Auto Updating Fuzzy Logic Powered Phishing Detection Engine

Phishing is the most common precursor for a cyber-, malware-,--, or spyware- attack. To curtail attacks, malware and web browser detection engines, similar to other research studies, rely on publicly available past-performance datasets and crowd -sourcing to train their internal algorithms. Such a generic implementation ensures that their relevance declines over time as cyber-attacks gain sophistication and eventually become harder to detect. This study detects phishing webpages with an accuracy rate of > 97% (AUC ≈ 0.97 – 1.0) via dynamically derived features and weights generated using Classification Based on Association (CBA). This study commenced with static model analysis where FL would generate an AUC of 1.0. However, this would overfit due to old patterns and the rate of detection would eventually decline by 15% over time to an AUC of 0.85–0.90. The study was updated to deploy data drift analysis to detect significant degradation (>5%) which eventually occurred due to evolving phishing patterns. This led to the creation of an adaptive (or auto-updating) fuzzy system which used regenerated (or adapted) features, weights, rules and other FL aspects to ensure an AUC ≈ of 0.97 – 1.0. These adapted features and weights were fed back into the model and confirmed post -verification of improvement in detection ratios. This ensured that this model could be left unattended while the adaptive data drift did not deviate, underscoring the importance of data-driven feature tuning in maintaining detection efficacy in evolving threat landscapes. This process may require user intervention but only upon graceful degradation. However, if the fuzzy system was operating constantly then it would continue to learn and evolve without human interaction. This research may be improved by removing the slight possibility of manual intervention. This would be archived by developing generic terminology and an internal knowledge engine that tracks, maintains, and implements changes in adaptive nomenclature.