An Effective and Robust Similarity-Based Phishing Website Detector in Cyber-Physical Systems

To safeguard Cyber-Physical Systems (CPS) from phishing attacks, a similarity-based phishing website detector is provided to inspect various website components, such as screen-shots, the Document Object Model (DOM) and the Cascading Style Sheets (CSS), to enhance the effectiveness and robustness. A decision-level multimodal fusion network with an innovative multilayer perceptron (MLP) architecture is designed and im-plemented to integrate different classification models tailored to individual website components, achieving improved detection accuracy while keeping computational costs low. In addition, for improving the robustness to the adversarial perturbations, a novel classification-confidence based binary discriminator is suggested. The MLP architecture and the classification-confidence-based adversarial detection method are two of the key innovations in our work. A comprehensive dataset comprising 17,747 samples from the web sites of 200 well-known companies and institutions has been generated for model training and performance evaluation. A series of experiments were conducted on this real-world dataset, demonstrating that integrating different state-of-the-art (SOTA) models tailored to single website components can potentially lead to increased effectiveness across various components, higher detection accuracy, and enhanced robustness against adversarial perturbations. In the experiment of the website classification accuracy, an Fl-score of 0.9691 is achieved by the provided phishing detector, surpassing all the three single-component-based detectors. In addition, The top-l accuracy of 0.9692 also outperforms majority voting baseline of multimodal fusion. Furthermore, the provided detector was applied on an adversarial modification examples driven from the above mentioned dataset, the results shows a over 90 % adversarial modification detection rate across the attack to three website components.