Contrastive learning of prototypical network for detecting phishing URL

Abstract Phishing attacks are a significant issue in cybersecurity, and extensive efforts with machine learning methods have been made to detect them. The high similarity between benign and phishing URLs requires a substantial amount of data for effective training, but ever-changing attacks hinder us from preparing for sufficient data. To cope with the issue of limited data, this paper proposes a triplet-sampled prototypical network, which learns the characteristics of URL samples for various phishing classes with appropriate prototypes trained with contrastive learning. For a new input URL, the learned model finds the most similar prototypes contrasted by themselves and calculates the average distance to judge whether it is phishing or not. Experiments with the three benchmark datasets of ISCX-URL-2016, PhishStorm, and PhishTank show an impressive performance of 99.83%, 98.61%, and 97.79%, respectively. Additional experiment with 100-, 10-, 5-, and 1-shot scenarios demonstrates that the proposed method allows for efficient and effective detection of phishing URLs even with a limited number of training data.