DPMLF: A Novel Phishing Detection Model Integrating URL Character and HTML Semantic Deep Features

Deep learning (DL) methods have been extensively applied in phishing detection, owing to their powerful feature-learning and classification capabilities. Nevertheless, generating deep feature vectors that can precisely characterize phishing behaviors is essential to effectively recognize and detect phishing attacks within the cyber realm. This study proposes DL phishing detection with multilevel features (DPMLF), a novel model crafted to boost phishing detection performance by integrating uniform resource locator (URL) character-level and HyperText Markup Language (HTML) word-level semantic features. DPMLF uses character embedding along with parallel convolutional kernels of diverse sizes to extract local URL features. HTML text adopts word-level embedding and stacked convolutional layers to capture both local and long-range dependencies. Subsequently, a fully connected layer merges these multilevel features into a fine-grained vector for classification. Moreover, DPMLF incorporates an incremental learning mechanism, enabling it to continuously update its knowledge base with new data. When evaluated on three public datasets sourced from GitHub, Kaggle, and Zenodo, DPMLF attained an average accuracy of 0.9900, precision of 0.9901, recall of 0.9899, and an F1-score of 0.9900.