🤖 AI Summary
This study addresses the limitations of existing phishing defenses in detecting template reuse and coordinated attacks by proposing a DOM tree-based fingerprinting approach coupled with hierarchical Jaccard distance metrics. By integrating HTML tag content augmentation with unsupervised clustering algorithms, the method enables precise extraction and visual analysis of webpage structural features. This approach effectively uncovers latent similarities among phishing sites, significantly enhancing the detection of emerging and zero-day templates. Furthermore, it provides robust technical support for coordinated threat analysis, thereby bridging critical gaps in traditional defense systems regarding structured correlation analysis. Collectively, this work advances phishing detection capabilities through rigorous structural feature engineering and similarity measurement.
📝 Abstract
Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats