cs.LGAug 17, 2026

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Authors: Unai Agirre, Imanol Jerico, Felipe Castaño, Andrea Venturi, Francesco Zola

Organizations: Digital Security Department, Vicomtech (BRTA), Donostia / San Sebastian, Spain · University of Le´on, Le´on, Spain

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats

Figures & tables

Fig. 1 : Example of a tree extracted from an HTML DOM.
 FeaturesDescription
1Number of nodesIt represents the total count of HTML elements within the pruned DOM tree, indicating the overall structural complexity of the web page.
2Number of edgesIt quantifies the total hierarchical and relational links between elements. A high edge-to-node ratio often suggests a more complex layout.
3Maximum centralityIt identifies the most interconnected node in the graph. In phishing, this often corresponds to a central container or a critical form element [ 22 ] .
4Minimum centralityIt measures the lowest degree of connectivity, helping to identify peripheral elements or isolated scripts often used for obfuscation [ 22 ] .
5Centrality on averageThis feature provides a global measure of structural importance across all elements, capturing the general density of the page’s architecture [ 23 ] .
TABLE I : List of structural properties extracted from the tree.
Fig. 2 : Schema of the qualitative validation steps followed during the analysis.
AlgorithmsParameterValues
DBSCANϵ\epsilon{0.1, 0.2,…, 1.0}, step=0.1
min_samples2, 3, 5, 8, 10
OPTICSxixi{0.1, 0.2,…, 1.0}, step=0.1
min_samples2, 3, 5, 8, 10
AHCtt5, 25, 50, 75, 100
TABLE II : Grid search parameters for clustering algorithms.
Fig. 3 : DBSCAN Sscore\mathcal{S}_{score} during the grid-search using only structural features.
Fig. 4 : OPTICS Sscore\mathcal{S}_{score} during the grid-search using only structural features.
Fig. 5 : AHC Sscore\mathcal{S}_{score} during the grid-search using only structural features.
TABLE III : Metrics of the best configuration of each algorithms for each level. NcN_{c} indicates the number of generated clusters; No%N_{o\%} the number of samples in percentage clustered as noisy points; Si%S_{i\%} the number of cluster in percentage that have only one sample within. For each metric and each algorithm, the best metric value is shown in bold, while the model selected as the best performer is highlighted in yellow.
AlgorithmsFeaturesParametersLevelLJDmean\mathcal{LJD}_{mean}LJDstd\mathcal{LJD}_{std}LJDmax\mathcal{LJD}_{max}# Cluster with LJD(C)=0\mathcal{LJD(C)}=0
DBSCANstructuralϵ=0.6\epsilon=0.6 , min_samples = 10140.9030.0520.9630
structural + contentϵ=0.9\epsilon=0.9 , min_samples = 280.1580.2540.979133
OPTICSstructuralxi=0.1xi=0.1 , min_samples = 2110.5920.3681.09387
structural + contentxi=0.3xi=0.3 , min_samples = 280.2420.3051.088170
AHCstructuralt=75.0t=75.0140.9010.0470.9590
structural + contentt=5.0t=5.0150.3510.3351.03655
TABLE IV : Best configuration for each algorithm using structural and content-based information, and the corresponding results obtained during quantitative validation. In bold the best values in each case.
Fig. 6 : Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural based features. Changes are marked with a black circle.
Fig. 7 : Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural and content-based features. Changes are marked with a black circle.
Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 8 : AHC Sscore\mathcal{S}_{score} during the grid-search using structural and content-based features.
Fig. 9 : DBSCAN Sscore\mathcal{S}_{score} during the grid-search using structural and content-based features.
Fig. 10 : OPTICS Sscore\mathcal{S}_{score} during the grid-search using structural and content-based features.
Fig. 11 : Qualitative analysis: - medoids of NN dispersed clusters.
More in this topic

Unsupervised Clustering

Unsupervised clustering groups unlabeled data by similarity or structure to reveal patterns, subgroups, and anomalies.

See all 117 papers

Explore similar work

CardsList
Mar 2, 2026

Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection

Phishing remains the most pervasive threat to the Web, enabling large-scale credential theft and financial fraud through deceptive webpages. While recent reference-based and generative-AI-driven phishing detectors achieve strong accuracy, their reliance on external knowledge bases, cloud services, and complex multimodal pipelines fundamentally limits practicality, scalability, and reproducibility. In contrast, conventional deep learning approaches often fail to generalize to evolving phishing campaigns. We introduce SpecularNet, a novel lightweight framework for reference-free web phishing detection that demonstrates how carefully designed compact architectures can rival heavyweight systems. SpecularNet operates solely on the domain name and HTML structure, modeling the Document Object Model (DOM) as a tree and leveraging a hierarchical graph autoencoding architecture with directional, level-wise message passing. This design captures higher-order structural invariants of phishing webpages while enabling fast, end-to-end inference on standard CPUs. Extensive evaluation against 13 state of the art phishing detectors, including leading reference-based systems, shows that SpecularNet achieves competitive detection performance with dramatically lower computational cost. On benchmark datasets, it reaches an F1 score of 93.9%, trailing the best reference-based method slightly while reducing inference time from several seconds to approximately 20 milliseconds per webpage. Field and robustness evaluations further validate SpecularNet in real-world deployments, on a newly collected 2026 open-world dataset, and against adversarial attacks.

Tailai Song, Pedro Casas, Michela Meo

Politecnico di Torino Turin, Italy · AIT Austrian Institute of Technology Vienna, Austria

Phishing DetectionGraph Neural Networks
AskPDF
Apr 23, 2026

TraceScope: Interactive URL Triage via Decoupled Checklist Adjudication

Modern phishing campaigns increasingly evade snapshot-based URL classifiers using interaction gates (e.g., checkbox/slider challenges), delayed content rendering, and logo-less credential harvesters. This shifts URL triage from static classification toward an interactive forensics task: an analyst must actively navigate the page while isolating themselves from potential runtime exploits. We present TraceScope, a decoupled triage pipeline that operationalizes this workflow at scale. To prevent the observer effect and ensure safety, a sandboxed operator agent drives a real GUI browser guided by visual motivation to elicit page behavior, freezing the session into an immutable evidence bundle. Separately, an adjudicator agent circumvents LLM context limitations by querying evidence on demand to verify a MITRE ATT&CK checklist, and generates an audit-ready report with extracted indicators of compromise (IOCs) and a final verdict. Evaluated on 708 reachable URLs from existing dataset (241 verified phishing from PhishTank and 467 benign from Tranco-derived crawling), TraceScope achieves 0.94 precision and 0.78 recall, substantially improving recall over three prior visual/reference-based classifiers while producing reproducible, analyst-grade evidence suitable for review. More importantly, we manually curated a dataset of real-world phishing emails to evaluate our system in a practical setting. Our evaluation reveals that TraceScope demonstrates superior performance in a real-world scenario as well, successfully detecting sophisticated phishing attempts that current state-of-the-art defenses fail to identify.

Haolin Zhang, William Reber, Yuxuan Zhang +2

Texas A&M University

Digital ForensicsPhishing Detection
AskPDF
May 30, 2026

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features

Phishing attacks remain a major cybersecurity threat, exploiting deceptive URLs to steal sensitive user information. Traditional blacklist and rule-based detection approaches are reactive and often fail to identify newly emerging phishing URLs. This paper proposes a lightweight hybrid framework for real-time phishing URL detection that combines blacklist-based screening with a Multi-Layer Perceptron (MLP) classifier operating solely on structural URL features. The framework extracts 16 URL-derived features capturing structural, domain-based, and security-related characteristics without requiring webpage content access, third-party APIs, or visual rendering, making it computationally efficient for real-time deployment. The system was trained and evaluated on the PhiUSIIL phishing dataset containing 235,795 labelled URLs. Experimental results show that the proposed MLP achieved 99.24% accuracy, 98.74% precision, 99.95% recall, 99.34% F1-score, and 99.65% ROC-AUC, outperforming Random Forest, Logistic Regression, XGBoost, LightGBM, and CatBoost under the same evaluation setting. The hybrid architecture achieved an average inference latency of 1.2 ms per URL and a peak throughput of 4,200 URLs per second under concurrent processing. A functional desktop application prototype, CyberGuard, further demonstrates deployment viability. The results indicate that the proposed framework provides an accurate and computationally efficient solution for real-time phishing URL detection in resource-constrained environments.

Uche Unoke Emmanuel, Gideon Francis Oghie

Department of Cyber Security Science, School of Information and Communication Technology, Federal University of Technology, Minna, Nigeria

Multilayer PerceptronsPhishing Detection
AskPDF