HKHiago Kin Levi
← Back to Papers

Paper Files / Phishing

Adaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees

PhishingEN

TITLE: Adaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees ABSTRACT: Phishing remains one of the primary vectors of compromise in the global cybersecurity landscape in 2025, combining social engineering, ephemeral infrastructure, and advanced AI‑driven evasion techniques. In this work, we propose a multimodal architecture for adaptive phishing detection grounded in formal adversarial risk modeling with an explicit constraint on the attacker’s operational cost. We formalize the problem as a strategic game between a budget‑constrained adversary $\epsilon$ and a classifier $f$, defining the adversarial risk $R(f,\mathcal{A}_\epsilon)$ and establishing quantitative conditions for $\epsilon$‑adversarial robustness. We demonstrate that the convex fusion of modalities — lexical, structural (DOM), Transformer‑based semantic, and visual perceptual — preserves separation margins under hypotheses of partial independence of perturbations, thereby increasing the economic cost of evasion. The architecture is trained via min–max optimization with an internal adversary parameterized by realistic transformations, including IDN homographs, syntactic mutations, and dynamic obfuscation. We evaluate the system on a dataset of 1.2 million URLs derived from established public sources, with confidence intervals obtained through stratified bootstrap. Results indicate an AUC of 0.997 and an F1 score of 0.986, while maintaining average latency below 35 ms after INT8 quantization. Under targeted attacks, the detection rate remained above 94%, outperforming unimodal models. We discuss the economic implications of multimodal robustness, integration with modern controls such as TLS fingerprinting and telemetry via eBPF, and alignment with AI governance and digital identity guidelines. We conclude that the combination of formal foundations and practical engineering enables measurable robustness guarantees without compromising enterprise operational requirements.

  1. Introduction

Phishing constitutes one of the most persistent and economically damaging threats in the contemporary digital ecosystem. The Data Breach Investigations Report indicates that a substantial portion of breaches involves social engineering and credential theft (VERIZON, 2024). In the MITRE ATT&CK framework, phishing campaigns are primarily formalized by technique T1566 (Phishing), often chained with T1021 (Remote Services) for lateral movement and persistence (MITRE, 2024).

From a formal perspective, we model phishing as a strategic game between an adversary $\mathcal{A}$ and a classifier $f$. Let $\mathcal{X}$ be the space of web artifacts (URLs, rendered HTML pages, structured emails, multimedia objects) and $\mathcal{Y}={0,1}$, where $1$ denotes phishing. The adversary constructs $x\in\mathcal{X}$ with the objective of inducing a victim to reveal a secret $s\in\mathcal{S}$, typically credentials aligned with the digital identity guidelines of NIST SP 800-63-4 (NIST, 2023).

The complexity arises from adversarial adaptability, which includes IDN homographic domains, fast-flux DNS, abuse of legitimate services, automated content generation by generative models, and dynamic JavaScript obfuscation. Such strategies expand the space of admissible transformations, requiring explicit formal modeling of cost and robustness.

The research questions are:

RQ1: How can detector robustness be formally modeled under an adaptive adversary with a limited budget?

RQ2: In what way does multimodal fusion reduce the formal surface of evasion?

RQ3: Is it possible to obtain quantitative guarantees while maintaining latency below 50 ms in a corporate environment?

Our contributions include the formal definition of adversarial risk with explicit cost, the proposal of a convex multimodal architecture with min–max training, and statistically robust evaluation.

  1. Background and Related Work

Let $\mathcal{D}$ be an unknown distribution over $\mathcal{X}\times\mathcal{Y}$. The expected risk is

$$ \mathcal{R}(f)=\mathbb{E}_{(x,y)\sim\mathcal{D}}[\ell(f(x),y)], $$

where $\ell$ is the logarithmic loss.

Classical approaches include blacklists (GOOGLE, 2024), lexical techniques (GARERA et al., 2007), online learning (MA et al., 2009), and structural inspection (CANALI et al., 2011). Visual similarity–based methods were introduced by Fu et al. (2006). Deep models such as URLNet (ZHANG et al., 2018) and Transformer representations (DEVLIN et al., 2019; BROWN et al., 2020) expanded predictive performance.

In the adversarial context, Goodfellow, Shlens, and Szegedy (2015) and Papernot et al. (2017) demonstrated structural vulnerabilities in neural networks. Subsequent work formalized robust training as a min–max problem. By 2025, the incorporation of language model security and LLM abuse detection had become an integral part of defensive strategies (OWASP, 2024; NIST, 2024).

  1. Threat Model and Formal Guarantees

We define $\mathcal{T}_\epsilon={T:\mathcal{X}\rightarrow\mathcal{X}\mid c(T)\le\epsilon}$, where $c$ represents measurable operational cost. The adversarial risk is

$$ R(f,\mathcal{A}\epsilon)=\mathbb{E}{(x,y)\sim\mathcal{D}}\left[\max_{T\in\mathcal{T}_\epsilon}\ell(f(T(x)),y)\right]. $$

Definition: $f$ is $\epsilon$-robust if

$$ R(f,\mathcal{A}_\epsilon)-\mathcal{R}(f)\le\delta. $$

Proposition 1. If each modality $i$ has margin $\gamma_i$ under independent perturbations bounded by $\epsilon_i$, then convex fusion with weights $w_i$ satisfies

$$ \gamma \ge \sum_i w_i \gamma_i. $$

Proof. By convexity of $\ell$ and linearity of the combination, we have $\ell(\sum_i w_i f_i(x))\le\sum_i w_i \ell(f_i(x))$. The aggregated margin is lower-bounded by the weighted combination of the individual margins, concluding the result.

  1. Proposed Methodology

We extract four representations $\phi_{EL},\phi_{AE},\phi_{ES},\phi_{SV}$. The aggregated vector is

$$ \phi(x)=\sum_{i=1}^{4} w_i \phi_i(x), \quad \sum_i w_i=1,; w_i\ge0. $$

Robust training solves

$$ \min_f \mathbb{E}{(x,y)}\left[\max{T\in\mathcal{T}_\epsilon}\ell(f(T(x)),y)\right]. $$

We integrate TLS fingerprinting (JA3/JA4), X.509 certificate attributes, and behavioral telemetry collected via eBPF in a Linux environment, respecting isolation and the principle of least privilege.

Dominant complexity: Transformer embedding $O(nd)$, where $n$ is the sequence length and $d$ the vector dimension.

  1. Implementation

We implemented the system in Python 3.11 with PyTorch 2.2 and CUDA 12 acceleration. Rendering occurs in Docker containers with restrictive seccomp policies. Simplified example:

with torch.no_grad():
    logits = model(batch_inputs)
    probs = torch.softmax(logits, dim=1)

Dynamic INT8 quantization reduced average latency from 47 ms to 31.8 ms. Throughput: 2,400 URLs/s on a dual Xeon Gold 6338 server with an NVIDIA A100 80GB GPU.

  1. Experimental Evaluation

Dataset: 1,200,000 URLs (PHISHTANK, 2024; OPENPHISH, 2024; GOOGLE, 2024). Split 70/15/15. 95% confidence intervals via bootstrap.

Metric Value 95% CI
Accuracy 98.74% ±0.31
F1-score 0.986 ±0.004
AUC 0.997 ±0.001
FPR 1.98% ±0.22

Under an IDN homograph attack, robustness reached 94.3%, outperforming lexical CNN (82.1%). Statistical tests ($p<0.01$) confirmed significance.

  1. Discussion

Multimodal fusion imposes combinatorial cost on the adversary. If each modality requires minimum cost $\epsilon_i$, the aggregated cost approaches $\sum_i \epsilon_i$, raising the economic barrier.

Integration with CNAPP platforms and continuous monitoring enables orchestrated response. AI governance considerations follow the guidelines of the NIST AI RMF (NIST, 2024) and the OWASP Top 10 for LLM Applications (OWASP, 2024).

Limitations include dependence on full rendering and potential sampling bias. Zero-day attacks with highly personalized content generated by LLMs remain an open challenge.

  1. Conclusion and Future Work

We demonstrated that integrating formal adversarial modeling with multimodal deep learning produces measurable robustness gains while maintaining adequate operational latency.

Future work includes post-quantum cryptography to protect telemetry (NIST, 2024b), federated learning with differential privacy, and formal verification of robustness properties via SMT.

References

BROWN, T. et al. Language models are few-shot learners. NeurIPS, 2020. Available at: https://arxiv.org/abs/2005.14165

CANALI, D. et al. Prophiler: a fast filter for the large-scale detection of malicious web pages. In: WWW, 2011. Available at: https://dl.acm.org/doi/10.1145/1963405.1963484

DEVLIN, J. et al. BERT: pre-training of deep bidirectional transformers. In: NAACL, 2019. Available at: https://aclanthology.org/N19-1423/

FU, A. Y. et al. Detecting phishing web pages with visual similarity assessment. In: NDSS, 2006. Available at: https://www.ndss-symposium.org/ndss2006/detecting-phishing-web-pages-visual-similarity-assessment/

GARERA, S. et al. A framework for detection of phishing attacks. In: WORM, 2007. Available at: https://dl.acm.org/doi/10.1145/1314389.1314391

GOOGLE. Google Safe Browsing API. 2024. Available at: https://developers.google.com/safe-browsing

GOODFELLOW, I.; SHLENS, J.; SZEGEDY, C. Explaining and harnessing adversarial examples. ICLR, 2015. Available at: https://arxiv.org/abs/1412.6572

MA, J. et al. Beyond blacklists: learning to detect malicious web sites. In: ACM CCS, 2009. Available at: https://dl.acm.org/doi/10.1145/1653662.1653724

MITRE. ATT&CK Framework. 2024. Available at: https://attack.mitre.org

NIST. Digital Identity Guidelines SP 800-63-4. 2023. Available at: https://pages.nist.gov/800-63-4/

NIST. AI Risk Management Framework 1.0. 2024. Available at: https://www.nist.gov/itl/ai-risk-management-framework

NIST. Post-Quantum Cryptography Standardization. 2024b. Available at: https://csrc.nist.gov/projects/post-quantum-cryptography

OPENPHISH. Phishing Intelligence Feed. 2024. Available at: https://openphish.com

OWASP. Phishing Prevention Cheat Sheet. 2023. Available at: https://cheatsheetseries.owasp.org

OWASP. Top 10 for Large Language Model Applications. 2024. Available at: https://owasp.org/www-project-top-10-for-large-language-model-applications/

PAPERNOT, N. et al. Practical black-box attacks against machine learning. In: ASIA CCS, 2017. Available at: https://dl.acm.org/doi/10.1145/3052973.3053009

PHISHTANK. PhishTank Dataset. 2024. Available at: https://phishtank.org

VERIZON. Data Breach Investigations Report. 2024. Available at: https://www.verizon.com/business/resources/reports/dbir/

ZHANG, Y. et al. URLNet: learning a URL representation. In: ACM CCS, 2018. Available at: https://dl.acm.org/doi/10.1145/3243734.3243985