Some phishing emails may have poor grammar and spelling are rarely perfect or the layout may be askew and not exactly what one would expect from a legitimate organization. Such phishing attacks are relatively easy to spot, but the close-to-perfect ones may well not be and protective systems on one's device are then needed to avoid the user being duped into clicking a malicious link.

Writing in the International Journal of Information Privacy, Security and Integrity a team from China has developed a deep learning-based framework that might be used to detect phishing websites. Huanhuan Wang, Debin Cheng, and Hui Peng of the Fifth Electronic Research Institute of Ministry of Industry and Information Technology in Guangzhou, China, explain how their framework can extract descriptive and statistical features from a website and then determine whether these features are indicative of a phishing website. The detection of such sites could then be used in online security research and perhaps even be incorporated into browsers to protect unwary users from being phished.

The team has tested their system against two databases, one containing the website address (uniform resource locators, URLs) of 10,000 legitimate and otherwise benign sites and 13,000 URLs found in the PhishTank public dataset of sites that have previously been themselves hooked and identified as malicious. The team has demonstrated a detection accuracy of almost 99 percent, which they say is a significant improvement on earlier phish detection methods. The approach they have taken might also point to new areas of research in this area and the development and optimization of detection systems that can be incorporated into security systems for mobile and desktop devices.