PHISHREV: A Hybrid Machine Learning and Post-Hoc Non-monotonic Reasoning Framework for Context-Aware Phishing Website Classification

1. Problem Statement

Phishing detection systems currently rely heavily on statistical machine learning (ML) and deep learning models trained on static datasets. While effective at identifying known patterns, these models suffer from several critical limitations:

• Lack of Contextual Reasoning: They rely on statistical correlations rather than logical reasoning, making them vulnerable to adversarial manipulation (e.g., typo-squatting, character swapping).
• Static Nature: Once trained, these models cannot easily adapt to new attack patterns or incorporate new domain knowledge without costly retraining.
• False Positives: Purely lexical-based classifiers often misclassify legitimate sites or fail to catch sophisticated phishing attempts that mimic legitimate URL structures.
• Inflexibility: Incorporating new rules (e.g., specific meta-tag behaviors) typically requires re-engineering features and retraining the entire model.

The authors argue that phishing detection requires human-like reasoning and belief revision capabilities to handle dynamic, incomplete, or contradictory information in real-world environments.

2. Methodology: The PHISHREV Framework

The proposed solution is a dual-stage hybrid framework that combines data-driven statistical learning with symbolic non-monotonic reasoning.

Phase 1: Statistical Learning (Initial Belief Generation)

• Input: A dataset of 11,430 URLs (50% phishing, 50% legitimate) containing 87 lexical features.
• Process:
  • Features are normalized using a Standard Scaler.
  • Four standard ML classifiers are trained: Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Decision Tree (DT), and Random Forest (RF).
  • The classifiers generate an initial prediction ($C \in \{0, 1\}$), representing the "initial belief" regarding whether a URL is legitimate or phishing.

Phase 2: Post-Hoc Non-Monotonic Reasoning (Belief Revision)

• Core Concept: This layer uses Answer Set Programming (ASP) via the Clingo solver to perform non-monotonic reasoning. Unlike monotonic logic (where adding facts never invalidates previous conclusions), non-monotonic reasoning allows the system to withdraw or revise conclusions when new, contradictory evidence arises.
• Knowledge Base Construction:
  • Classifier predictions are encoded as facts: pred(CL, ID, C).
  • Meta-tag availability is extracted by parsing the actual web pages for metadata (description, keywords, author). This is encoded as: meta(ID, M) where $M \in \{yes, no\}$.
• The Reasoning Rule:
  The system applies a domain-specific axiom: If a URL is predicted as phishing but contains valid meta-tags (a characteristic of legitimate sites), the prediction is revised to "benign."
  • Logic: If $C = \text{phishing} \land M = \text{yes} \rightarrow \text{Final Belief} = \text{benign}$.
  • Otherwise, the classifier's original prediction stands.
• Outcome: This layer acts as a "post-hoc" filter that selectively revises specific instances based on symbolic rules rather than statistical thresholds.

3. Key Contributions

1. Hybrid Framework: Integration of ML classifiers with an ASP-based non-monotonic reasoning layer for context-aware decision refinement.
2. Novel Feature Engineering: Construction of a binary feature indicating meta-tag availability by independently parsing web pages, distinguishing between legitimate sites (which usually have meta-tags) and phishing sites (which often omit them).
3. Efficient Knowledge Integration: The ability to incorporate new domain knowledge (e.g., new evasion strategies or legitimacy signals) into the reasoning layer in $O(n)$ time without retraining the underlying ML models.
4. Formal Belief Revision: Demonstration of using formal logic to withdraw incorrect classifier predictions when contradictory evidence (meta-tags) is present.

4. Experimental Results

The framework was evaluated on a dataset split into 80% training and 20% testing (2,286 test instances).

• Initial Classifier Performance:

  • Random Forest (RF) achieved the highest accuracy at 95.89%, followed by SVM (96.32% - Note: Table I shows SVM slightly higher, but RF is often cited as the best performer in the text context).
  • All classifiers showed high precision and recall (>0.94).

• Belief Revision Impact:

  • The reasoning module revised 465 out of 9,144 total predictions (approx. 5.08% of decisions).
  • False Positive (FP) Reduction: The revision layer consistently reduced false positives across all classifiers:
    • SVM: 41 $\to$ 30
    • KNN: 47 $\to$ 34
    • DT: 69 $\to$ 48
    • RF: 49 $\to$ 35
  • Case Study: The system successfully corrected instances where classifiers predicted "phishing" but the presence of meta-tags indicated "legitimate," and vice versa.

• Complexity Comparison:

  • Training Complexity: $O(T \cdot n \cdot f \cdot \log n)$ (same as standard ML).
  • NMR Overhead: $O(n)$ (linear time).
  • Retraining: Not required for the ML models when updating the reasoning rules, offering a significant advantage over state-of-the-art monotonic methods.

5. Significance and Conclusion

PHISHREV addresses the rigidity of traditional phishing detection systems. By decoupling the statistical learning phase from the decision refinement phase, it offers a flexible architecture that can adapt to new threats without the computational cost of retraining deep learning models.

• Advantages:
  • Reduces "alert fatigue" by lowering false positives.
  • Provides interpretability through symbolic rules (ASP).
  • Enables rapid incorporation of expert knowledge.
• Limitations & Future Work:
  • The current system relies on a single hand-crafted rule (meta-tag availability).
  • Adversarial attackers may begin mimicking meta-tag behaviors to fool the reasoning layer.
  • Future work aims to incorporate multi-rule reasoning strategies and additional contextual evidence to handle sophisticated adversarial replication.

In summary, PHISHREV demonstrates that combining statistical prediction with symbolic non-monotonic reasoning creates a more robust, adaptable, and context-aware defense against phishing attacks.