用语义特征+量化强化学习，精准识别钓鱼链接
Deep Reinforcement Learning for Phishing Detection with Transformer-Based Semantic Features
- 结合RoBERTa语义与手工特征，用分位数DQN建模收益分布
- 测试准确率99.86%，召回率达99.96%，显著优于传统方法
- 适合需要高鲁棒性、应对新型攻击的网络安全场景
网络钓鱼通过伪造消息、误导广告和被劫持的合法网站诱骗用户泄露个人信息，常导致财务损失。本文提出一种基于分位数回归的深度Q网络（QR-DQN）方法，融合RoBERTa语义嵌入与人工设计的词汇特征，以提升钓鱼检测能力并处理不确定性。与传统DQN仅预测单一标量Q值不同，QR-DQN通过分位数回归建模回报分布，增强对未见钓鱼数据的稳定性和泛化能力。研究收集了来自PhishTank、OpenPhish、Cloudflare等来源的10.5万条URL，采用80/20划分训练与测试集。实验表明，该框架在测试集上达到99.86%的准确率、99.75%的精确率、99.96%的召回率和99.85%的F1分数，表现出卓越效果。相比仅使用词汇特征的标准DQN，融合语义与词汇特征的混合模型将泛化误差从1.66%降至0.04%，显著提升鲁棒性。五折交叉验证确认模型可靠性，平均准确率为99.90%，标准差为0.04%。结果表明，该混合方法能有效识别钓鱼威胁，适应不断演化的攻击策略，并良好泛化至未知数据。
原文摘要 · Abstract (English)
Phishing is a cybercrime in which individuals are deceived into revealing personal information, often resulting in financial loss. These attacks commonly occur through fraudulent messages, misleading advertisements, and compromised legitimate websites. This study proposes a Quantile Regression Deep Q-Network (QR-DQN) approach that integrates RoBERTa semantic embeddings with handcrafted lexical features to enhance phishing detection while accounting for uncertainties. Unlike traditional DQN methods that estimate single scalar Q-values, QR-DQN leverages quantile regression to model the distribution of returns, improving stability and generalization on unseen phishing data. A diverse dataset of 105,000 URLs was curated from PhishTank, OpenPhish, Cloudflare, and other sources, and the model was evaluated using an 80/20 train-test split. The QR-DQN framework achieved a test accuracy of 99.86%, precision of 99.75%, recall of 99.96%, and F1-score of 99.85%, demonstrating high effectiveness. Compared to standard DQN with lexical features, the hybrid QR-DQN with lexical and semantic features reduced the generalization gap from 1.66% to 0.04%, indicating significant improvement in robustness. Five-fold cross-validation confirmed model reliability, yielding a mean accuracy of 99.90% with a standard deviation of 0.04%. These results suggest that the proposed hybrid approach effectively identifies phishing threats, adapts to evolving attack strategies, and generalizes well to unseen data.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。