| --- |
| license: mit |
| tags: |
| - cybersecurity |
| - phishing-detection |
| - computer-vision |
| - resnet50 |
| - brand-impersonation |
| datasets: |
| - circl-phishing |
| - openphish |
| - kaggle-webpage-phishing |
| metrics: |
| - accuracy |
| - precision |
| - recall |
| - f1 |
| pipeline_tag: image-classification |
| --- |
| |
| # Ph5 Webpage Screenshot Classifier: Visual Brand Impersonation Detector (ResNet-50) |
|
|
| <p align="center"> |
| <img src="https://img.shields.io/badge/Model-ResNet--50-blue.svg" alt="Model"> |
| <img src="https://img.shields.io/badge/Test%20Accuracy-79.00%25-brightgreen.svg" alt="Test Accuracy"> |
| <img src="https://img.shields.io/badge/Val%20Accuracy-83.30%25-green.svg" alt="Val Accuracy"> |
| <img src="https://img.shields.io/badge/F1--Score-77.34%25-success.svg" alt="F1 Score"> |
| <img src="https://img.shields.io/badge/Latency-28.5ms-orange.svg" alt="Latency"> |
| <img src="https://img.shields.io/badge/License-MIT-purple.svg" alt="License"> |
| </p> |
|
|
| ## Model Summary |
|
|
| The **Ph5 Screenshot Classifier** is a deep convolutional neural network based on `ResNet-50` fine-tuned to classify webpage landing page screenshots and identify fraudulent brand impersonation, visual cloning, and deceptive graphical credential-harvesting interfaces. |
|
|
| It forms the visual inspection modality of the **Ph5 Multimodal Cybersecurity Framework**, closing critical blind spots where attackers host phishing forms on trusted infrastructure (such as Microsoft Forms, Notion, or SharePoint) that easily bypass lexical URL filters. |
|
|
| --- |
|
|
| ## Performance & Evaluation Benchmark |
|
|
| Evaluated on an independent, held-out test partition of **438 webpage screenshots** (248 Benign, 190 Phishing): |
|
|
| | Metric | Held-Out Test Split (N = 438) | Peak Validation Split (N = 438) | |
| | :--- | :--- | :--- | |
| | **Accuracy** | **79.00%** | **83.30%** | |
| | **Precision** | **72.69%** | **78.20%** | |
| | **Recall** | **82.63%** | **85.10%** | |
| | **F1-Score** | **77.34%** | **81.50%** | |
| | **Inference Latency** | **28.5 ms** | Batch Size = 1 (RTX 3050 Laptop GPU) | |
|
|
| ### Baseline Comparison |
|
|
| | Architecture | Test Accuracy | Precision | Recall | F1-Score | Latency | |
| | :--- | :--- | :--- | :--- | :--- | :--- | |
| | MobileNetV2 | 76.10% | 70.20% | 79.40% | 74.51% | 14.0 ms | |
| | VGG-16 | 77.40% | 71.10% | 80.50% | 75.51% | 42.0 ms | |
| | **Ph5 ResNet-50 (This Model)** | **79.00%** | **72.69%** | **82.63%** | **77.34%** | **28.5 ms** | |
|
|
| --- |
|
|
| ## Confusion Matrix (Test Split: N = 438) |
|
|
| ```text |
| Predicted |
| Benign Phishing |
| Benign 189 59 |
| Phishing 33 157 |
| ``` |
|
|
| --- |
|
|
| ## Intended Use & Integration |
|
|
| ### PyTorch Inference |
|
|
| ```python |
| import torch |
| import torchvision.models as models |
| import torchvision.transforms as transforms |
| from PIL import Image |
| |
| # Initialize ResNet-50 architecture |
| model = models.resnet50(weights=None) |
| model.fc = torch.nn.Sequential( |
| torch.nn.Dropout(0.3), |
| torch.nn.Linear(2048, 2) |
| ) |
| |
| # Load state dict |
| state_dict = torch.load("best_model.pth", map_location="cpu") |
| model.load_state_dict(state_dict) |
| model.eval() |
| |
| # Preprocessing transforms |
| transform = transforms.Compose([ |
| transforms.Resize((256, 256)), |
| transforms.CenterCrop((224, 224)), |
| transforms.ToTensor(), |
| transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225]) |
| ]) |
| |
| image = Image.open("screenshot.png").convert("RGB") |
| tensor = transform(image).unsqueeze(0) |
| |
| with torch.no_grad(): |
| logits = model(tensor) |
| probs = torch.softmax(logits, dim=-1).squeeze().tolist() |
| |
| print(f"Benign: {probs[0]:.4f}") |
| print(f"Phishing: {probs[1]:.4f}") |
| ``` |
|
|
| --- |
|
|
| ## Training Configuration & Data Provenance |
|
|
| - **Pretrained Backbone:** `ResNet-50` (ImageNet-1k initialized weights) |
| - **Classification Head:** `Dropout(0.3) + Linear(2048, 2)` |
| - **Dataset Composition (2,915 screenshots total):** |
| - **Benign Pages (1,648):** 1,101 from Kaggle Webpage Phishing collection, 501 from CIRCL open dataset, 46 multi-path headless Chrome captures. |
| - **Phishing Pages (1,267):** 515 from Kaggle, 444 captured via automated Headless Chrome from live OpenPhish feeds, 273 from CIRCL Luxembourg, 35 curated threat feeds. |
| - **Split:** 70% Train (2,039) / 15% Validation (438) / 15% Test (438) |
| - **Optimizer:** AdamW (learning rate = 1e-4, weight decay = 0.0001) |
| - **Epochs:** 25 epochs with ReduceLROnPlateau scheduler |
|
|
| --- |
|
|
| ## Citation & Framework |
|
|
| ```bibtex |
| @article{devi2026ph5, |
| title={Ph5: A Multimodal Framework for Cross-Modality Evasion-Resilient Phishing Detection in Multi-Vector Environments}, |
| author={Ritu Devi Deepti Singh and Akash Sah}, |
| journal={Journal of Computer & Mathematical Sciences / JCMM}, |
| year={2026} |
| } |
| ``` |
|
|
