--- license: mit tags: - cybersecurity - phishing-detection - computer-vision - resnet50 - brand-impersonation datasets: - circl-phishing - openphish - kaggle-webpage-phishing metrics: - accuracy - precision - recall - f1 pipeline_tag: image-classification --- # Ph5 Webpage Screenshot Classifier: Visual Brand Impersonation Detector (ResNet-50)

## Model Summary The **Ph5 Screenshot Classifier** is a deep convolutional neural network based on `ResNet-50` fine-tuned to classify webpage landing page screenshots and identify fraudulent brand impersonation, visual cloning, and deceptive graphical credential-harvesting interfaces. It forms the visual inspection modality of the **Ph5 Multimodal Cybersecurity Framework**, closing critical blind spots where attackers host phishing forms on trusted infrastructure (such as Microsoft Forms, Notion, or SharePoint) that easily bypass lexical URL filters. --- ## Performance & Evaluation Benchmark Evaluated on an independent, held-out test partition of **438 webpage screenshots** (248 Benign, 190 Phishing): | Metric | Held-Out Test Split (N = 438) | Peak Validation Split (N = 438) | | :--- | :--- | :--- | | **Accuracy** | **79.00%** | **83.30%** | | **Precision** | **72.69%** | **78.20%** | | **Recall** | **82.63%** | **85.10%** | | **F1-Score** | **77.34%** | **81.50%** | | **Inference Latency** | **28.5 ms** | Batch Size = 1 (RTX 3050 Laptop GPU) | ### Baseline Comparison | Architecture | Test Accuracy | Precision | Recall | F1-Score | Latency | | :--- | :--- | :--- | :--- | :--- | :--- | | MobileNetV2 | 76.10% | 70.20% | 79.40% | 74.51% | 14.0 ms | | VGG-16 | 77.40% | 71.10% | 80.50% | 75.51% | 42.0 ms | | **Ph5 ResNet-50 (This Model)** | **79.00%** | **72.69%** | **82.63%** | **77.34%** | **28.5 ms** | --- ## Confusion Matrix (Test Split: N = 438) ```text Predicted Benign Phishing Benign 189 59 Phishing 33 157 ``` --- ## Intended Use & Integration ### PyTorch Inference ```python import torch import torchvision.models as models import torchvision.transforms as transforms from PIL import Image # Initialize ResNet-50 architecture model = models.resnet50(weights=None) model.fc = torch.nn.Sequential( torch.nn.Dropout(0.3), torch.nn.Linear(2048, 2) ) # Load state dict state_dict = torch.load("best_model.pth", map_location="cpu") model.load_state_dict(state_dict) model.eval() # Preprocessing transforms transform = transforms.Compose([ transforms.Resize((256, 256)), transforms.CenterCrop((224, 224)), transforms.ToTensor(), transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225]) ]) image = Image.open("screenshot.png").convert("RGB") tensor = transform(image).unsqueeze(0) with torch.no_grad(): logits = model(tensor) probs = torch.softmax(logits, dim=-1).squeeze().tolist() print(f"Benign: {probs[0]:.4f}") print(f"Phishing: {probs[1]:.4f}") ``` --- ## Training Configuration & Data Provenance - **Pretrained Backbone:** `ResNet-50` (ImageNet-1k initialized weights) - **Classification Head:** `Dropout(0.3) + Linear(2048, 2)` - **Dataset Composition (2,915 screenshots total):** - **Benign Pages (1,648):** 1,101 from Kaggle Webpage Phishing collection, 501 from CIRCL open dataset, 46 multi-path headless Chrome captures. - **Phishing Pages (1,267):** 515 from Kaggle, 444 captured via automated Headless Chrome from live OpenPhish feeds, 273 from CIRCL Luxembourg, 35 curated threat feeds. - **Split:** 70% Train (2,039) / 15% Validation (438) / 15% Test (438) - **Optimizer:** AdamW (learning rate = 1e-4, weight decay = 0.0001) - **Epochs:** 25 epochs with ReduceLROnPlateau scheduler --- ## Citation & Framework ```bibtex @article{devi2026ph5, title={Ph5: A Multimodal Framework for Cross-Modality Evasion-Resilient Phishing Detection in Multi-Vector Environments}, author={Ritu Devi Deepti Singh and Akash Sah}, journal={Journal of Computer & Mathematical Sciences / JCMM}, year={2026} } ```