IDENTIFYING URL OBFUSCATION TECHNIQUES IN FACEBOOK PHISHING URLS USING STRUCTURAL DETECTION RULES AND JACCARD SIMILARITY

Yasir Muin; Arifandy Mario Mamonto; Hairil Kurniadi Sirajuddin; Saiful Do Abdullah

doi:10.36549/ijis.v11i2.528

IDENTIFYING URL OBFUSCATION TECHNIQUES IN FACEBOOK PHISHING URLS USING STRUCTURAL DETECTION RULES AND JACCARD SIMILARITY

Yasir Muin, Arifandy Mario Mamonto, Hairil Kurniadi Sirajuddin, Saiful Do Abdullah

Sari

Phishing URLs distributed through social media may employ structural and character-level obfuscation to make malicious links more difficult to recognize. Although previous studies have extensively investigated phishing URL classification, the distribution of specific URL obfuscation patterns and the changes in token composition associated with canonicalization require further empirical examination in Facebook-related phishing URL datasets. In particular, the relationship between rule-based structural detection and token-set similarity has not been sufficiently established in the context of this study. This research aims to identify structural obfuscation patterns, examine their co-occurrence, and evaluate changes in URL token composition using Jaccard similarity. A total of 1,000 phishing URLs collected from Facebook were analyzed using ten predefined structural detection rules. Jaccard similarity was calculated by comparing token sets before and after canonicalization. The results show that 292 URLs (29.2%) matched at least one detection rule, producing 329 detections. Long URLs (140 detections), excessive dashes (88), excessive subdomains (46), and URL shorteners (42) accounted for 96.0% of all detections. The average Jaccard similarity was 0.9991, while Hex/URL Encoding exhibited a median value of 0.934. These findings characterize the structural patterns captured by the proposed rules and indicate that Jaccard similarity distinguishes changes in token composition more clearly for encoding-related cases than for most structurally detected cases.

Keywords: Canonicalization, Cybersecurity, Facebook, Jaccard similarity, Phishing URL, URL obfuscation

Teks Lengkap:

PDF (English)

Referensi

Razaque, A., Hariri, S., Alajlan, A.M., Yoo, J. (2025). A comprehensive review of cybersecurity vulnerabilities, threats, and solutions for the Internet of Things at the network-cum-application layer. Computer Science Review, 58: 100789. https://doi.org/10.1016/j.cosrev.2025.100789

Sasi, T., Lashkari, A.H., Lu, R., Xiong, P., & Iqbal, S. (2024). A comprehensive survey on IoT attacks: Taxonomy, detection mechanisms and challenges. Journal of Information and Intelligence..https://doi.org/10.1016/j.jiixd.2023.12.001

Tian, Y., Yu, Y., Sun, J., & Wang, Y. (2025). From past to present: A survey of malicious URL detection techniques, datasets and code repositories. Computer Science Review, 58: 100810..https://doi.org/10.1016/j.cosrev.2025.100810

Zhang, Z., Wu, J., Lu, N., Shi, W., & Liu, Z. (2025). AdaptPUD: An accurate URL-based detection approach against tailored deceptive phishing websites. Computer Networks, 265: 111303 https://doi.org/10.1016/j.comnet.2025.111303

Xie, L., Zhang, H., Yang, H., Hu, Z., & Cheng, X. (2025). A scalable phishing website detection model based on dual-branch TCN and mask attention. Computer Networks, 263: 111230..https://doi.org/10.1016/j.comnet.2025.111230

Linh, D.M., Thua, H.T., & Hung, T.C. (2026). Real-time phishing uniform resource locator detection based on hybrid embedding transformer and retraining-free inferencing. Computers & Electrical Engineering, 136: 111001..https://doi.org/10.1016/j.compeleceng.2026.111001

Arikkat, D.R., Vinod, P., Rafidha Rehiman, K.A., Nicolazzo, S., Arazzi, M., Nocera, A., & Conti, M. (2025). DroidTTP: Mapping android applications with TTP for Cyber Threat Intelligence. Journal of Information Security and Applications, 93.https://doi.org/10.1016/j.jisa.2025.104112

Choi, S.H., Buu, S.J., & Cho, S.B. (2026). LLM-structured expert feedback for knowledge calibration of deep learning model to detect phishing URL. Applied Soft Computing, 197: 115234..https://doi.org/10.1016/j.asoc.2026.115234

Sruthi, K., & Manohar Naik, S. (2025). A novel framework for effective phishing URL detection using an LSTM-based siamese network. Knowledge-Based Systems, 310: 113900.https://doi.org/10.1016/j.knosys.2025.113900

Sruthi, K., & Manohar Naik, S. (2025). A novel framework for phishing attack detection using domain-adapted GloVe embeddings and attention-enhanced neural sequence model. Applied Soft Computing, 188: 114441. https://doi.org/10.1016/j.asoc.2025.114441

Li, C., Wang, X., & Song, L. (2026). Concept drift handling in security applications: A survey across unimodal to multimodal data. Neurocomputing, 701: 134490.. https://doi.org/10.1016/j.neucom.2026.134490

van Geest, R.J., Cascavilla, G., Hulstijn, J., & Zannone, N. (2024). The applicability of a hybrid framework for automated phishing detection. Computers & Security, 139: 103736.https://doi.org/10.1016/j.cose.2024.103736

Dhar, S., & Bose, I. (2024). An ensemble deep learning model for fast classification of Twitter spam. Information & Management, 61(3): 104052.https://doi.org/10.1016/j.im.2024.104052

Osmanoglu, M., Gupta, D., Ozkan, M., Ar, Y., & Aslan, O. (2026). A comprehensive review of malicious URLs: Detection techniques, features and datasets. Computers and Electrical Engineering, 136: 111186. https://doi.org/10.1016/j.compeleceng.2026.111186

Kale, G., Bostanci, G.E., & Celebi, F.V. (2024). Evolutionary feature selection for machine learning based malware classification. Journal of King Saud University - Computer and Information Sciences. https://doi.org/10.1016/j.jksuci.2024.101920

Rani, N., Saha, B., & Shukla, S.K. (2025). A comprehensive survey of automated Advanced Persistent Threat attribution: Taxonomy, methods, challenges and open research problems. Journal of Information Security and Applications, 92: 104076..https://doi.org/10.1016/j.jisa.2025.104076

Al Saidat, M.R., Yerima, S.Y., & Shaalan, K. (2026). A hybrid deep learning framework for Arabic smishing detection: Dataset creation, model design, and explainability. https://doi.org/10.1016/j.cose.2026.104700

Prasad, N., Diro, A., Warren, M., & Fernando, M. (2025). A survey of cyber threat attribution: Challenges, techniques, and future directions. Computers & Security, 157: 104606.. https://doi.org/10.1016/j.cose.2025.104606

Chen, Y., Cui, M., Wang, D., Cao, Y., Yang, P., Jiang, B., Lu, Z., & Liu, B. (2024). A survey of large language models for cyber threat detection. Computers & Security, 145: 104016.. https://doi.org/10.1016/j.cose.2024.104016

Maniriho, P., Mahmood, A.N., & Chowdhury, M.J.M. (2024). A systematic literature review on Windows malware detection: Techniques, research issues, and future directions. Journal of Systems and Software, 209: 111921. https://doi.org/10.1016/j.jss.2023.111921

Yeboah, P.N., Kayes, A.S.M., Rahayu, W., Pardede, E., & Mahbub, S. (2026). A systematic literature survey of machine learning approaches to cyber data breach detection. https://doi.org/10.1016/j.cose.2026.104650

Wang, Y., Liu, S., Wang, W., Zhou, C., Zhang, C., Jin, J., & Zhu, C. (2025). A unified modeling framework for automated penetration testing. Computers & Security, 159: 104787. https://doi.org/10.1016/j.cose.2025.104787

Bui, H.T., Aboutorab, H., Mahboubi, A., Gao, Y., Sultan, N.H., Parvez, M.Z., Bewong, M., & Islam, R. (2024). Agriculture 4.0 and beyond: Evaluating cyber threat intelligence sources and techniques in smart farming ecosystems. Computers & Security, 140: 103754.. https://doi.org/10.1016/j.cose.2024.103754

Patsakis, C., Casino, F., & Lykousas, N. (2024). Assessing LLMs in malicious code deobfuscation of real-world malware campaigns. arXiv preprint, arXiv:2404.19715.. https://doi.org/10.48550/arXiv.2404.19715

Li, Y., Liu, Y., Li, P., Jia, Y., & Wang, Y. (2025). Continuous multi-task pre-training for malicious URL detection and webpage classification. Computer Networks, 268: 111513.. https://doi.org/10.1016/j.comnet.2025.111513

Zhao, X., Wang, Y., Zhang, L., & Liu, H. (2025). Exploring the ransomware ecosystem and the activities of ransomware groups. Computers & Security, 151: 104320. https://doi.org/10.1016/j.cose.2025.104320

Kharnotia, S., Arora, B., & Kour, R. (2026). Feature-driven static analysis for learning-based android malware detection: A review. ICT Express, 12(1): 186-198.. https://doi.org/10.1016/j.icte.2025.11.002

Ferrag, M.A., Shu, L., Yang, X., & Derhab, A. (2025). Generative AI in cybersecurity: A comprehensive survey. IEEE Access, 13: 21045-21072..https://doi.org/10.1109/ACCESS.2025.3365349

Manguli, K., Kondaiah, C., Pais, A.R., & Rao, R.S. (2025). GraPhish: A graph-based approach for phishing detection from encrypted TLS traffic. Journal of Information Security and Applications..https://doi.org/10.1016/j.jisa.2025.104216

Vennela, P., Rao, K.S., Kumar, A., & Sharma, R. (2026). Intelligent cybersecurity systems for phishing detection. Computer Communications, 215: 108-121.. https://doi.org/10.1016/j.comcom.2025.10.015

Alageel, A., & Maffeis, S. (2026). Investigation of advanced persistent threats network-based tactics, techniques and procedures. Computer Networks, 278: 112069.. https://doi.org/10.1016/j.comnet.2025.112069

Arazzi, M., Arikkat, D.R., Nicolazzo, S., Nocera, A., Rehiman, R.K.A., Vinod, P., & Conti, M. (2025). NLP-based techniques for Cyber Threat Intelligence. Computer Science Review, 58: 100765.. https://doi.org/10.1016/j.cosrev.2025.100765

Alsirhani, A., Ali, S., Humayun, M., Rehman, S.U., & Alzahrani, M.S. (2026). NLP in cybersecurity: Advances, applications, and future directions for threat analysis and dark web intelligence. Neurocomputing, 699:134365..https://doi.org/10.1016/j.neucom.2026.134365

Prasad, Y.B., Dondeti, V., & Dondeti, R. (2026). Phishing URL Detection in Real-Time: Machine Learning and Deep Learning Approaches on a Custom Threat Intelligence Dataset. Procedia Computer Science, 283: 4859-4879.https://doi.org/10.1016/j.procs.2026.06.541

Alanazi, M.M., Wahab, A.W.A., Idris, M.Y.I., & Nandy, T. (2027). Profiling advanced persistent threat groups: a systematic review, activity classification, and countermeasure taxonomy. Computer Standards & Interfaces, 99: 104190.. https://doi.org/10.1016/j.csi.2026.104190

Al-rimy, B.A.S., Maarof, M.A., Shaid, S.Z.M., & Doss, R. (2024). Ransomware early detection: A survey. Computer Networks, 239: 110138. https://doi.org/10.1016/j.comnet.2023.110138

Yigit, Y., Buchanan, W.J., Tehrani, M.G., & Maglaras, L. (2025). Review of Generative AI methods in cybersecurity. Internet of Things and Cyber-Physical Systems, 5: 241-261.. https://doi.org/10.1016/j.iotcps.2025.01.002

Abdullah, S., & Faye, I. (2024). Securing the Industrial Internet of Things against ransomware attacks: a comprehensive analysis of the emerging threat landscape and detection mechanisms. Journal of Network and Computer Applications, 224:103809.https://doi.org/10.1016/j.jnca.2024.103809

Li, Q., & Fung, B. (2025). Security concerns for Large Language Models: A survey. https://doi.org/10.1016/j.jisa.2025.104284

Prasad, A., Yadav, V., Solanki, C., Goswami, H., Jha, T., & Nagal, D. (2026). StealthPhisher: A defensive framework against phishing attack using hybrid deep learning and GenAI. Expert Systems with Applications, 299: 130205.. https://doi.org/10.1016/j.eswa.2025.130205

Alam, M.T., Bhusal, D., Park, Y., & Rastogi, N. (2025). Trustworthy and explainable malware threat intelligence through STIX-based CTI and nature-inspired optimization. Computer Security & Intelligence, 45: 102190..https://doi.org/10.1016/j.csi.2025.102190

Gagniuc, P. (2026). Why educated users still click: a review on phishing and the limits of human judgment. Computer Science Review, 59: 100830..https://doi.org/10.1016/j.cosrev.2026.100830

DOI: https://doi.org/10.36549/ijis.v11i2.528