# PhishSim: Aiding Phishing Website Detection with a Feature-Free Tool

arXiv: https://arxiv.org/abs/2207.10801 · HTML: https://mlsanity.com/paper/2207.10801/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 39 references that are in the map.
- First posted on arXiv 13 Jul 2022.

## Builds on (most cited first, 4 of 4)

- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Detecting and Characterizing Lateral Phishing at Scale](https://mlsanity.com/paper/1910.00790/) (2019)
- [PhishZip: A New Compression-based Algorithm for Detecting Phishing Websites](https://mlsanity.com/paper/2007.11955/) (2020)

## Built on by (most cited first, 5 of 5)

- [PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT](https://mlsanity.com/paper/2408.05667/) (2024)
- [A Review of Data-driven Approaches for Malicious Website Detection](https://mlsanity.com/paper/2305.09084/) (2023)
- [A Gradient-Optimized TSK Fuzzy Framework for Explainable Phishing Detection](https://mlsanity.com/paper/2504.18636/) (2025)
- [Can LLM Agents Simulate Dynamic Networks? A Case Study on Email Networks with Phishing Synthesis](https://mlsanity.com/paper/2605.12507/) (2026)
- [CaptchaAgent: Verifiable Visual Reasoning for CAPTCHA Solving](https://mlsanity.com/paper/2610.12866/) (2026)

## Abstract (arXiv)

In this paper, we propose a feature-free method for detecting phishing websites using the Normalized Compression Distance (NCD), a parameter-free similarity measure which computes the similarity of two websites by compressing them, thus eliminating the need to perform any feature extraction. It also removes any dependence on a specific set of website features. This method examines the HTML of webpages and computes their similarity with known phishing websites, in order to classify them. We use the Furthest Point First algorithm to perform phishing prototype extractions, in order to select instances that are representative of a cluster of phishing webpages. We also introduce the use of an incremental learning algorithm as a framework for continuous and adaptive detection without extracting new features when concept drift occurs. On a large dataset, our proposed method significantly outperforms previous methods in detecting phishing websites, with an AUC score of 98.68%, a high true positive rate (TPR) of around 90%, while maintaining a low false positive rate (FPR) of 0.58%. Our approach uses prototypes, eliminating the need to retain long term data in the future, and is feasible to deploy in real systems with a processing time of roughly 0.3 seconds.