{"id":"https://openalex.org/W7203679949","doi":"https://doi.org/10.48550/arxiv.2608.16158","title":"A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis","display_name":"A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis","publication_year":2026,"publication_date":"2026-08-17","ids":{"openalex":"https://openalex.org/W7203679949","doi":"https://doi.org/10.48550/arxiv.2608.16158"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.16158","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16158","pdf_url":"https://arxiv.org/pdf/2608.16158","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.16158","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5146919753","display_name":"Unai Agirre","orcid":"https://orcid.org/0009-0008-2976-1416","observed_orcids":["https://orcid.org/0009-0008-2976-1416"]},"institutions":[{"id":"https://openalex.org/I4210092551","display_name":"Vicomtech","ror":"https://ror.org/0023sah13","country_code":"ES","type":"facility","lineage":["https://openalex.org/I4210092551"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Agirre, Unai","raw_affiliation_strings":["Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","institution_ids":["https://openalex.org/I4210092551"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5147376792","display_name":"Imanol Jerico","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210092551","display_name":"Vicomtech","ror":"https://ror.org/0023sah13","country_code":"ES","type":"facility","lineage":["https://openalex.org/I4210092551"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Jerico, Imanol","raw_affiliation_strings":["Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","institution_ids":["https://openalex.org/I4210092551"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016363910","display_name":"Felipe Casta\u00f1o","orcid":"https://orcid.org/0000-0001-9157-4111","observed_orcids":["https://orcid.org/0000-0001-9157-4111"]},"institutions":[{"id":"https://openalex.org/I4210092551","display_name":"Vicomtech","ror":"https://ror.org/0023sah13","country_code":"ES","type":"facility","lineage":["https://openalex.org/I4210092551"]},{"id":"https://openalex.org/I8833935","display_name":"Universidad de Le\u00f3n","ror":"https://ror.org/02tzt0b78","country_code":"ES","type":"education","lineage":["https://openalex.org/I8833935"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Casta\u00f1o, Felipe","raw_affiliation_strings":["Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","University of Le\u00f3n , Le\u00f3n , Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","institution_ids":["https://openalex.org/I4210092551"]},{"raw_affiliation_string":"University of Le\u00f3n , Le\u00f3n , Spain","institution_ids":["https://openalex.org/I8833935"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042333020","display_name":"Andrea Venturi","orcid":"https://orcid.org/0000-0003-3822-968X","observed_orcids":["https://orcid.org/0000-0003-3822-968X"]},"institutions":[{"id":"https://openalex.org/I4210092551","display_name":"Vicomtech","ror":"https://ror.org/0023sah13","country_code":"ES","type":"facility","lineage":["https://openalex.org/I4210092551"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Venturi, Andrea","raw_affiliation_strings":["Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","institution_ids":["https://openalex.org/I4210092551"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5067556242","display_name":"Francesco Zola","orcid":"https://orcid.org/0000-0002-1733-5515","observed_orcids":["https://orcid.org/0000-0002-1733-5515"]},"institutions":[{"id":"https://openalex.org/I4210092551","display_name":"Vicomtech","ror":"https://ror.org/0023sah13","country_code":"ES","type":"facility","lineage":["https://openalex.org/I4210092551"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Zola, Francesco","raw_affiliation_strings":["Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Digital Security Department , Vicomtech (BRTA) , Donostia / San Sebastian , Spain","institution_ids":["https://openalex.org/I4210092551"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.0,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.0,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/phishing-detection","display_name":"phishing detection","score":0.8650000095367432},{"id":"https://openalex.org/keywords/template-reuse","display_name":"template reuse","score":0.7929999828338623},{"id":"https://openalex.org/keywords/html-structure","display_name":"HTML structure","score":0.5730000138282776},{"id":"https://openalex.org/keywords/dom-tree","display_name":"DOM tree","score":0.6729999780654907},{"id":"https://openalex.org/keywords/structural-fingerprints","display_name":"structural fingerprints","score":0.49799999594688416},{"id":"https://openalex.org/keywords/unsupervised-clustering","display_name":"unsupervised clustering","score":0.7699999809265137},{"id":"https://openalex.org/keywords/zero-day-phishing","display_name":"zero-day phishing","score":0.8320000171661377},{"id":"https://openalex.org/keywords/jaccard-distance","display_name":"Jaccard distance","score":0.6740000247955322},{"id":"https://openalex.org/keywords/web-page-similarity","display_name":"web page similarity","score":0.38100001215934753}],"concepts":[{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.9189000129699707},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7746999859809875},{"id":"https://openalex.org/C203519979","wikidata":"https://www.wikidata.org/wiki/Q865360","display_name":"Jaccard index","level":3,"score":0.7095000147819519},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.667900025844574},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.43140000104904175},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.41119998693466187},{"id":"https://openalex.org/C2777826928","wikidata":"https://www.wikidata.org/wiki/Q3745713","display_name":"Fingerprint (computing)","level":2,"score":0.40700000524520874},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.3912000060081482},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38589999079704285},{"id":"https://openalex.org/C137922610","wikidata":"https://www.wikidata.org/wiki/Q2093","display_name":"Document Object Model","level":3,"score":0.3783999979496002},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.37380000948905945},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.3434999883174896},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3167000114917755},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30979999899864197},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2973000109195709},{"id":"https://openalex.org/C164866538","wikidata":"https://www.wikidata.org/wiki/Q367351","display_name":"Cluster (spacecraft)","level":2,"score":0.296099990606308},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.2669000029563904},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2513999938964844}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.16158","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16158","pdf_url":"https://arxiv.org/pdf/2608.16158","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.16158","doi":"https://doi.org/10.48550/arxiv.2608.16158","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.16158","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.16158","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.16158","pdf_url":"https://arxiv.org/pdf/2608.16158","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G2065967292","display_name":null,"funder_award_id":"101168562","funder_id":"https://openalex.org/F4320334322","funder_display_name":"HORIZON EUROPE Framework Programme"},{"id":"https://openalex.org/G3771002347","display_name":"Innovations in Detecting and Disrupting Crime-as-a-Service Operations","funder_award_id":"101168562","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G8421091417","display_name":"ENhanced AI-baSEd cybercriMe-oriented collaBorative investigation technologies and capabiLitiEs","funder_award_id":"101168360","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320334322","display_name":"HORIZON EUROPE Framework Programme","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7203679949.pdf","grobid_xml":"https://content.openalex.org/works/W7203679949.grobid-xml"},"referenced_works_count":2,"referenced_works":["https://openalex.org/W1599454686","https://openalex.org/W7133357950"],"related_works":["https://openalex.org/W4210654219","https://openalex.org/W6925946929","https://openalex.org/W3132365585","https://openalex.org/W4406028346","https://openalex.org/W4385625023","https://openalex.org/W7033176457","https://openalex.org/W2990233589","https://openalex.org/W2092412564","https://openalex.org/W2410105440","https://openalex.org/W2960795449"],"abstract_inverted_index":{"Phishing":[0],"remains":[1],"a":[2,102,179],"persistent":[3],"and":[4,28,37,84,119,149,164,176,185,212,215],"evolving":[5],"cybersecurity":[6],"threat,":[7],"with":[8,125],"attack":[9],"volumes":[10],"reaching":[11],"record":[12],"levels.":[13],"This":[14],"growth":[15],"is":[16,171],"driven":[17],"by":[18,189],"the":[19,155,158,208,217],"industrialization":[20],"of":[21,41,157,197,210,219],"phishing":[22,26,75,87,107,205,221],"through":[23],"widely":[24],"available":[25],"kits":[27],"reusable":[29],"templates,":[30],"which":[31],"enable":[32],"cybercriminals":[33],"to":[34,80,139],"rapidly":[35],"generate":[36],"deploy":[38],"large":[39],"numbers":[40],"fraudulent":[42],"webpages.":[43,143],"Although":[44],"surface-level":[45],"attributes":[46],"may":[47],"differ":[48],"across":[49,204],"these":[50],"websites,":[51],"their":[52,78],"underlying":[53],"structures":[54],"often":[55],"exhibit":[56],"significant":[57],"similarities.":[58],"However,":[59],"most":[60],"existing":[61],"defenses":[62],"rely":[63],"on":[64,73],"reactive":[65],"blocklists":[66],"or":[67],"supervised":[68],"classification":[69],"models":[70],"that":[71,194],"focus":[72],"individual":[74],"instances,":[76],"limiting":[77],"ability":[79],"identify":[81],"structural":[82,121,195],"reuse":[83],"detect":[85],"coordinated":[86,220],"campaigns.":[88],"To":[89],"address":[90],"this":[91,93],"limitation,":[92],"study":[94],"investigates":[95],"whether":[96],"HTML":[97,126],"structure":[98],"can":[99,199],"serve":[100],"as":[101,113],"robust":[103],"fingerprint":[104],"for":[105],"identifying":[106],"template":[108],"reuse.":[109],"We":[110],"model":[111],"webpages":[112,198],"Document":[114],"Object":[115],"Model":[116],"(DOM)":[117],"trees":[118],"extract":[120],"features,":[122],"optionally":[123],"enriched":[124],"tag-based":[127],"content":[128],"information.":[129],"These":[130],"representations":[131,196],"are":[132,147],"then":[133],"clustered":[134],"using":[135],"unsupervised":[136],"learning":[137],"methods":[138],"group":[140],"structurally":[141],"similar":[142],"Three":[144],"clustering":[145,166],"algorithms":[146],"evaluated":[148,173],"compared,":[150],"while":[151],"also":[152,172],"analyzing":[153],"how":[154],"depth":[156],"extracted":[159],"DOM-tree":[160],"affects":[161],"cluster":[162,169],"formation":[163],"overall":[165],"performance.":[167],"Finally,":[168],"quality":[170],"both":[174],"quantitatively":[175],"qualitatively,":[177],"including":[178],"novel":[180],"level-wise":[181],"Jaccard":[182],"Distance":[183],"Score":[184],"manual":[186],"inspection":[187],"supported":[188],"visualization":[190],"tools.":[191],"Results":[192],"demonstrate":[193],"effectively":[200],"reveal":[201],"hidden":[202],"similarities":[203],"sites,":[206],"enabling":[207],"detection":[209],"emerging":[211],"zero-day":[213],"templates":[214],"supporting":[216],"analysis":[218],"threats":[222]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-19T00:00:00"}