Implementation of Deterministic Finite Automata for Phishing URL Detection

Abstract

The increasing prevalence of phishing attacks targeting users of digital banking, e-commerce, and social media platforms highlights the need for phishing detection tools that are transparent and easy to understand. This study aims to develop a Deterministic Finite Automata (DFA)-based phishing URL analysis system that supports cybersecurity awareness through interpretable rule-based detection. The proposed system is implemented as an interactive web application that evaluates URLs using nine phishing indicators, including dangerous keywords, service impersonation, URL shorteners, suspicious top-level domains, IP-based domains, excessive subdomains, URL encoding anomalies, at-sign usage, and unencrypted HTTP connections. These indicators trigger transitions across six DFA states and generate a cumulative risk score used to classify URLs into four risk levels: Safe, Suspicious, Highly Suspicious, and Phishing. The research method consists of DFA modeling, rule-based URL analysis, web-based implementation, and functional testing using ten URL samples with varying characteristics. To enhance educational value, the system visualizes DFA state transitions in real time, enabling users to observe how phishing indicators influence the classification process. The testing results indicate that the proposed rules and DFA transitions operate consistently on the evaluated samples and classify URLs according to predefined criteria. The findings suggest that DFA can provide a transparent and educational approach for illustrating phishing detection mechanisms and improving user understanding of suspicious URL characteristics. The proposed system is intended as a prototype for cybersecurity awareness and learning environments, while further validation using larger and more diverse datasets is required.