Machine-learning phishing webpage detectors (ML-PWD) have been shown to
suffer from adversarial manipulations of the HTML code of the input webpage.
Nevertheless, the attacks recently proposed have demonstrated limited
effectiveness due to their lack of optimizing the usage of the adopted
manipulations, and they focus solely on specific elements of the HTML code. In
this work, we overcome these limitations by first designing a novel set of
fine-grained manipulations which allow to modify the HTML code of the input
phishing webpage without compromising its maliciousness and visual appearance,
i.e., the manipulations are functionality- and rendering-preserving by design.
We then select which manipulations should be applied to bypass the target
detector by a query-efficient black-box optimization algorithm. Our experiments
show that our attacks are able to raze to the ground the performance of current
state-of-the-art ML-PWD using just 30 queries, thus overcoming the weaker
attacks developed in previous work, and enabling a much fairer robustness
evaluation of ML-PWD.

通过黑盒优化算法，我们设计了一种新颖的细粒度修改方式，能够在不损害恶意性和视觉外观的情况下修改输入钓鱼网页的 HTML 代码，从而成功绕过目标检测器，破坏当前最先进的机器学习防钓鱼网页检测系统的性能，仅使用 30 个查询就能击败以前的攻击方法，并实现对机器学习防钓鱼网页检测系统更公正的鲁棒性评估。