Ph5 Webpage Screenshot Classifier: Visual Brand Impersonation Detector (ResNet-50)
Model Summary
The Ph5 Screenshot Classifier is a deep convolutional neural network based on ResNet-50 fine-tuned to classify webpage landing page screenshots and identify fraudulent brand impersonation, visual cloning, and deceptive graphical credential-harvesting interfaces.
It forms the visual inspection modality of the Ph5 Multimodal Cybersecurity Framework, closing critical blind spots where attackers host phishing forms on trusted infrastructure (such as Microsoft Forms, Notion, or SharePoint) that easily bypass lexical URL filters.
Performance & Evaluation Benchmark
Evaluated on an independent, held-out test partition of 438 webpage screenshots (248 Benign, 190 Phishing):
| Metric | Held-Out Test Split (N = 438) | Peak Validation Split (N = 438) |
|---|---|---|
| Accuracy | 79.00% | 83.30% |
| Precision | 72.69% | 78.20% |
| Recall | 82.63% | 85.10% |
| F1-Score | 77.34% | 81.50% |
| Inference Latency | 28.5 ms | Batch Size = 1 (RTX 3050 Laptop GPU) |
Baseline Comparison
| Architecture | Test Accuracy | Precision | Recall | F1-Score | Latency |
|---|---|---|---|---|---|
| MobileNetV2 | 76.10% | 70.20% | 79.40% | 74.51% | 14.0 ms |
| VGG-16 | 77.40% | 71.10% | 80.50% | 75.51% | 42.0 ms |
| Ph5 ResNet-50 (This Model) | 79.00% | 72.69% | 82.63% | 77.34% | 28.5 ms |
Confusion Matrix (Test Split: N = 438)
Predicted
Benign Phishing
Benign 189 59
Phishing 33 157
Intended Use & Integration
PyTorch Inference
import torch
import torchvision.models as models
import torchvision.transforms as transforms
from PIL import Image
# Initialize ResNet-50 architecture
model = models.resnet50(weights=None)
model.fc = torch.nn.Sequential(
torch.nn.Dropout(0.3),
torch.nn.Linear(2048, 2)
)
# Load state dict
state_dict = torch.load("best_model.pth", map_location="cpu")
model.load_state_dict(state_dict)
model.eval()
# Preprocessing transforms
transform = transforms.Compose([
transforms.Resize((256, 256)),
transforms.CenterCrop((224, 224)),
transforms.ToTensor(),
transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229, 0.224, 0.225])
])
image = Image.open("screenshot.png").convert("RGB")
tensor = transform(image).unsqueeze(0)
with torch.no_grad():
logits = model(tensor)
probs = torch.softmax(logits, dim=-1).squeeze().tolist()
print(f"Benign: {probs[0]:.4f}")
print(f"Phishing: {probs[1]:.4f}")
Training Configuration & Data Provenance
- Pretrained Backbone:
ResNet-50(ImageNet-1k initialized weights) - Classification Head:
Dropout(0.3) + Linear(2048, 2) - Dataset Composition (2,915 screenshots total):
- Benign Pages (1,648): 1,101 from Kaggle Webpage Phishing collection, 501 from CIRCL open dataset, 46 multi-path headless Chrome captures.
- Phishing Pages (1,267): 515 from Kaggle, 444 captured via automated Headless Chrome from live OpenPhish feeds, 273 from CIRCL Luxembourg, 35 curated threat feeds.
- Split: 70% Train (2,039) / 15% Validation (438) / 15% Test (438)
- Optimizer: AdamW (learning rate = 1e-4, weight decay = 0.0001)
- Epochs: 25 epochs with ReduceLROnPlateau scheduler
Citation & Framework
@article{devi2026ph5,
title={Ph5: A Multimodal Framework for Cross-Modality Evasion-Resilient Phishing Detection in Multi-Vector Environments},
author={Ritu Devi Deepti Singh and Akash Sah},
journal={Journal of Computer & Mathematical Sciences / JCMM},
year={2026}
}