PhishOnt: OWL Ontology for Phishing Attack Classification

Updated 5 July 2026

PhishOnt is an OWL-based phishing ontology that formalizes email indicators like missing MX and SPF records into description logic axioms for structured attack classification.
It complements CyberCane’s dual-phase system by converting low-level symbolic cues into confidence-scored, verifiable reasoning chains for transparent decision-making.
Empirical results show 85.2% coverage on phishing emails, providing structured explanations and audit trails that support privacy-preserving detection.

Searching arXiv for PhishOnt and closely related phishing-ontology work to ground the article in current papers. PhishOnt is an OWL-based phishing ontology introduced within CyberCane as a formal semantic layer over Phase 1 email indicators such as missing MX records, missing SPF records, missing DMARC policy, domain mismatch, URL obfuscation, urgency cues, credential requests, and freemail senders. It encodes phishing attack knowledge as description-logic axioms, derives multi-label attack classifications with confidence scores and reasoning chains, and supplies structured symbolic context to a privacy-preserving retrieval-augmented generation pipeline. PhishOnt is not presented as a standalone phishing detector; rather, it complements deterministic rule scoring and borderline-case semantic classification by translating low-level evidence into verifiable attack-type interpretations (Hakim et al., 26 Apr 2026).

1. Conceptual scope and purpose

PhishOnt was introduced for privacy-critical domains in which phishing detection must satisfy several simultaneous constraints: very low false positives, transparent and auditable explanations, privacy-preserving operation, and robustness to novel or AI-generated phishing. In that framing, conventional rule systems remain precise and interpretable but brittle, while purely neural or LLM-based approaches are flexible but opaque and potentially incompatible with privacy regulations when sensitive content is transmitted externally. PhishOnt addresses a narrower but technically important problem: it formalizes symbolic phishing knowledge so that raw indicators can be converted into attack-type classifications with explicit reasoning chains suitable for verification and audit (Hakim et al., 26 Apr 2026).

The ontology’s role is therefore epistemic as much as classificatory. It organizes indicators into attack taxonomies rather than treating them as isolated flags, derives classifications through formal constraints, and produces explanation chains that can be passed onward to downstream components. The paper is explicit that PhishOnt supports “verifiable attack classification through formal reasoning chains” and that its function is complementary to CyberCane’s detector rather than a replacement for it.

A central interpretive point is that PhishOnt does not itself define the final phishing-versus-benign verdict. CyberCane retains a dual-phase decision process: deterministic symbolic scoring in Phase 1, followed by similarity-based RAG on borderline cases in Phase 2. PhishOnt sits between those phases as the symbolic substrate that renders Phase 1 evidence semantically intelligible.

2. Ontological formalism and modeled knowledge

PhishOnt is specified as an OWL ontology using description-logic axioms. The paper does not provide a full schema, namespace design, ontology engineering methodology, or OWL profile, and it does not identify a concrete reasoner. What is explicit is the ontology language, the use of description-logic-style attack definitions, and the fact that Phase 1 Boolean indicators are normalized into ontology properties. The clearest example of this normalization is the mapping missing_mx → hasMissingMX (Hakim et al., 26 Apr 2026).

The ontology’s conceptual scope is tightly bounded by CyberCane’s Phase 1 indicators. Those indicators span infrastructure authenticity, sender-content mismatch, URL suspiciousness, and social-engineering or credential-harvesting cues. The paper’s explicit examples include missing MX, missing SPF, missing DMARC, domain mismatch, URL obfuscation, urgency, credential requests, and freemail senders. One illustrative attack definition is given directly in prose: CredentialTheft = hasCredentialRequest AND hasMissingMX. This indicates that at least some attack types are modeled as conjunctions over indicator-derived properties.

PhishOnt’s reported attack labels are multi-label rather than mutually exclusive. Named labels include Prescription Fraud, High-Confidence Phishing, Technical Attack, Credential Theft, Insurance Verification Phish, Appointment Scam, Social Engineering Attack, and URL-Based Attack. This suggests overlapping tactic-based, theme-based, and confidence-oriented categorizations rather than a single strict inheritance tree.

The paper reports the following attack-label prevalence values:

Attack type	Prevalence
Prescription Fraud	62.3%
High-Confidence Phishing	58.8%
Technical Attack	36.8%
Credential Theft	34.1%
Insurance Verification Phish	13.2%
Appointment Scam	11.4%
Social Engineering Attack	8.2%
URL-Based Attack	1.5%

These labels reflect the ontology’s practical emphasis on semantic characterization rather than binary verdicting alone. A plausible implication is that PhishOnt is best understood as an attack-typing and explanation layer whose ontology classes are activated from symbolic evidence rather than from unrestricted open-world knowledge integration.

3. Reasoning model and inference procedure

PhishOnt’s reasoning mechanism is presented in Algorithm 1, “Ontology-Guided Attack Classification.” Its inputs are Phase 1 indicators $I$ , the ontology $\Omega$ , and a threshold $\theta = 0.3$ ; its outputs are attack labels $\mathcal{A}$ and reasoning chains $\mathcal{E}$ (Hakim et al., 26 Apr 2026).

The algorithm first maps active indicators into ontology properties: $P \leftarrow \emptyset$ and, for each true indicator $i$ ,

$P \leftarrow P \cup \{\mathrm{MapProperty}(i)\}.$

For each attack type $\tau \in \Omega$ , the ontology provides two sets of constraints: $(\mathcal{R}_{\forall}, \mathcal{R}_{\exists}) \leftarrow \Omega.\mathrm{GetAxioms}(\tau),$ where $\Omega$ 0 denotes universally required constraints and $\Omega$ 1 denotes existential requirements. The algorithm then computes: $\Omega$ 2

$\Omega$ 3

$\Omega$ 4

Confidence is defined through axiom satisfaction: $\Omega$ 5 An attack type is accepted when

$\Omega$ 6

The paper also summarizes this as $\Omega$ 7, where $\Omega$ 8 is the number of satisfied constraints and $\Omega$ 9 is the number of required constraints. Once accepted labels are accumulated, explanation chains are generated: $\theta = 0.3$ 0

Operationally, this procedure is not classical OWL entailment in isolation. It is an application-level coverage computation over observed symbolic evidence, using ontology-defined attack constraints as the semantic template. This suggests a pragmatic closed-world style over extracted indicators, even though OWL as a formalism is open-world by default.

4. Role inside CyberCane’s neuro-symbolic pipeline

CyberCane is a dual-phase neuro-symbolic system, and PhishOnt is the principal symbolic layer connecting those phases. Phase 1 performs deterministic symbolic analysis over email metadata, URLs, and content-derived cues, computes indicators $\theta = 0.3$ 1, and forms a weighted score

$\theta = 0.3$ 2

with $\theta = 0.3$ 3. Phase 1 verdicts are then assigned as benign for $\theta = 0.3$ 4, review for $\theta = 0.3$ 5, and phishing for $\theta = 0.3$ 6. The paper states that detected indicators are then passed to ontology reasoning for formal attack classification (Hakim et al., 26 Apr 2026).

Phase 2 is a privacy-preserving RAG stage. Emails are redacted, embedded, and matched against a phishing-only retrieval corpus. The LLM is conditioned on the redacted email, Phase 1 indicators, ontology-inferred attack types, ontology reasoning chains, and retrieved examples. The paper explicitly states that ontology-inferred attack types are passed to the LLM as structured context, enabling [ONTOLOGY]-tagged explanations grounded in formal reasoning rather than heuristic prose alone.

This placement gives PhishOnt three operational functions. First, it supplies attack labels that are more semantically structured than raw indicator lists. Second, it supplies explanation provenance for analyst-facing outputs and audit trails. Third, it grounds the neural component with symbolic context, making CyberCane neuro-symbolic in a substantive rather than merely sequential sense.

PhishOnt also plays a privacy role. Ontology classification operates entirely offline on Phase 1 indicators, avoiding external API dependency for formal explanations. The paper’s implementation details remain sparse at the ontology layer, but the overall system is implemented in Python 3.11 as a FastAPI backend, uses PostgreSQL 17 with pgvector and HNSW for retrieval, and exposes a Next.js frontend. The ontology itself is described as OWL-based, while the paper does not identify a dedicated OWL API, reasoner, or serialization format.

5. Empirical profile, explanation quality, and limitations

The strongest empirical evidence for PhishOnt concerns coverage, confidence behavior, and explanation groundedness rather than end-to-end accuracy in isolation. On the mixed-label test split of $\theta = 0.3$ 7, the ontology’s reported coverage is $\theta = 0.3$ 8, with phishing coverage $\theta = 0.3$ 9 and benign coverage $\mathcal{A}$ 0 (Hakim et al., 26 Apr 2026).

Activation alone is not highly discriminative, because many benign emails also activate structural indicators such as URLs or authentication-related cues. The paper therefore emphasizes confidence-level characteristics. On activated emails, the ontology assigns an average of 2.66 labels with mean confidence 53.6%. Mean confidence is 54.6% for phishing activations and 52.8% for benign activations, a difference of +1.84 percentage points. It further reports that only 14.5% of benign activations exceed the phishing mean confidence, or equivalently that 85.5% of benign activations are below the typical phishing confidence level.

The clearest PhishOnt-specific evidence concerns explanation groundedness. In a 60-email groundedness study, ontology-enabled explanations produced 41 ONTOLOGY-tagged bullets, all 100% supported. The paper states that all 41 correctly cite attack types and reasoning chains from formal inference. This is contrasted with lower support rates for several heuristic explanation tags such as AUTH, URL, URGENCY, and CONTENT. Accordingly, PhishOnt’s empirically demonstrated value lies primarily in explanation verifiability.

At the system level, CyberCane reports a 78.6-point recall gain over symbolic-only detection on AI-generated threats, with precision exceeding 98% and FPR as low as 0.16%. However, the paper does not provide an ablation of “CyberCane without PhishOnt,” a comparison of RAG performance with and without ontology attack labels, or a study of ontology effects on calibration or escalation logic. The paper is likewise silent on the ontology’s full schema, reasoner identity, update workflow, and any explicit alignment with external cybersecurity ontologies or standards. These omissions constrain reproducibility and limit formal comparison with broader ontology-engineering practice.

6. Historical position and relation to adjacent phishing research

PhishOnt occupies a distinct place within phishing research because it formalizes symbolic phishing knowledge more explicitly than earlier ontology-assisted detectors while remaining narrower than broader intention-recognition or structural webpage-analysis systems. Earlier work on phishing in instant messengers combined domain ontology or ontology-based information extraction with Classification Based on Association in a PDS monitoring system. In that framework, ontology was used to assign domain and context to chat terms, dynamically append semantic lexicon entries through RDF, and reduce false positives from isolated keyword triggers such as “kill,” but the final phishing decision remained association-rule classification rather than formal ontology reasoning (Qaseem et al., 2014).

More recent adjacent work broadens the semantic space in different directions. Screenshot-centered intention analysis in “PhishIntentionLLM” models phishing websites through four explicit intention classes—Credential Theft, Financial Fraud, Malware Distribution, and Personal Information Harvesting—with a multi-agent RAG architecture operating over screenshots and evidence chains (Li et al., 21 Jul 2025). Reference-free webpage detection in “SpecularNet” instead emphasizes domain names and DOM structure, treating phishing as a problem of higher-order structural invariants captured by hierarchical graph autoencoding rather than symbolic taxonomies (Song et al., 2 Mar 2026). A plausible implication is that PhishOnt represents one layer in a larger decomposition of phishing semantics: formal attack typing over extracted email indicators, adjacent to but distinct from website-intention modeling and structural webpage anomaly detection.

In that sense, PhishOnt is neither a comprehensive phishing knowledge graph nor a universal reasoning substrate for all phishing artifacts. It is a focused OWL ontology for email-phishing interpretation inside a privacy-preserving neuro-symbolic detector. Its significance lies in formal attack labeling, confidence-scored axiom satisfaction, and explanation chains that can be audited and passed into downstream language-model reasoning. Its limitations lie in bounded indicator coverage, high benign activation, incomplete implementation disclosure, and the absence of a standalone performance ablation.