DEEP LEARNING-BASED PHISHING DETECTION FOR CYBER THREAT INTELLIGENCE: DEVELOPMENT AND EVALUATION OF THE PHISHING GUARD SYSTEM

Abstract

Background Phishing is a common cybersecurity attack in which criminals use fake or misleading websites to trick people into sharing sensitive information. This may include usernames, passwords, banking details or personal information. Traditional detection methods such as blacklists and fixed security rules can identify many known threats, but they may be less effective when a phishing website is new or its URL has been changed.  Objectives This research aimed to develop and evaluate PhishingGuard, a web-based phishing detection and website security analysis system. The study investigated the performance of a deep-learning model for phishing URL classification and then examined how the trained model could be integrated into a practical security application.  Methods The CNN was developed using the PhiUSIIL Phishing URL dataset. The original dataset contained 235,795 records. After removing 425 duplicate URLs, 235,370 unique URLs remained. A stratified 80:20 split produced 188,296 URLs for training and 47,074 URLs for held-out testing. A character-level Convolutional Neural Network (CNN) was trained to learn patterns directly from URL text. The frozen CNN was then integrated into PhishingGuard together with URL-based lexical analysis and live website security analysis.  Results The frozen CNN achieved 99.81% accuracy, 99.99% precision, 99.58% recall, 99.78% F1-score and 0.9986 ROC-AUC on the held-out test set. The confusion matrix contained 26,967 true negatives, 3 false positives, 85 false negatives and 20,019 true positives. An additional balanced evaluation of 10,000 URLs produced 99.85% accuracy. However, this sample came from the same underlying PhiUSIIL source and therefore does not represent independent external validation. Practical testing also identified an important limitation. Small changes in the way the same legitimate URL was written could cause large changes in the CNN prediction. PhishingGuard therefore introduced validated URL processing and application-level decision logic while keeping the evaluated CNN unchanged. Conclusion The findings show that character-level deep learning can provide strong phishing URL classification under the conditions tested in this research. However, practical testing also showed that high model accuracy alone is not enough for a complete phishing detection system. PhishingGuard therefore combines the CNN prediction with URL characteristics and available live website information to provide a broader and easier-to-understand risk assessment.