Aug 2026· Journal of Trends in Computer Science and Smart Technology· Vol 8, pp. 838-861· 0 citations· 32 references
TL;DR
GAFPNet (Generalization-Aware and False-Positive Controlled Framework Network), a five-module stacked-ensemble framework, is introduced as a generalization-aware and deployment-oriented phishing URL classifier for real-time filtering applications.
Abstract
Phishing remains a persistent cybersecurity threat, with over 1.3 million attacks reported in a single quarter of 2023. Despite strong benchmark performance, many machineand deep-learning models exhibit limited deployment reliability because they are evaluated using balanced, single-source datasets with randomized splits. This paper addresses this gap in two phases. First, it presents a controlled multi-source empirical study of four baseline phishing URL detection models–Logistic Regression, Support Vector Machine, Random Forest, and XGBoost–under four increasingly realistic evaluation conditions, including cross-source generalization, temporal drift, and class imbalance. Second, it introduces GAFPNet (Generalization-Aware and False-Positive Controlled Framework Network), a five-module stacked-ensemble framework. GAFPNet uses dataset-neutral lexical and structural URL feature extraction, SMOTE-based imbalance correction, Platt scaling for ensemble calibration, and a tunable false-positive control scheme. Experiments using a consolidated 13,000-sample set from PhishTank, OpenPhish, and Tranco Top-Sites show that baseline accuracy decreases by 13.16 to 20.22 percentage points in cross-source testing and by 2.41 to 8.14 percentage points in standard testing. GAFPNet achieves 99.12% accuracy, a 98.97% F1-score, an AUC-ROC of 0.9943, an MCC of 0.988, and a false positive rate of 0.74%, outperforming the evaluated baselines in all four scenarios. An ablation study confirms the contribution of each module. These results position GAFPNet as a generalization-aware and deployment-oriented phishing URL classifier for real-time filtering applications.
Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance.
I. Mamatov· Международный Журнал Теорети...· 0 citations
A feature-driven framework for phishing Uniform Resource Locator (URL) detection is introduced, emphasizing the design and evaluation of enhanced feature representations and highlighting that performance gains are primarily driven by feature design rather than model complexity.
Deniz Kaya, Murat Osmanoğlu· PeerJ Computer Science· 0 citations
An Explainable Ensemble Artificial Intelligence Framework for Real Time Phishing Website Detection that addresses the primary weakness of existing systems and is deployed as a real-time desktop application.
F. J. Boniface· International Journal of Com...· 0 citations
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Phishing attacks continue to pose a significant threat to individuals and organizations, driven by the increasing sophistication of cybercriminal techniques and the rapid expansion of digital services. Traditional detection approaches, such as blacklist-based and rule-based systems, are often ineffective against newly generated or obfuscated phishing URLs. This study proposes a machine learning (ML)-based framework intended for integration within penetration testing environments. The approach leverages multiple supervised learning algorithms, including Random Forest (RF), Support Vector Machine (SVM), and XGBoost, trained and evaluated using the PhiUSIIL Phishing URL Dataset, a large-scale benchmark dataset containing phishing and legitimate URL samples. A comprehensive preprocessing pipeline and feature engineering strategy are employed to enhance model performance. Experimental results demonstrate exceptionally high detection accuracy, with RF and XGBoost achieving near-perfect classification performance across key evaluation metrics, including accuracy, precision, recall, F1-score, and ROC-AUC. The proposed system is further designed for real-time deployment, enabling integration into penetration testing workflows for proactive security assessment. Despite promising results, limitations related to dataset characteristics and real-world generalization are acknowledged. Overall, this research highlights the effectiveness and practical applicability of ML-based approaches in strengthening phishing detection and advancing modern cybersecurity defences.
Ashwag Alotaibi, Mounir Frikha· International Journal of Adv...· 0 citations
External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed phishing detection model is reliable.