Aug 2026· PeerJ Computer Science· Vol 12, pp. e4029· 0 citations· 25 references
TL;DR
A feature-driven framework for phishing Uniform Resource Locator (URL) detection is introduced, emphasizing the design and evaluation of enhanced feature representations and highlighting that performance gains are primarily driven by feature design rather than model complexity.
Abstract
Through the prevalence of internet technologies and the integration of digitalization into our daily routine, a significant portion of our personal, financial, and professional activities has shifted to cyberspace. However, this transformation has led to the rise of cyber threats, with phishing attacks being among the most dangerous and widespread, often tricking users into disclosing sensitive information by mimicking legitimate websites. In this study, we introduce a feature-driven framework for phishing Uniform Resource Locator (URL) detection, emphasizing the design and evaluation of enhanced feature representations. The proposed approach integrates structural, lexical, and distributional characteristics of URLs and evaluates their effectiveness across both classical machine learning and deep learning models. To assess their impact, several machine learning algorithms, including Naive Bayes, k-Nearest Neighbors, Random Forest, Gradient Boosting, and Multi-Layer Perceptron, are employed. To ensure a comprehensive evaluation, experiments are conducted on three datasets, including two recent large-scale datasets and a widely used benchmark dataset, enabling the assessment of model performance under different data distributions. Among all machine learning models, Random Forest achieves highly competitive performance with an accuracy of up to 99.82%, demonstrating the effectiveness of the proposed feature representation even with computationally efficient models. Building on this foundation, multiple deep learning architectures combining convolutional neural network (CNN)-based sequence modeling with handcrafted features are developed and further enhanced using ensemble strategies. The resulting ensemble model achieves the highest overall performance, with accuracy reaching 99.84% and consistently low false negative rates across all datasets. However, the observed improvements over strong classical baselines remain modest, highlighting that performance gains are primarily driven by feature design rather than model complexity. Besides, we conduct multiple statistical significance tests, including paired t-tests, Wilcoxon signed-rank tests, Analysis of Variance (ANOVA), and McNemar’s test, to assess the reliability of the observed performance differences. The results confirm that while the improvements of the proposed approach are statistically consistent, the performance gaps among top-performing models are relatively small in practical terms.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance.
I. Mamatov· Международный Журнал Теорети...· 0 citations
Phishing persists as a serious cybersecurity concern in which consumers are tricked into divulging private information by using phony websites. It is necessary to accurately and competently identify such hazardous links in order to secure the internet environment. Because Deep Learning (DL) approaches can automatically learn complex patterns, and proved to be effective tools for identifying such attacks. Five DL models were tested in this study using a dataset gathered from Kaggle: Recurrent Neural Network (SimpleRNN), Long Short-Term Memory (LSTM), Multi-Layer Perception (MLP), Conventional Neural Network (CNN), and Gated Recurrent Unit (GRU). The most useful URL attributes were selected using Random Forest-based feature significance techniques and Chi-Square feature selection to maximize the model’s efficiency. To achieve the global performance study, the models were evaluated using a variety of assessment metrics, including accuracy, precision, recall, and F1 score, with the help of loss graphs and confusion matrices. LSTM successfully proved its effectiveness in dealing with sequential patterns in phishing URLs with a highly accurate result of 98.80%. The DL models given in the paper, especially the recurrent neural networks, performed significantly better compared to the highest standard of accuracy and reliability established in the previous papers. The experimental results confirm that a reliable method for identifying phishing URLs can be formed using recurrent DL and effective feature selection.
The growth of digital platforms has unfortunately led to the proliferation of social engineering deceptions, especially in the form of phishing. Existing security techniques that rely on static lists are not effective at identifying freshly registered rogue domains and hence leave internet users extremely vulnerable. To address this limitation, this study develops and evaluates an automated phishing website detection system using advanced gradient boosting algorithms, namely Extreme Gradient Boosting, Light Gradient Boosting Machine, and Categorical Boosting. The methodology utilizes the pre-structured Mendeley Phishing Websites Dataset, where comprehensive hybrid features from both uniform resource locator characteristics and hypertext markup language source code were already extracted. The models are optimized using a randomized search method combined with five-fold stratified cross validation, and predictive performance is systematically evaluated across four distinct data partitioning scenarios to ensure robustness. The experimental evaluations reveal that all models achieve their peak classification performance at the 80:20 training and testing data distribution. Among the evaluated frameworks, Categorical Boosting demonstrates the most superior capability, achieving an overall accuracy of 97.40 percent, a recall of 96.11 percent, and an F1 score of 96.12 percent. The high recall metric proves the practical effectiveness of Categorical Boosting in minimizing false negative predictions, ensuring that zero-day threats do not bypass the system undetected. These findings establish Categorical Boosting's performance as strong benchmark evidence on a single public dataset; however, further validation on newer campaigns, unseen domains, adversarially obfuscated sites, and cross-dataset settings is still required to confirm its generalization capabilities.
Muhammad Hilmy Aziz, Rizky Parlika, Kartini Kartini· bit-Tech· 0 citations
Email phishing is by far one of the most common and harmful cybersecurity risks that make use of misguided communication methods to breach sensitive user data. Phishing attacks keep changing, which greatly constrains the performance of conventional rule-based and classical machine-learning methods of detection. The proposed study will introduce a hybrid deep learning model that combines Convolutional Neural Networks (CNN) and Bidirectional Long Short-term Memory (Bi-LSTM) networks to detect emails with high phishing accuracy. The model proposed examines various elements of email, such as, email headers, subject lines, message bodies and embedded URLs, in the form of a rich feature representation that represents structural and contextual features. The datasets collected in the real world, PhishTank and Mendeley repositories, were preprocessed by feature binning, redundancy reduction as well as class balancing to improve the quality of data and generalization. The experimental findings indicate that CNNBILSTM model has a high accuracy (96), precision (95.9), recall (96) and ROC-AUC (0.99), which is better than a number of baseline models, including Support Vector Machines (SVM), Decision Trees, K-Nearest Neighbors (KNN) and individual neural networks. The statistical analysis also verifies that the performance improvements are substantial (p < 0.05) and the confidence intervals are not wide which means the study is very consistent and reliable. Based on the findings, it is possible to note that the CNN-BiLSTM model represents a reliable, scalable, and high-performance solution that can be applied to real-time email phishing detection in the contemporary cybersecurity settings.
Nicholas Muriuki· Journal of Intelligent Syste...· 0 citations
Phishing incidents remain highly frequent and destructive cyber threats affecting private users and organizations globally. Malicious actors continuously refine their deceptive strategies to evade traditional rule-based filters and conventional machine learning models, leading to financial losses, credential theft, and data breaches. This study presents an enhanced phishing email detection system based on a hybrid deep learning framework integrating a Convolutional Neural Network (CNN) with a Multi-Layer Perceptron (MLP). The CNN component automatically extracts discriminative textual features from email content, while the MLP component performs accurate email classification as legitimate or phishing. A publicly available phishing email dataset from the Kaggle platform was utilized for model training and evaluation. The dataset underwent preprocessing stages including data cleaning, text normalization, tokenization, sequence padding, and label encoding. The CNN layer extracted relevant textual patterns and semantic representations, while the MLP network performed final classification. The developed system was evaluated using accuracy, precision, recall, and F1-score. Experimental results demonstrated that the CNN–MLP model achieved 98.5% accuracy, 98% precision, 99% recall, and 99% F1-score, indicating strong capability in distinguishing phishing from legitimate emails. Additionally, a web-based application was developed to facilitate real-time phishing detection using direct text input and PDF document analysis through Optical Character Recognition (OCR). The findings demonstrate that integrating CNN-based feature extraction with MLP-based classification provides an effective, reliable, and scalable solution for phishing email detection, contributing to improved cybersecurity protection against evolving phishing attacks.
M. Yuguda, Kamil K. Saka, Y. H. Usman· FUDMA Journal of Sciences· 0 citations