Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
Abstract
Phishing attacks represent a continuously growing cyber threat that exploits social engineering to deceive users, causing significant financial and informational harm worldwide. As phishing URLs are carefully crafted to mimic legitimate websites, they often bypass traditional rule-based or blacklist methods, which can only detect a small fraction of new threats. This study aims to develop an efficient and accurate phishing URL detection system using purely lexical analysis. The methodology employs a dataset of URLs from Kaggle and GitHub, which undergoes validation, normalization, and deduplication. Character-level TF-IDF with an n-gram range of (3,6) was specifically chosen for its superior ability to capture structural anomalies and obfuscation patterns without requiring semantic understanding or access to web page content. Furthermore, Complement Naive Bayes (CNB) was selected for its robust performance on imbalanced datasets, effectively addressing the skewed class distributions typical of web security data. To ensure reliable risk assessment, the model was calibrated using isotonic regression and evaluated through 5-fold stratified cross-validation. The results demonstrate an accuracy of 94.25%, an F1-Score of 0.9263, and an ROC-AUC of 0.9862. These findings are significant as they outperform heavier deep learning architectures while maintaining a much lower computational footprint. This efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
K. Shrinivas, B. Karthick, M. MuthukaruppanKN et al.· International Conference on...· 0 citations
An integrated comparative evaluation that combines six-algorithm benchmarking, leakage-free hyperparameter optimization, and SHAP-based interpretation on a public phishing dataset, offering practical guidance for security analysts is offered.
Juni Ismail, Raja Anan Nasution, Muhammad Nasri Gea· 0 citations
Phishing attacks based on Uniform Resource Locator (URL) links are one of the most significant cyber threats capable of exploiting user negligence at government institutions, including the Meteorology, Climatology, and Geophysics Agency (BMKG). This study aims to design and build a machine learning-based phishing URL detection system using the Random Forest algorithm integrated with the WhatsApp Bot messaging application. URL features were extracted from lexical aspects, government-specific domain knowledge, and BMKG domain typosquatting indicators. The model was trained using a dataset of 12,744 URLs consisting of 6,372 legitimate URLs and 6,372 phishing URLs with an 80:20 data split. Statistical evaluation results on the testing set (2,549 URLs) show that the Random Forest model achieves an accuracy of 98.16%, precision of 98.73%, recall of 97.57%, and F1-score of 98.14%. Functionality testing through Black Box Testing on 20 test URLs (10 legitimate and 10 phishing) produced a 100% success rate with an average response time of less than 10 seconds per URL. This integration is proven to provide a practical, responsive, and precise early detection solution for BMKG employees.
Iqbal Fariansyah Ridwan, E. Trihadi, Andri Setiyaji· Internet of Things and Artif...· 0 citations
- The rapid expansion of digital communication has established email as a primary medium for information exchange among individuals, businesses, and organisations. This widespread reliance has contributed to a marked increase in phishing attacks, in which cybercriminals impersonate legitimate entities to obtain sensitive information, including login credentials, financial data, and personal details. Traditional phishing detection methods, including rule-based filters and blacklist mechanisms, have proven increasingly insufficient against sophisticated and evolving phishing strategies. As a result, there is a critical need for intelligent and adaptive detection systems capable of accurately identifying phishing emails. This study presents the development of an intelligent Email Phishing Detection System utilising supervised machine learning algorithms to enhance email security and protect users from phishing threats. A publicly available dataset containing both phishing and legitimate email messages was employed for model training and evaluation. The dataset underwent preprocessing steps including text cleaning, tokenisation, stop-word removal, and feature extraction using the Term Frequency – Inverse Document Frequency (TF – IDF) technique. Five supervised machine learning algorithms — Logistic Regression, Naïve Bayes, Decision Tree, Random Forest, and Support Vector Machine (SVM) — were trained and evaluated using standard performance metrics: accuracy, precision, recall, and F1-score. Experimental results indicated that the Support Vector Machine (SVM) outperformed the other classification models, achieving an accuracy of 99.1%, precision of 99.0%, recall of 99.1%, and an F1-score of 99.0%. Due to its superior performance, the SVM model was selected for deployment in the developed system. The proposed phishing detection system was implemented as a desktop application using Python's Tkinter graphical user interface (GUI), allowing users to input email content and receive real-time predictions regarding the legitimacy of emails. The findings demonstrate that machine learning techniques, particularly the Support Vector Machine algorithm, offer a highly accurate, reliable, and efficient approach to phishing email detection. Integrating the trained SVM model into a user-friendly desktop application provides a practical, lightweight, and scalable solution that enhances email security, reduces false detections, and assists users in more effectively identifying phishing attempts.
Etus C., Ewunonu T. C., Chuks-Ugochukwu C. M. et al.· Iconic research and engineer...· 0 citations
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
