Aug 2026· Frontiers of Computer Science· 0 citations· 21 references
TL;DR
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Abstract
Phishing remains one of the most persistent cybersecurity threats, exploiting human trust to steal sensitive information through deceptive websites. Traditional detection methods, reliant on blacklists and reactive reporting, offer limited protection against rapidly evolving zero-day attacks. To address these challenges, this study proposes and evaluates a hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service. Communication between the client and server is optimised using gRPC over the QUIC protocol, ensuring secure, high-performance data exchange with built-in retry mechanisms for resilience. The framework adopts a fail-safe decision strategy in which URLs identified as malicious by VirusTotal are immediately blocked, while benign or unknown results are further evaluated using a weighted fusion of machine learning and DOM-based scores. The model was trained on several high-impact URL features to ensure both speed and accuracy. Privacy remains a core principle, with sensitive data processed locally and minimal external data transmission. Experimental evaluation demonstrates that the proposed framework achieves a detection accuracy of 96.7%, with 97.1% precision, 96.0% recall, an F1-score of 96.6%, and an AUC of 0.993 using the optimised Random Forest classifier. The complete detection pipeline maintains an average end-to-end latency of less than one second, while the hybrid decision-fusion strategy successfully detects 91.7% of zero-day phishing URLs in the live evaluation dataset. These results demonstrate that the proposed architecture provides an accurate, low-latency, privacy-aware, and practically deployable solution for real-time browser-based phishing detection.
With the widespread adoption of digital banking platforms, phishing-based fraudulent redirection attacks have become one of the most critical cyber threats targeting the financial sector. Data published by the National Cyber Incident Response Center (USOM) show that malicious URLs in Türkiye have reached hundreds of thousands, indicating the persistence of locally operated phishing campaigns and the increasing diversity of attackers’ techniques. This study presents a forensic case analysis of a phishing incident targeting e-banking users, focusing on domain manipulation, cloned web interfaces, and reverse-proxy-based session hijacking. The analysis examines domain registration records, hosting infrastructure, certificate attributes, redirection flow, and HTML structure within a structured multi-layered framework. The findings show that attackers rely on short-lived and rapidly changing domain infrastructures to support credential theft and session hijacking attempts. In addition, several indicators of compromise (IoCs) were derived with the support of USOM data to facilitate the early detection of similar attacks. The results indicate that phishing campaigns cannot be mitigated solely through user awareness; instead, DNS, content, certificate, and infrastructure indicators should be evaluated together.
Ilker Kara· Ömer Halisdemir Üniversitesi...· 0 citations
Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
Phishing attacks are one of the long-lasting problems in cybersecurity. Attackers are always changing their techniques to avoid being caught by conventional detection techniques. The techniques used currently are based on static blacklists or individual classifiers using features, but this does not completely represent the phishing attack. This project fills this critical information security gap by developing a hybrid real-time phishing detection system in the form of a Google Chrome extension. Our system uses a combination of two independent machine learning pipelines. In the first pipeline, we use thirty hand-crafted features to classify URL structure using a Gradient Boosting Classifier on 11,054 samples with 97.4% accuracy. In the second pipeline, we use raw HTML data from the webpage. We use a TF-IDF vectorizer on HTML data injected with semantic flag tokens. We use a Random Forest Classifier on 1,859 real site files with 82.80% accuracy. We combine the results using a weighted combination. We use a Retrieval Augmented Generation module, which uses a Google Gemini language model. We use a FAISS vector index to produce a risk explanation in a human-readable format. We use a trusted domain whitelist for false positives on legitimate banking and government websites. We use a pattern-based blocklist for piracy and malware domains. We use a popup interface to show users Safe or Phishing results. We use a full-screen alert overlay injected into the active tab for users. We use experimental results to show that our system performs better than any individual baseline
Kavila Moni Sushma Deep, Pavan KumarSeepana, Natasha Rayi et al.· International journal of re...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
Phishing websites still pose a threat to internet users by using well-known domain names and confusing URL formats to trick them into divulging confidential information. This research proposes a phishing website detection system and a cyberattack prevention system based on a deep learning model designed to detect whether raw URLs are phishing or legitimate, leveraging a transformer model. The system analyzes URL sequences to identify patterns, domain name irregularities, suspicious tokens, unusual lengths, special character usage, and deceptive subdomains. A web interface enables the user to input URLs, and the Flask backend performs pre-processing, tokenization, model inference, and suspicious feature identification. The proposed method fuses the transformer-based semantic representation of the URL and lexical feature analysis to reliably detect phishing and provide explainable warning features. The system creates a prediction label, confidence score, and suspicious features in real time to support the decision-making process. This work provides a practical and scalable solution for phishing identification, user protection, and web-based cyberattack prevention.
Dr. N. Ramadevi, Dr. K. Uday, Kumar et al.· 2026 International Conferenc...· 0 citations
An intelligent phishing detection framework that integrates machine learning, deep learning-enabled feature selection, multi-source phishing feature extraction, hybrid classification, and real-time risk assessment is proposed that can achieve higher detection accuracy, precision, recall, F1-score, and lower response latency than blacklist-based, conventional machine learning, and standalone deep learning approaches.
P. Paul, Bharath Bhushan, Bandameedi Sai Charan et al.· American Journal of AI Cyber...· 0 citations