A novel, hybrid detection framework that constructs a structured “portrait” of each URL by extracting 12 discriminative features-spanning structural, semantic, technical, and morphological dimensions, addressing critical gaps in existing black-box AI systems and aligns with the stringent transparency requirements of security-critical domains such as banking, e-government, and enterprise cybersecurity.
Phishing attacks continue to evolve in sophistication, rendering static detection methods increasingly ineffective. Existing URL-based approaches suffer from limited adaptability to emerging phishing patterns, mislabeled training data, and insufficient validation protocols. This paper proposes a hybrid phishing URL detection system that integrates Fuzzy C-Means (FCM) clustering with XGBoost classification, enhanced by a novel Micro Adaptive Feature Extractor (MAFE). The system employs a multi-stage pipeline: feature engineering generating 36 statistical and interaction features, MAFE producing 15 adaptive features through class-aware dynamic weighting, micro-pattern detection, and entropy analysis, and FCM with K=2 clusters providing soft membership features to XGBoost. A two-pass confidence-based mislabel detection protocol identifies and removes 2.66% suspected labeling errors from the training data. The system is evaluated on the large-scale DEPHIDES dataset of 5,202,841 URLs using a proper three-way split: 60% training, 10% validation, and 30% test. The classification threshold is optimized exclusively on the validation set, ensuring unbiased test evaluation. The proposed system achieves 97.86% accuracy and 99.84% AUC on the raw test set, improving to 98.98% accuracy after verified mislabel removal. Comparative evaluation demonstrates that the system outperforms Random Forest 95.91%, LightGBM 96.31%, CatBoost 95.75%, and standalone XGBoost 96.59% trained on identical data with the same evaluation protocol. The system processes URLs at 6,528 URLs/second, with 95% confidence intervals of 97.77%–97.96% for accuracy. A sensitivity analysis confirms robustness to the MAFE adaptation rate parameter, with accuracy varying by only 0.06% across α ∈ [0.05, 0.30].
Muntadher Kareem, R. I. Farhan· Karbala International Journa...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
Investigating whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse demonstrates that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats.
Unai Agirre, Imanol Jerico, Felipe Castano et al.· 0 citations
External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed phishing detection model is reliable.
Phishing remains one of the most persistent cyber threats, and almost every campaign ultimately depends on a deceptive Uniform Resource Locator (URL). Existing defences face a structural trade-off: blacklists are reactive and cannot cover newly registered domains during the zero-hour window, while machine-learning detectors, although accurate, are opaque, feature-hungry, and often depend on page content or full DNS telemetry that many organisations cannot collect. This study proposes and evaluates a lightweight, fully interpretable two-level rule-based framework that fuses lexical URL features with domain registration evidence retrieved through the Registration Data Access Protocol (RDAP). Level 1 scores each URL using five transparent lexical rules derived from training-set distributions of domain length, number of dots, number of hyphens, number of digits, and URL entropy. Level 2 applies three RDAP rules covering domain age, days to expiry, and a missing-registration-data flag, targeting the young, short-lived, and poorly documented domains that characterise phishing infrastructure. The two levels are combined through logical OR and AND decision fusion and evaluated on a balanced, held-out set of 400 URLs drawn from a curated corpus of 800. Level 1 achieved 95.50% accuracy (precision 0.9789, recall 0.9300); Level 2 achieved perfect recall (1.0000) at 0.8969 precision; OR fusion preserved perfect recall; and AND fusion delivered the best overall result at 96.50% accuracy with perfect precision, zero false positives, and a Matthews Correlation Coefficient of 0.9323. A confusion-matrix decomposition further shows that the false-positive sets of the two levels are completely disjoint, confirming that lexical and registration evidence fail independently. Exploiting this, a cascaded implementation of AND fusion reproduces identical decisions while issuing RDAP queries for only 47.5% of URLs, a 52.5% reduction in external lookups.
Wan Afifie Aliff Bin Wan Abdullah, Zulkiflee Muslim, Haniza Nahar et al.· International journal of res...· 0 citations
An integrated comparative evaluation that combines six-algorithm benchmarking, leakage-free hyperparameter optimization, and SHAP-based interpretation on a public phishing dataset, offering practical guidance for security analysts is offered.
Juni Ismail, Raja Anan Nasution, Muhammad Nasri Gea· 0 citations
