RakshNet-PhishGuard: A Multi-Layer Heuristic and Machine-Learning Framework for Real-Time Phishing URL Detection

Abstract

Phishing remains one of the most prevalent and financially damaging cyberattack vectors, with attackers routinely disguising malicious links through typosquatting, homograph substitution, brand impersonation, and abuse of free top-level domains. Existing defenses are largely reactive — blocklist services cannot flag a newly registered phishing domain until it has already been reported, while enterprise secure-web gateways are priced for organizations rather than individual users. In this paper, we propose RakshNet–PhishGuard, a client-first, multi-layer URL threat detection system that classifies a submitted URL as Safe, Suspicious, or Phishing without depending on a live threat-intelligence database. Twenty-five lexical and structural features are extracted from each URL and evaluated by two cooperating layers: a deterministic heuristic engine that checks twelve categorical red-flag rules, and a machine-learning ensemble of six classifiers — Logistic Regression, Naive Bayes, Decision Tree, Random Forest, Support Vector Machine, and Gradient Boosted Trees (XGBoost) — trained on a stratified 168- URL sample drawn from the Hannousse and Yahiouche phishing-URL benchmark. A large-language-model layer (Google Gemini, invoked through a serverless cloud function) converts the combined verdict into a plain-language explanation for nontechnical users, and a community-reporting module lets users flag suspicious URLs for analyst review. Under 5-fold stratified cross-validation, Logistic Regression achieved the best overall performance (79.17% accuracy, 0.861 AUC), followed closely by the Support Vector Machine (76.19% accuracy, 0.859 AUC); a Random Forest feature-importance analysis further shows that the categorical indicators the heuristic layer specifically targets carry essentially zero learned weight in the trained models, confirming the two layers cover complementary failure modes. The project's documented test plan, covering single and bulk scanning, role-based access, and the AI-service fallback path, produced its expected result in all eight scenarios, with heuristic analysis completing in under 50 ms per URL. This paper additionally positions the system against nine related works spanning feature-engineered ML, deep representation learning, and large-language-model-assisted detection, and reports the system's functional, non-functional, and hardware/software requirements in full. The complete system is implemented as a React 18 and TypeScript single-page application in which every trained model runs entirely client-side, requiring no backend inference server.