Jul 2026· International Journal for Research in Applied Science and Engineering Technology· 0 citations
TL;DR
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Abstract
Phishing attacks constitute one of the most pervasive cyber threats, exploiting human behaviour and system
vulnerabilities to steal sensitive information such as login credentials and financial data. Existing detection systems frequently
rely on singular modelling approaches and thus fall short in addressing the multidimensional and continuously evolving nature
of these attacks. To overcome this challenge, the present work proposes a hybrid phishing detection framework that integrates
three complementary techniques: DistilBERT (Distilled Bidirectional Encoder Representations from Transformers) for semantic
analysis of URL text, Graph Neural Networks (GNN) for modelling structural relationships among URL components, and
LightGBM (Light Gradient Boosting Machine) for efficient metadata-based feature classification. The outputs of the three
models are fused through a weighted ensemble voting mechanism, enabling the system to leverage textual, structural, and
statistical perspectives simultaneously. By replacing the computationally heavy BERT model used in prior work with the lighter
DistilBERT variant, the proposed system achieves reduced computational complexity, faster inference, and lower memory
consumption while preserving detection quality. Experimental evaluation on a large-scale Kaggle phishing URL dataset
demonstrates that the hybrid ensemble yields a weighted phishing probability of 86.9%, with individual model contributions of
0.628 (DistilBERT), 1.000 (GNN), and 0.999 (LightGBM). The system is deployed via a Flask-based web interface that enables
real-time URL classification. This multi-level approach underscores the importance of strengthening online security through
robust, efficient, and scalable detection mechanisms.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Phishing is currently one of the most common and most monetarily devastating types of cyberattacks, and hackers are actively employing it to acquire sensitive usernames and financial information with the use of nefarious uniform resource locators (URLs). The traditional intrusion detection system has failed to perform well against these new threats because they are based on traditional rules and sets of constraints which cannot be modified to suit the new trends of intrusion. The article presents a distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network. The suggested modified XGBoost algorithm is designed to solve the problem of scalability, robustness, and privacy through adapting feature weights, managing features via regularization, and aggregating gradients with the help of encryption. Even though recent advancements in DL architecture, such as convolutional neural networks (CNNs), bidirectional long short-term memory networks, CNN and long short-term memory networks, and deep reinforcement learning have demonstrated competitive performance, they are severely limited, such as high computation complexity and inference latency of between 85 and 145 ms, and hardware requirements based on the use of GPU technology, which is not feasible to implement in a resource-constrained network. The proposed modified XGBoost is characterized by a competitive performance of 96.9% and an F1-score of 0.973, although its inference latency is significantly lower, 18 ms, in the range of 8 times lower than that of DL-based methods, and inherently has the feature-importance analysis that can be interpreted. The importance of such performance increments is checked with the help of one-way analysis of variance and Tukey Honestly Significant Difference tests, the
p
-value of which is established at 0.0003.
G. R, G. S., Belshia Jebamalar T et al.· Journal of High Speed Networ...· 0 citations
External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed phishing detection model is reliable.
A Phishing Website Detection System Using a Stacked Hybrid Model With Explainable AI, designed to accurately classify websites as phishing or legitimate while providing transparent decision explanations, is presented.
A. Mounika, D. Ramakrishna· International Journal for Re...· 0 citations
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
Topicality. Phishing attacks remain one of the most common initial access vectors because they combine URL obfuscation, social engineering and rapid changes in domain infrastructure. From the perspective of computer science, the problem can be formulated as the classification of weakly structured textual objects; from the perspective of cybersecurity, it is a risk-reduction task aimed at preventing credential compromise, financial data leakage and malware delivery. The subject of the study is the automated detection of phishing URLs using lexical and structural features without opening or rendering the target webpage. The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module. The following results were obtained. The paper reviews current approaches to phishing mitigation and critically analyzes regulatory, organizational and machine-learning solutions. It is shown that many existing works do not sufficiently balance detection speed, interpretability and resistance to rapidly changing domains. The practical part includes the implementation of a feature extraction module and a simulation dataset of 1600 URLs. Logistic Regression, Decision Tree, Random Forest and Gradient Boosting were tested. The best F1 result was obtained by Random Forest: accuracy - 0.900, precision - 0.910, recall - 0.888, F1 - 0.899. Conclusion. Lexical URL features make it possible to build a fast and interpretable phishing pre-detection mechanism; however, such a model should be used as part of a layered cyber defense system rather than as a single decision-making control.
D. Abrosimov, D. Balagura, A.M. Yevheniev et al.· Terra security· 0 citations