Jul 2026· Computer and Decision Making: An International Journal· Vol 3, pp. 859-875· 2 citations
TL;DR
Results demonstrate the promise of the unified, interpretable approach in advancingadaptive and trustworthy generalized phishing detection systems and integrate interpretability into model decisions using Explainable AI, particularly SHapley Additive exPlanations.
Abstract
Phishing remains one of the most pervasive cybersecurity threats, exploiting humanand technical vulnerabilities and targeting users through deceptive Emails,URLs, and SMS messages. Artificial Intelligence (AI) and Machine Learning (ML)techniques have been widely used to improve phishing detection accuracy. However,most existing studies have focused on specific data types, thereby limitingthe scope of their applicability, and lacking a generalized framework integratingheterogeneous data sources within phishing context. In this study, we propose ageneralized phishing detection framework that leverages classical machine learning(Random Forest and Logistic Regression) and deep learning (ConvolutionalNeural Network) to identify phishing attempts across heterogeneous textual data,such as Emails, URLs, and SMS messages. Moreover, we integrate interpretabilityinto model decisions using Explainable AI, particularly SHapley Additive exPlanations(SHAP), to enhance transparency and trustworthiness. The framework isevaluated based on both predictive performance and inference efficiency. Experimentalresults show that Random Forest achieves the highest accuracy (93%)and F1-score (85%), highlighting the efficiency of the classifier on tabular data forthe binary classification task at hand, while SHAP local and global explanationsreveal semantically relevant features influencing model decisions, where wordssuch as “admin” and “login” are identified as strong phishing indicators. These resultsdemonstrate the promise of our unified, interpretable approach in advancingadaptive and trustworthy generalized phishing detection systems.
External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed phishing detection model is reliable.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
K. Shrinivas, B. Karthick, M. MuthukaruppanKN et al.· International Conference on...· 0 citations
An Explainable Ensemble Artificial Intelligence Framework for Real Time Phishing Website Detection that addresses the primary weakness of existing systems and is deployed as a real-time desktop application.
F. J. Boniface· International Journal of Com...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
The multi-modal approach improves accuracy, reduces mistakes, and adapts better to new phishing methods, and performs better than single-method systems and has strong potential for future improvement.
R. Paper, Wong Ki Hurn, T. Yan et al.· International Journal of Eme...· 0 citations