Jul 2026· Journal of Intelligent Decision Making and Information Science· Vol 3, pp. 1047-1053· 0 citations· 11 references
TL;DR
A framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound is presented, which shows that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.
Abstract
Malicious web sites hosted via manipulated URL strings present users with phishing, malware and defacement. This research presents a framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound. Model is trained on a Kaggle dataset of 651191 URLs (4,28,103 benign, 96,457 defacement, 94,111 phishing and 32,520 malware). After tokenization, feature extraction and then a logistic-like function which gives a probability score, calibration applies a constraint on the amount of error. In comparative tests, the proposed model results in an accuracy, precision, recall, F1-score and AUC of 98.64%, 98.12%, 97.89%, 98.00% and 0.99, which is about 1-3 % better than that of logistic regression, random forest, XGBoost and CNN classifiers. These results show that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.
The rapid growth of internet services has significantly increased the number of malicious webpages that target users through phishing, malware distribution, fake login pages, and other cyberattacks. Conventional detection techniques such as blacklist-based and signature-based methods are effective only for identifying known malicious websites and often fail to detect newly created or obfuscated URLs. To overcome these limitations, this paper presents a Real-Time Malicious Webpage Detection System using a Hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) model. The proposed system automatically learns structural and sequential characteristics from URL strings without relying on manually engineered features. URL preprocessing techniques including cleaning, tokenization, encoding, and normalization are performed before training the model. The CNN component extracts lexical and structural patterns from URLs, while the LSTM component captures sequential dependencies for improved classification performance. A Flask-based web application has been developed to provide real-time URL prediction through a user-friendly interface. In addition, a Google Chrome Extension has been implemented to allow users to verify webpage safety directly while browsing. Experimental evaluation demonstrates that the Hybrid CNN–LSTM model effectively classifies webpages as Safe, Suspicious, or Malicious, providing improved detection accuracy and faster prediction compared with conventional machine learning approaches. The proposed system offers a lightweight, scalable, and practical solution for enhancing web security against evolving cyber threats
Sinchana and Dr. Kruthi R· International Journal of Adv...· 0 citations
Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
The proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses and suggests that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
K. Shrinivas, B. Karthick, M. MuthukaruppanKN et al.· International Conference on...· 0 citations
Despite advances in machine learning-based phishing detection, existing Artificial Neural Network (ANN) models operate as black boxes with no interpretable explanation of feature interactions—a critical limitation for security analysts. Furthermore, most approaches deploy large feature sets without investigating whether a minimal subset achieves equivalent performance. This study develops a phishing detection system combining ANN with Logic Gate-Based Feature Interaction Modeling (LGFIM), a novel framework that characterizes ANN decisions through AND, OR, and XOR Boolean operations, addressing both accuracy and interpretability gaps. Using the PhiUSIIL dataset (235,795 instances), Pearson correlation identified URLSimilarityIndex (r=0.8604) and HasSocialNet (r=0.7843) as the two most discriminative features. An ANN (2-64-32-16-1, ReLU, Adam) trained on an 80/20 split achieved 99.63% accuracy, 100% recall, 99.68% F1-score, and 99.91% AUC-ROC with zero false negatives. The LGFIM analysis reveals the classification boundary follows a predominantly AND-type Boolean structure: the AND gate achieves 99.67% accuracy against true labels, while ANN predictions align with AND for 42.48% of samples and XOR for 57.52%, together accounting for 100% of all predictions. This is the first study to comprehensively characterize ANN phishing decisions through logic gate interaction patterns, providing a zero-cost interpretability layer for cybersecurity operations.
M. H. Rahman, Z. Abidin, M. A. Hariyadi· G-Tech· 0 citations
Topicality. Phishing attacks remain one of the most common initial access vectors because they combine URL obfuscation, social engineering and rapid changes in domain infrastructure. From the perspective of computer science, the problem can be formulated as the classification of weakly structured textual objects; from the perspective of cybersecurity, it is a risk-reduction task aimed at preventing credential compromise, financial data leakage and malware delivery. The subject of the study is the automated detection of phishing URLs using lexical and structural features without opening or rendering the target webpage. The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module. The following results were obtained. The paper reviews current approaches to phishing mitigation and critically analyzes regulatory, organizational and machine-learning solutions. It is shown that many existing works do not sufficiently balance detection speed, interpretability and resistance to rapidly changing domains. The practical part includes the implementation of a feature extraction module and a simulation dataset of 1600 URLs. Logistic Regression, Decision Tree, Random Forest and Gradient Boosting were tested. The best F1 result was obtained by Random Forest: accuracy - 0.900, precision - 0.910, recall - 0.888, F1 - 0.899. Conclusion. Lexical URL features make it possible to build a fast and interpretable phishing pre-detection mechanism; however, such a model should be used as part of a layered cyber defense system rather than as a single decision-making control.
D. Abrosimov, D. Balagura, A.M. Yevheniev et al.· Terra security· 0 citations