Phishing attacks continue to pose a significant threat to individuals and organizations, driven by the increasing sophistication of cybercriminal techniques and the rapid expansion of digital services. Traditional detection approaches, such as blacklist-based and rule-based systems, are often ineffective against newly generated or obfuscated phishing URLs. This study proposes a machine learning (ML)-based framework intended for integration within penetration testing environments. The approach leverages multiple supervised learning algorithms, including Random Forest (RF), Support Vector Machine (SVM), and XGBoost, trained and evaluated using the PhiUSIIL Phishing URL Dataset, a large-scale benchmark dataset containing phishing and legitimate URL samples. A comprehensive preprocessing pipeline and feature engineering strategy are employed to enhance model performance. Experimental results demonstrate exceptionally high detection accuracy, with RF and XGBoost achieving near-perfect classification performance across key evaluation metrics, including accuracy, precision, recall, F1-score, and ROC-AUC. The proposed system is further designed for real-time deployment, enabling integration into penetration testing workflows for proactive security assessment. Despite promising results, limitations related to dataset characteristics and real-world generalization are acknowledged. Overall, this research highlights the effectiveness and practical applicability of ML-based approaches in strengthening phishing detection and advancing modern cybersecurity defences.
Ashwag Alotaibi, Mounir Frikha· International Journal of Adv...· 0 citations
The growing amount of heterogeneous devices with scarce resources is compromising the security of the Internet of Things (IoT), as they are more likely to adapt to a fixed and identity-based access control. Conventional security systems tend to assume that once a device is authenticated, the network may be exposed to credential theft, firmware, and insider abuse. In this study a behavior-sensitive access control solution is presented, which integrates lightweight supervised Machine Learning (ML) on the IoT gateway to provide dynamic authorization. Unlike the traditional passive intrusion detection models, the proposed framework uses a Supervised Random Forest model to process real-time statistical feature summaries in terms of mean, standard deviation, and sparsity of the IoT telemetry data. The method converts the output of anomaly detection directly into access (full, restricted or blocked) levels. The system was implemented on a Flask-based gateway and tested with ToN-IoT benchmark dataset. The results of the experiments show an anomaly-class recall of 0.9986 (99.86%) with 91,169 correctly detected attack and 125 false negatives among the 91,294 attack instances, for a security-oriented Zero Trust profile. As an example, when rounded to two decimal places, this value is 1.00, but the unrounded value is reported so as not to suggest 100% detection. The enforcement layer focuses on reducing risk and removes or filters out requests that were determined to be malicious or unauthorized in the scenarios. The architecture is designed to provide low latency through feature extraction and inference on the edge, which provides data privacy because telemetry processing is locally done without relying on the cloud.
Yaseen Alduwayl, Abdullah T. Al-Essa, Mounir Frikha· International Journal of Adv...· 0 citations