Browser-based phishing detection system using modern web technologies

Abstract

Phishing remains one of the most persistent cybersecurity threats, exploiting human trust to steal sensitive information through deceptive websites. Traditional detection methods, reliant on blacklists and reactive reporting, offer limited protection against rapidly evolving zero-day attacks. To address these challenges, this study proposes and evaluates a hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service. Communication between the client and server is optimised using gRPC over the QUIC protocol, ensuring secure, high-performance data exchange with built-in retry mechanisms for resilience. The framework adopts a fail-safe decision strategy in which URLs identified as malicious by VirusTotal are immediately blocked, while benign or unknown results are further evaluated using a weighted fusion of machine learning and DOM-based scores. The model was trained on several high-impact URL features to ensure both speed and accuracy. Privacy remains a core principle, with sensitive data processed locally and minimal external data transmission. Experimental evaluation demonstrates that the proposed framework achieves a detection accuracy of 96.7%, with 97.1% precision, 96.0% recall, an F1-score of 96.6%, and an AUC of 0.993 using the optimised Random Forest classifier. The complete detection pipeline maintains an average end-to-end latency of less than one second, while the hybrid decision-fusion strategy successfully detects 91.7% of zero-day phishing URLs in the live evaluation dataset. These results demonstrate that the proposed architecture provides an accurate, low-latency, privacy-aware, and practically deployable solution for real-time browser-based phishing detection.