Smart Detection and Prevention of Phishing Websites Using ML & NLP

Abstract

Phishing attacks are one of the long-lasting problems in cybersecurity. Attackers are always changing their techniques to avoid being caught by conventional detection techniques. The techniques used currently are based on static blacklists or individual classifiers using features, but this does not completely represent the phishing attack. This project fills this critical information security gap by developing a hybrid real-time phishing detection system in the form of a Google Chrome extension. Our system uses a combination of two independent machine learning pipelines. In the first pipeline, we use thirty hand-crafted features to classify URL structure using a Gradient Boosting Classifier on 11,054 samples with 97.4% accuracy. In the second pipeline, we use raw HTML data from the webpage. We use a TF-IDF vectorizer on HTML data injected with semantic flag tokens. We use a Random Forest Classifier on 1,859 real site files with 82.80% accuracy. We combine the results using a weighted combination. We use a Retrieval Augmented Generation module, which uses a Google Gemini language model. We use a FAISS vector index to produce a risk explanation in a human-readable format. We use a trusted domain whitelist for false positives on legitimate banking and government websites. We use a pattern-based blocklist for piracy and malware domains. We use a popup interface to show users Safe or Phishing results. We use a full-screen alert overlay injected into the active tab for users. We use experimental results to show that our system performs better than any individual baseline