A Browser-Based Hybrid Deep Learning Framework for Robust Phishing URL Detection

Abstract

Phishing attacks have become among the most influential cybercrimes at a very fast pace, taking advantage of technical vulnerabilities as well as human vulnerability. Current detection systems are usually unsuccessful with zero-day phishing links, maliciously designed links, and websites generated by AIs. In order to address these limitations, this paper suggests a new hybrid AI-based phishing detection system integrating the capabilities of deep learning, ensemble learning, anomaly detection, and explainable AI. We use a Convolutional Neural Network (CharCNN) which operates on a character level, a LightGBM that uses built lexical along with host-based features, as well as a Logistic Regression meta-classifier that combines the results of probabilistic models into one decision. To combat the severe drawback of zero-day resilience, we integrate an Isolation Forest anomaly detector that identifies unseen suspicious URLs, despite the use of classifiers which predict benign URLs. More so, we propose an uncertainty-aware prediction system that does not yield forced classification when the probabilities are uncertain, thus minimizing the number of false positives and false negatives. In order to increase user trust and the usability of the analyst, the framework has a explainability module which points out suspicious tokens (e.g., homoglyphs like g00gle.com or sensitive keywords like login-secure) directly in the browser. The entire system is implemented as a real-time browser extension which also allows to easily intercept and classify URLs with the minimum amount of latency. Evaluation on benchmark phishing datasets reveals that our model has an accuracy of 99.1, precision of 98.8 and recall of 99.3 as well as F1-score of 99.1 that is higher than base CNN, LightGBM, and BERT-based systems. As opposed to our previous work, our solution is the first to integrate zero-day anomaly detection, explainability, and uncertainty management into a practical, scalable, and deployable browser-based defence to enable the translation between academic research and practice in cybersecurity.