Aug 2026· International Journal of Creative and Open Research in Engineering and Management· Vol 02, pp. 1-9· 0 citations
TL;DR
A high-efficiency detection framework utilizing DistilBERT, a distilled knowledge representation of the BERT transformer is proposed, substantiate the viability of Knowledge Distillation as a mechanism to deploy state-of-the-art semantic security filters on edge infrastructure.
Abstract
The ubiquity of Application-to-Person (A2P) messaging has inadvertently created a robust vector for mobile security threats, specifically Smishing (SMS Phishing). Traditional lexical filters, such as Naive Bayes and Support Vector Machines (SVM), exhibit diminishing returns against modern obfuscated attacks due to their inability to interpret semantic context. While Transformer-based architectures like BERT have revolutionized Natural Language Processing (NLP), their computational latency renders them impractical for real-time deployment on resource-constrained mobile edge devices. This study proposes a high-efficiency detection framework utilizing DistilBERT, a distilled knowledge representation of the BERT transformer. By fine-tuning this architecture on the UCI SMS Spam Collection, we achieved a testing accuracy of 99.04% and a weighted F1-score of 0.9904. Notably, the model maintained a precision of 0.97 on the minority spam class, effectively mitigating the class imbalance problem without synthetic data augmentation. These results substantiate the viability of Knowledge Distillation as a mechanism to deploy state-of-the-art semantic security filters on edge infrastructure.
Keywords - SMS Spam, Knowledge Distillation, DistilBERT, Cybersecurity, Edge AI, NLP, Smishing, Transfer Learning
The proliferation of mobile communications has led to a significant increase in SMS spam, posing challenges related to security, privacy, and user experience. Although numerous machine-learning-based spam detection approaches have been proposed, developing systems that are simultaneously lightweight and resilient to adversarial manipulation remains an open problem. This paper proposes an SMS spam detection framework that incorporates multiple feature extraction methods, including bag-of-words (BoW), Term Frequency–Inverse Document Frequency (TF-IDF), and N-gram models with dimensionality reduction using principal component analysis (PCA), followed by classification using decision tree (DT) and Logistic Regression (LogReg) models. Experimental evaluations on the UCI SMS Spam Collection dataset demonstrate that the TF-IDF-PCA-DT pipeline achieves a detection accuracy of 99% while reducing model size by 77% and inference time by 75%. Robustness evaluation under adversarial text perturbations indicates minimal performance degradation, maintaining an accuracy of 96.5%. These findings demonstrate the practicality of the proposed framework for real-world deployment in resource-constrained environments.
Baraa Tareq Hammad, Ismail Taha Ahmed, Mohamed A. Hafez et al.· Computers· 0 citations
Phishing attacks via desktops, smartphones and internet of things devices are becoming increasingly sophisticated, posing critical security challenges for digital infrastructures. Defending against these attacks requires AI-based detection models that maintain high accuracy, since false positives or negatives can lead to severe breaches, while remaining lightweight enough to run on resource-constrained client devices. Split Learning (SL) meets these requirements by having clients compute only initial model layers locally and transmit intermediate activations (“smashed data”) to a server for the remaining inference, avoiding direct sharing of raw inputs. However, prior work in the image domain has shown that smashed data can leak original content, suggesting that SL may not be safe for user privacy. Therefore, it is essential to investigate whether these privacy risks also extend to language-model–based SL systems, which have fundamentally different neural network architectures, including attention mechanism. This paper introduces the Semantic Information Reconstruction Attack (SIRA), a novel framework designed to infer sensitive semantic elements directly from smashed data by leveraging the generative capabilities of large language models. In experiments on real-world phishing datasets, SIRA outperforms conventional reconstruction attacks in accurately inferring private webpage information. These findings reveal a potential privacy vulnerability in SL-based language models for security applications and motivate the development of targeted defense strategies.
Yushin Kim, Jungin Kim, Yongseok Kwon et al.· International Journal of Inf...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
The rapid proliferation of digital communication has exponentially increased the volume of Short Message Service (SMS) spam, exposing mobile users to systemic convenience disruptions, productivity drops, and severe financial losses through sophisticated fraudulent schemes. To construct a highly dependable filtering mechanism, this study presents a rigorous dual-pipeline machine learning framework that systematically addresses the challenges of class imbalance in statistical text mining. Utilizing a verified dataset of 5,572 Indonesian-context short messages, the raw textual corpus is subjected to uniform case normalization, structural URL extraction, and character filtering before feature projection via Term Frequency–Inverse Document Frequency (TF-IDF) vectorization. To overcome the inherent accuracy paradox of skewed class distributions, the experimental design evaluates a baseline pipeline (imbalanced data) against a synthetic data augmentation pipeline leveraging the Synthetic Minority Oversampling Technique (SMOTE) across four distinct classifiers: Logistic Regression, Naive Bayes, Linear Support Vector Machine (Linear SVM), and Random Forest. Empirical results demonstrate that while the baseline Linear SVM serves as the optimal standalone model for overall balance, achieving a peak accuracy of 98.11% and a dominant F1-Score of 92.83%, the SMOTE-augmented Random Forest configuration yields an exceptional high-security alternative by securing a flawless 100.00% precision envelope alongside an 83.89% recall rate. Advanced post-hoc evaluations including McNemar's statistical significance tests (, for Random Forest), qualitative error analyses of semantic edge cases, and runtime profiling confirm that the developed architecture establishes a highly scalable, mathematically verified, and low-latency solution suitable for integration into real-time telecom filtering gateways.
Zulpan Hadi, Selamet Riadi, Supardianto et al.· Journal Computer and Technol...· 0 citations
Phishing attacks remain a major cybersecurity threat, causing financial loss, data breaches, and reputational damage to individuals and organizations. Conventional detection methods, such as rule-based filters and blacklist-based systems, often fail to identify newly generated or highly obfuscated phishing URLs. Recent advances in artificial intelligence, particularly large language models (LLMs), provide new opportunities to detect complex structural and contextual patterns in malicious web addresses. This study evaluates the effectiveness of transformer-based LLMs for phishing URL detection by comparing LLaMA-3 and GEMMA-7B with traditional machine learning models, including Support Vector Machines, Random Forest, and XGBoost. The models were fine-tuned and tested on a publicly available dataset containing 247,950 labeled URLs, each described by 42 structural and lexical features. To support transformer-based classification, structured URL attributes were converted into textual representations, enabling the models to exploit contextual embeddings. Experimental results showed that LLMs outperformed conventional machine learning baselines. GEMMA-7B achieved the best performance, with an accuracy of approximately 94.8%, followed by LLaMA-3 at 94%. These findings suggest that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques. Overall, the proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations
Phishing email detection has been destabilised by Large Language Models (LLMs), which allow attackers to mass-produce fluent, contextually plausible messages. Detectors tuned on legacy corpora, notably the 2008 CEAS spam collection, consequently report benchmark accuracies that do not survive deployment. We present PhishingGAT, a detector that fuses word-level semantic features with structural ones and is hardened against adversarial perturbation. Each email is represented as an undirected graph whose nodes are unique tokens carrying 100-dimensional GloVe embeddings, and whose edges record co- occurrence inside a three-token sliding window. A two-layer Graph Attention Network (GAT) then learns per-edge importance over that graph. Robustness comes from Projected Gradient Descent (PGD) adversarial training, applied to continuous node features during optimisation only. Training uses a hybrid corpus of 70,716 emails assembled from the CEAS collection, the Enron collection, and curated LLM-generated samples. Evaluation follows two protocols. The first is strictly zero-shot: 1,186 unseen LLM-generated adversarial emails, on which the model reaches 77.40 per cent accuracy and an area under the receiver operating characteristic curve (AUC) of 0.8700. The second is domain-adapted: 401 held-out hard samples, on which accuracy rises to 90.27 per cent and AUC to 0.9717. The 12.87 percentage-point difference between the two is, to our knowledge, the first such measurement reported for graph-based phishing detection, and it quantifies a degradation that same-distribution benchmarks systematically hide. An ablation separates the contribution of attention from that of adversarial defence, and repeated runs across independent random seeds confirm that the reported figures are reproducible rather than seed artefacts.
R. Kodali, Siva Rama Krishna T Dr· International Journal of Inn...· 0 citations