Jul 2026· International Journal for Research in Applied Science and Engineering Technology· Vol 14, pp. 2016-2021· 0 citations
TL;DR
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Abstract
Phishing attacks constitute one of the most pervasive cyber threats, exploiting human behaviour and system
vulnerabilities to steal sensitive information such as login credentials and financial data. Existing detection systems frequently
rely on singular modelling approaches and thus fall short in addressing the multidimensional and continuously evolving nature
of these attacks. To overcome this challenge, the present work proposes a hybrid phishing detection framework that integrates
three complementary techniques: DistilBERT (Distilled Bidirectional Encoder Representations from Transformers) for semantic
analysis of URL text, Graph Neural Networks (GNN) for modelling structural relationships among URL components, and
LightGBM (Light Gradient Boosting Machine) for efficient metadata-based feature classification. The outputs of the three
models are fused through a weighted ensemble voting mechanism, enabling the system to leverage textual, structural, and
statistical perspectives simultaneously. By replacing the computationally heavy BERT model used in prior work with the lighter
DistilBERT variant, the proposed system achieves reduced computational complexity, faster inference, and lower memory
consumption while preserving detection quality. Experimental evaluation on a large-scale Kaggle phishing URL dataset
demonstrates that the hybrid ensemble yields a weighted phishing probability of 86.9%, with individual model contributions of
0.628 (DistilBERT), 1.000 (GNN), and 0.999 (LightGBM). The system is deployed via a Flask-based web interface that enables
real-time URL classification. This multi-level approach underscores the importance of strengthening online security through
robust, efficient, and scalable detection mechanisms.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Phishing is currently one of the most common and most monetarily devastating types of cyberattacks, and hackers are actively employing it to acquire sensitive usernames and financial information with the use of nefarious uniform resource locators (URLs). The traditional intrusion detection system has failed to perform well against these new threats because they are based on traditional rules and sets of constraints which cannot be modified to suit the new trends of intrusion. The article presents a distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network. The suggested modified XGBoost algorithm is designed to solve the problem of scalability, robustness, and privacy through adapting feature weights, managing features via regularization, and aggregating gradients with the help of encryption. Even though recent advancements in DL architecture, such as convolutional neural networks (CNNs), bidirectional long short-term memory networks, CNN and long short-term memory networks, and deep reinforcement learning have demonstrated competitive performance, they are severely limited, such as high computation complexity and inference latency of between 85 and 145 ms, and hardware requirements based on the use of GPU technology, which is not feasible to implement in a resource-constrained network. The proposed modified XGBoost is characterized by a competitive performance of 96.9% and an F1-score of 0.973, although its inference latency is significantly lower, 18 ms, in the range of 8 times lower than that of DL-based methods, and inherently has the feature-importance analysis that can be interpreted. The importance of such performance increments is checked with the help of one-way analysis of variance and Tukey Honestly Significant Difference tests, the
p
-value of which is established at 0.0003.
G. R, G. S, Belshia Jebamalar T et al.· Journal of High Speed Networ...· 0 citations
Phishing attacks have become increasingly sophisticated, exploiting techniques such as URL manipulation, certificate authority abuse, and misleading hyperlinks to evade traditional security mechanisms. Although machine learning models have demonstrated high effectiveness in phishing detection, many rely on benchmark datasets that emphasize performance over real-world applicability and lack interpretability. This paper proposes an interpretable phishing detection model utilizing structured multi-feature representations and ensemble learning. The term "hybrid" in this study refers to the integration of multiple feature sources, including URL-based, domain-based, and behavioral features, rather than combining multiple classifiers. A Random Forest classifier was developed using the UCI Phishing Websites dataset (11,055 samples) which contains 30 structural features. The proposed model utilizes all three types of indicators: URL-based, domain-based, and webpage behavior indicators, and allows for fast feature importance analysis. The proposed model's experimental results demonstrated an accuracy of 96.9%, a recall of 97.9%, and an Area Under the Curve (AUC) of 0.99 when tested against unseen data. Feature importance analysis demonstrated that the presence or absence of Secure Sockets Layer (SSL) validation status and the structure of a hyperlink were key indicators of phishing. External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed model is reliable. Therefore, these results demonstrate that the proposed method provides a balance between model performance, interpretability, and the practicality of deployment.
Phishing attacks have become a critical cybersecurity challenge due to the increasing use of fraudulent websites and
malicious URLs to deceive users and obtain sensitive information. Conventional phishing detection approaches such as
blacklist-based filtering and static rule-based techniques often fail to recognize newly generated phishing websites because they
depend on previously identified threats. To overcome these limitations, this work presents a Phishing Website Detection System
Using a Stacked Hybrid Model With Explainable AI, designed to accurately classify websites as phishing or legitimate while
providing transparent decision explanations. The proposed framework utilizes a stacking ensemble architecture that combines
multiple learning models, including Artificial Neural Network (ANN), Bagging K-Nearest Neighbors (KNN), and Support
Vector Machine (SVM), to identify complex patterns from URL-based and website-related characteristics. Logistic Regression
is incorporated as a meta-level classifier to combine the predictions of individual models and generate the final classification
result. The system uses extracted lexical, structural, and security-related website features to improve detection reliability and
enhance model generalization. Furthermore, Explainable Artificial Intelligence (XAI) is integrated through SHAP to analyze
the contribution of individual features and provide meaningful explanations behind each prediction. This improves the
transparency of the detection process by showing the factors that influence phishing and legitimate classifications. A useroriented detection interface is also developed, allowing users to submit website URLs and receive immediate classification results
along with feature-based explanations. Performance assessment of the developed hybrid model is carried out using a publicly
available phishing website dataset. Experimental results evaluated using Accuracy, Precision, Recall, and F1-score indicates
that the stacked hybrid model provides reliable and consistent identification of phishing websites.
A. Mounika, D. Ramakrishna· International Journal for Re...· 0 citations
Phishing remains one of the most persistent cybersecurity threats, exploiting human trust to steal sensitive information through deceptive websites. Traditional detection methods, reliant on blacklists and reactive reporting, offer limited protection against rapidly evolving zero-day attacks. To address these challenges, this study proposes and evaluates a hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service. Communication between the client and server is optimised using gRPC over the QUIC protocol, ensuring secure, high-performance data exchange with built-in retry mechanisms for resilience. The framework adopts a fail-safe decision strategy in which URLs identified as malicious by VirusTotal are immediately blocked, while benign or unknown results are further evaluated using a weighted fusion of machine learning and DOM-based scores. The model was trained on several high-impact URL features to ensure both speed and accuracy. Privacy remains a core principle, with sensitive data processed locally and minimal external data transmission. Experimental evaluation demonstrates that the proposed framework achieves a detection accuracy of 96.7%, with 97.1% precision, 96.0% recall, an F1-score of 96.6%, and an AUC of 0.993 using the optimised Random Forest classifier. The complete detection pipeline maintains an average end-to-end latency of less than one second, while the hybrid decision-fusion strategy successfully detects 91.7% of zero-day phishing URLs in the live evaluation dataset. These results demonstrate that the proposed architecture provides an accurate, low-latency, privacy-aware, and practically deployable solution for real-time browser-based phishing detection.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
Topicality. Phishing attacks remain one of the most common initial access vectors because they combine URL obfuscation, social engineering and rapid changes in domain infrastructure. From the perspective of computer science, the problem can be formulated as the classification of weakly structured textual objects; from the perspective of cybersecurity, it is a risk-reduction task aimed at preventing credential compromise, financial data leakage and malware delivery. The subject of the study is the automated detection of phishing URLs using lexical and structural features without opening or rendering the target webpage. The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module. The following results were obtained. The paper reviews current approaches to phishing mitigation and critically analyzes regulatory, organizational and machine-learning solutions. It is shown that many existing works do not sufficiently balance detection speed, interpretability and resistance to rapidly changing domains. The practical part includes the implementation of a feature extraction module and a simulation dataset of 1600 URLs. Logistic Regression, Decision Tree, Random Forest and Gradient Boosting were tested. The best F1 result was obtained by Random Forest: accuracy - 0.900, precision - 0.910, recall - 0.888, F1 - 0.899. Conclusion. Lexical URL features make it possible to build a fast and interpretable phishing pre-detection mechanism; however, such a model should be used as part of a layered cyber defense system rather than as a single decision-making control.
D. Abrosimov, D. Balagura, A.M. Yevheniev et al.· Terra security· 0 citations