Jul 2026· 2026 4th International Conference on Sustainable Computing and Smart Systems (ICSCSS)· pp. 1689-1695· 0 citations· 16 references
Abstract
The security landscape is increasingly at risk from phishing attackers; individuals engaging in this type of attack successfully persuade users to divulge sensitive data such as identity information or financial resources. Existing blacklist-based solutions and other approaches have proved ineffective because the adversaries are able to adjust to current bottleneck detectors and because machine learning models are based on hand-crafted behavior patterns. Deep learning brings the inductive bias of generalization to the fore while explicitly constraining the architectures to only hold local representations and to limit their capacity to express long-range relationships in data. We present a model based on CapsNet for phishing website detection in this paper. In the framework of CapsNets, dynamic routing is used to fortify the relationship between spatial and hierarchical features in a model that is built upon these orders between features. This approach is mostly to enable the model to gain complex relationships in a URL string and HTML structure. As a result of this property, the architecture is resistant to various types of adversarial perturbations like character replacement, subdomain mimicry, and misphrasing in phishing URLs. The model is evaluated the model using datasets from PhishTank, OpenPhish, and a benign domain list sourced from the Tranco list. Experimental results show that the proposed method is superior to the state-of-the-art deep learning methods and traditional classifiers in terms of accuracy, precision, recall, and ROC-AUC and reduces the false positive rate. The results confirm that CapsNet is a stable and flexible method for phishing classification that can be used for designing and implementing secure reliable web protection systems.
Phishing is currently one of the most common and most monetarily devastating types of cyberattacks, and hackers are actively employing it to acquire sensitive usernames and financial information with the use of nefarious uniform resource locators (URLs). The traditional intrusion detection system has failed to perform well against these new threats because they are based on traditional rules and sets of constraints which cannot be modified to suit the new trends of intrusion. The article presents a distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network. The suggested modified XGBoost algorithm is designed to solve the problem of scalability, robustness, and privacy through adapting feature weights, managing features via regularization, and aggregating gradients with the help of encryption. Even though recent advancements in DL architecture, such as convolutional neural networks (CNNs), bidirectional long short-term memory networks, CNN and long short-term memory networks, and deep reinforcement learning have demonstrated competitive performance, they are severely limited, such as high computation complexity and inference latency of between 85 and 145 ms, and hardware requirements based on the use of GPU technology, which is not feasible to implement in a resource-constrained network. The proposed modified XGBoost is characterized by a competitive performance of 96.9% and an F1-score of 0.973, although its inference latency is significantly lower, 18 ms, in the range of 8 times lower than that of DL-based methods, and inherently has the feature-importance analysis that can be interpreted. The importance of such performance increments is checked with the help of one-way analysis of variance and Tukey Honestly Significant Difference tests, the
p
-value of which is established at 0.0003.
G. R, G. S, Belshia Jebamalar T et al.· Journal of High Speed Networ...· 0 citations
Phishing attacks via desktops, smartphones and internet of things devices are becoming increasingly sophisticated, posing critical security challenges for digital infrastructures. Defending against these attacks requires AI-based detection models that maintain high accuracy, since false positives or negatives can lead to severe breaches, while remaining lightweight enough to run on resource-constrained client devices. Split Learning (SL) meets these requirements by having clients compute only initial model layers locally and transmit intermediate activations (“smashed data”) to a server for the remaining inference, avoiding direct sharing of raw inputs. However, prior work in the image domain has shown that smashed data can leak original content, suggesting that SL may not be safe for user privacy. Therefore, it is essential to investigate whether these privacy risks also extend to language-model–based SL systems, which have fundamentally different neural network architectures, including attention mechanism. This paper introduces the Semantic Information Reconstruction Attack (SIRA), a novel framework designed to infer sensitive semantic elements directly from smashed data by leveraging the generative capabilities of large language models. In experiments on real-world phishing datasets, SIRA outperforms conventional reconstruction attacks in accurately inferring private webpage information. These findings reveal a potential privacy vulnerability in SL-based language models for security applications and motivate the development of targeted defense strategies.
Yushin Kim, Jungin Kim, Yongseok Kwon et al.· International Journal of Inf...· 0 citations
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
Phishing remains one of the most persistent cybersecurity threats, exploiting human trust to steal sensitive information through deceptive websites. Traditional detection methods, reliant on blacklists and reactive reporting, offer limited protection against rapidly evolving zero-day attacks. To address these challenges, this study proposes and evaluates a hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service. Communication between the client and server is optimised using gRPC over the QUIC protocol, ensuring secure, high-performance data exchange with built-in retry mechanisms for resilience. The framework adopts a fail-safe decision strategy in which URLs identified as malicious by VirusTotal are immediately blocked, while benign or unknown results are further evaluated using a weighted fusion of machine learning and DOM-based scores. The model was trained on several high-impact URL features to ensure both speed and accuracy. Privacy remains a core principle, with sensitive data processed locally and minimal external data transmission. Experimental evaluation demonstrates that the proposed framework achieves a detection accuracy of 96.7%, with 97.1% precision, 96.0% recall, an F1-score of 96.6%, and an AUC of 0.993 using the optimised Random Forest classifier. The complete detection pipeline maintains an average end-to-end latency of less than one second, while the hybrid decision-fusion strategy successfully detects 91.7% of zero-day phishing URLs in the live evaluation dataset. These results demonstrate that the proposed architecture provides an accurate, low-latency, privacy-aware, and practically deployable solution for real-time browser-based phishing detection.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
Phishing attacks continue to pose a significant threat to individuals and organizations, driven by the increasing sophistication of cybercriminal techniques and the rapid expansion of digital services. Traditional detection approaches, such as blacklist-based and rule-based systems, are often ineffective against newly generated or obfuscated phishing URLs. This study proposes a machine learning (ML)-based framework intended for integration within penetration testing environments. The approach leverages multiple supervised learning algorithms, including Random Forest (RF), Support Vector Machine (SVM), and XGBoost, trained and evaluated using the PhiUSIIL Phishing URL Dataset, a large-scale benchmark dataset containing phishing and legitimate URL samples. A comprehensive preprocessing pipeline and feature engineering strategy are employed to enhance model performance. Experimental results demonstrate exceptionally high detection accuracy, with RF and XGBoost achieving near-perfect classification performance across key evaluation metrics, including accuracy, precision, recall, F1-score, and ROC-AUC. The proposed system is further designed for real-time deployment, enabling integration into penetration testing workflows for proactive security assessment. Despite promising results, limitations related to dataset characteristics and real-world generalization are acknowledged. Overall, this research highlights the effectiveness and practical applicability of ML-based approaches in strengthening phishing detection and advancing modern cybersecurity defences.
Ashwag Alotaibi, Mounir Frikha· International Journal of Adv...· 0 citations