Aug 2026· Международный Журнал Теоретических и Прикладных Вопросов Цифровых Технологий· 0 citations
TL;DR
Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance.
Abstract
Phishing remains one of the most persistent cybersecurity threats, and URLs are often the earliest observable indicator of an attack. Although existing phishing URL detection methods achieve high accuracy using lexical, host-based, deep learning, and ensemble approaches, many rely on static evaluation settings that overlook temporal drift, domain leakage, cross-dataset bias, and adversarial URL evolution. This study proposes a leakage-aware phishing URL detection framework that combines lexical, host-based, and sequential URL representations with GenAI-augmented ensemble learning. A safety-filtered synthetic URL generation module produces realistic phishing patterns, including brand impersonation, typosquatting, excessive subdomains, homoglyph variants, suspicious paths, and malicious query structures, without generating live malicious domains. Classical machine learning models, deep sequence networks, transformer-lite models, and ensemble methods are evaluated using random, temporal, domain-disjoint, and cross-dataset splits. The impact of synthetic augmentation ratios (0%, 10%, 25%, and 50%) is assessed using F1-score, ROC-AUC, PR-AUC, false positive rate, and false negative rate. Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance. The proposed framework offers a reproducible and leakage-aware benchmark for evaluating whether GenAI-based data augmentation and multi-signal ensemble learning improve resilience against evolving phishing URL attacks.
Phishing remains a persistent cybersecurity threat, with over 1.3 million attacks reported in a single quarter of 2023. Despite strong benchmark performance, many machineand deep-learning models exhibit limited deployment reliability because they are evaluated using balanced, single-source datasets with randomized splits. This paper addresses this gap in two phases. First, it presents a controlled multi-source empirical study of four baseline phishing URL detection models–Logistic Regression, Support Vector Machine, Random Forest, and XGBoost–under four increasingly realistic evaluation conditions, including cross-source generalization, temporal drift, and class imbalance. Second, it introduces GAFPNet (Generalization-Aware and False-Positive Controlled Framework Network), a five-module stacked-ensemble framework. GAFPNet uses dataset-neutral lexical and structural URL feature extraction, SMOTE-based imbalance correction, Platt scaling for ensemble calibration, and a tunable false-positive control scheme. Experiments using a consolidated 13,000-sample set from PhishTank, OpenPhish, and Tranco Top-Sites show that baseline accuracy decreases by 13.16 to 20.22 percentage points in cross-source testing and by 2.41 to 8.14 percentage points in standard testing. GAFPNet achieves 99.12% accuracy, a 98.97% F1-score, an AUC-ROC of 0.9943, an MCC of 0.988, and a false positive rate of 0.74%, outperforming the evaluated baselines in all four scenarios. An ablation study confirms the contribution of each module. These results position GAFPNet as a generalization-aware and deployment-oriented phishing URL classifier for real-time filtering applications.
Mohammed Elias Basha S., M. N.· Journal of Trends in Compute...· 0 citations
Through the prevalence of internet technologies and the integration of digitalization into our daily routine, a significant portion of our personal, financial, and professional activities has shifted to cyberspace. However, this transformation has led to the rise of cyber threats, with phishing attacks being among the most dangerous and widespread, often tricking users into disclosing sensitive information by mimicking legitimate websites. In this study, we introduce a feature-driven framework for phishing Uniform Resource Locator (URL) detection, emphasizing the design and evaluation of enhanced feature representations. The proposed approach integrates structural, lexical, and distributional characteristics of URLs and evaluates their effectiveness across both classical machine learning and deep learning models. To assess their impact, several machine learning algorithms, including Naive Bayes, k-Nearest Neighbors, Random Forest, Gradient Boosting, and Multi-Layer Perceptron, are employed. To ensure a comprehensive evaluation, experiments are conducted on three datasets, including two recent large-scale datasets and a widely used benchmark dataset, enabling the assessment of model performance under different data distributions. Among all machine learning models, Random Forest achieves highly competitive performance with an accuracy of up to 99.82%, demonstrating the effectiveness of the proposed feature representation even with computationally efficient models. Building on this foundation, multiple deep learning architectures combining convolutional neural network (CNN)-based sequence modeling with handcrafted features are developed and further enhanced using ensemble strategies. The resulting ensemble model achieves the highest overall performance, with accuracy reaching 99.84% and consistently low false negative rates across all datasets. However, the observed improvements over strong classical baselines remain modest, highlighting that performance gains are primarily driven by feature design rather than model complexity. Besides, we conduct multiple statistical significance tests, including paired t-tests, Wilcoxon signed-rank tests, Analysis of Variance (ANOVA), and McNemar’s test, to assess the reliability of the observed performance differences. The results confirm that while the improvements of the proposed approach are statistically consistent, the performance gaps among top-performing models are relatively small in practical terms.
Deniz Kaya, Murat Osmanoğlu· PeerJ Computer Science· 0 citations
The Adversarial-Resilient Lightweight Random Forest (AR-LRF) model is proposed, combining controlled ensemble complexity with simulated adversarial perturbations applied during training to mitigate adversarial vulnerabilities.
A. Chaudhuri, M. B· Scientific Reports· 0 citations
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
Phishing remains one of the most persistent and rapidly evolving cybersecurity threats, exploiting deceptive websites, malicious URLs, fraudulent messages, compromised domains, and social-engineering strategies to obtain sensitive information such as usernames, passwords, financial credentials, personal records, and authentication tokens. Conventional phishing detection mechanisms based on blacklists, manually defined rules, static signatures, and heuristic filters provide useful protection against previously identified attacks but often exhibit limited effectiveness against zero-day phishing websites, short-lived malicious domains, obfuscated URLs, and dynamically changing attack patterns. Furthermore, machine learning-based phishing detection models frequently process large and redundant feature spaces containing irrelevant, correlated, or noisy attributes, which may increase computational overhead and reduce generalization capability. This research proposes an intelligent phishing detection framework that integrates machine learning, deep learning-enabled feature selection, multi-source phishing feature extraction, hybrid classification, and real-time risk assessment. The proposed framework extracts URL lexical characteristics, domain and host-based properties, webpage content indicators, Hypertext Markup Language and JavaScript features, security certificate attributes, redirection behavior, and contextual metadata. A deep learningenabled feature selection module employs representation learning and importance estimation to identify the most discriminative phishing indicators while eliminating redundant and low-contribution attributes. The selected feature subset is subsequently evaluated using machine learning classifiers such as Random Forest, Support Vector Machine, XGBoost, and Logistic Regression, together with deep learning architectures including Multilayer Perceptron, Convolutional Neural Network, and Long Short-Term Memory networks. A hybrid decision engine combines model confidence, anomaly indicators, and contextual risk information to classify web resources as legitimate, suspicious, or phishing. The proposed architecture consists of five interconnected layers: Data Acquisition, Preprocessing and Feature Engineering, Deep Learning-Enabled Feature Selection and Intelligent Detection, Risk Assessment and Response, and Application/User layers. Illustrative conceptual evaluation demonstrates that the proposed hybrid framework can achieve higher detection accuracy, precision, recall, F1-score, and lower response latency than blacklist-based, conventional machine learning, and standalone deep learning approaches. The framework provides a scalable foundation for intelligent phishing protection across browsers, email gateways, enterprise networks, financial platforms, educational environments, and cloud-based security services.
P. Paul, Bharath Bhushan, Bandameedi Sai Charan et al.· American Journal of AI Cyber...· 0 citations
Phishing attacks remain a major cybersecurity threat, causing financial loss, data breaches, and reputational damage to individuals and organizations. Conventional detection methods, such as rule-based filters and blacklist-based systems, often fail to identify newly generated or highly obfuscated phishing URLs. Recent advances in artificial intelligence, particularly large language models (LLMs), provide new opportunities to detect complex structural and contextual patterns in malicious web addresses. This study evaluates the effectiveness of transformer-based LLMs for phishing URL detection by comparing LLaMA-3 and GEMMA-7B with traditional machine learning models, including Support Vector Machines, Random Forest, and XGBoost. The models were fine-tuned and tested on a publicly available dataset containing 247,950 labeled URLs, each described by 42 structural and lexical features. To support transformer-based classification, structured URL attributes were converted into textual representations, enabling the models to exploit contextual embeddings. Experimental results showed that LLMs outperformed conventional machine learning baselines. GEMMA-7B achieved the best performance, with an accuracy of approximately 94.8%, followed by LLaMA-3 at 94%. These findings suggest that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques. Overall, the proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations