Jul 2026· Journal of Intelligent Decision Making and Information Science· Vol 3, pp. 1047-1053· 0 citations· 11 references
TL;DR
A framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound is presented, which shows that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.
Abstract
Malicious web sites hosted via manipulated URL strings present users with phishing, malware and defacement. This research presents a framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound. Model is trained on a Kaggle dataset of 651191 URLs (4,28,103 benign, 96,457 defacement, 94,111 phishing and 32,520 malware). After tokenization, feature extraction and then a logistic-like function which gives a probability score, calibration applies a constraint on the amount of error. In comparative tests, the proposed model results in an accuracy, precision, recall, F1-score and AUC of 98.64%, 98.12%, 97.89%, 98.00% and 0.99, which is about 1-3 % better than that of logistic regression, random forest, XGBoost and CNN classifiers. These results show that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.
The rapid growth of internet services has significantly increased the number of malicious webpages that target users through phishing, malware distribution, fake login pages, and other cyberattacks. Conventional detection techniques such as blacklist-based and signature-based methods are effective only for identifying known malicious websites and often fail to detect newly created or obfuscated URLs. To overcome these limitations, this paper presents a Real-Time Malicious Webpage Detection System using a Hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) model. The proposed system automatically learns structural and sequential characteristics from URL strings without relying on manually engineered features. URL preprocessing techniques including cleaning, tokenization, encoding, and normalization are performed before training the model. The CNN component extracts lexical and structural patterns from URLs, while the LSTM component captures sequential dependencies for improved classification performance. A Flask-based web application has been developed to provide real-time URL prediction through a user-friendly interface. In addition, a Google Chrome Extension has been implemented to allow users to verify webpage safety directly while browsing. Experimental evaluation demonstrates that the Hybrid CNN–LSTM model effectively classifies webpages as Safe, Suspicious, or Malicious, providing improved detection accuracy and faster prediction compared with conventional machine learning approaches. The proposed system offers a lightweight, scalable, and practical solution for enhancing web security against evolving cyber threats
Sinchana and Dr. Kruthi R· International Journal of Adv...· 0 citations
Phishing attacks represent a continuously growing cyber threat that exploits social engineering to deceive users, causing significant financial and informational harm worldwide. As phishing URLs are carefully crafted to mimic legitimate websites, they often bypass traditional rule-based or blacklist methods, which can only detect a small fraction of new threats. This study aims to develop an efficient and accurate phishing URL detection system using purely lexical analysis. The methodology employs a dataset of URLs from Kaggle and GitHub, which undergoes validation, normalization, and deduplication. Character-level TF-IDF with an n-gram range of (3,6) was specifically chosen for its superior ability to capture structural anomalies and obfuscation patterns without requiring semantic understanding or access to web page content. Furthermore, Complement Naive Bayes (CNB) was selected for its robust performance on imbalanced datasets, effectively addressing the skewed class distributions typical of web security data. To ensure reliable risk assessment, the model was calibrated using isotonic regression and evaluated through 5-fold stratified cross-validation. The results demonstrate an accuracy of 94.25%, an F1-Score of 0.9263, and an ROC-AUC of 0.9862. These findings are significant as they outperform heavier deep learning architectures while maintaining a much lower computational footprint. This efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
Phishing attacks remain a major cybersecurity threat, causing financial loss, data breaches, and reputational damage to individuals and organizations. Conventional detection methods, such as rule-based filters and blacklist-based systems, often fail to identify newly generated or highly obfuscated phishing URLs. Recent advances in artificial intelligence, particularly large language models (LLMs), provide new opportunities to detect complex structural and contextual patterns in malicious web addresses. This study evaluates the effectiveness of transformer-based LLMs for phishing URL detection by comparing LLaMA-3 and GEMMA-7B with traditional machine learning models, including Support Vector Machines, Random Forest, and XGBoost. The models were fine-tuned and tested on a publicly available dataset containing 247,950 labeled URLs, each described by 42 structural and lexical features. To support transformer-based classification, structured URL attributes were converted into textual representations, enabling the models to exploit contextual embeddings. Experimental results showed that LLMs outperformed conventional machine learning baselines. GEMMA-7B achieved the best performance, with an accuracy of approximately 94.8%, followed by LLaMA-3 at 94%. These findings suggest that transformer-based models can effectively identify deceptive domain structures, abnormal URL patterns, and obfuscation techniques. Overall, the proposed LLM-based framework offers a promising approach for improving phishing detection and strengthening modern cybersecurity defenses.
L. Eliyan, M. Alshraideh, Bayan Alfayoumi· Journal of integrated scienc...· 0 citations
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
K. Shrinivas, B. Karthick, M. MuthukaruppanKN et al.· International Conference on...· 0 citations
Despite advances in machine learning-based phishing detection, existing Artificial Neural Network (ANN) models operate as black boxes with no interpretable explanation of feature interactions—a critical limitation for security analysts. Furthermore, most approaches deploy large feature sets without investigating whether a minimal subset achieves equivalent performance. This study develops a phishing detection system combining ANN with Logic Gate-Based Feature Interaction Modeling (LGFIM), a novel framework that characterizes ANN decisions through AND, OR, and XOR Boolean operations, addressing both accuracy and interpretability gaps. Using the PhiUSIIL dataset (235,795 instances), Pearson correlation identified URLSimilarityIndex (r=0.8604) and HasSocialNet (r=0.7843) as the two most discriminative features. An ANN (2-64-32-16-1, ReLU, Adam) trained on an 80/20 split achieved 99.63% accuracy, 100% recall, 99.68% F1-score, and 99.91% AUC-ROC with zero false negatives. The LGFIM analysis reveals the classification boundary follows a predominantly AND-type Boolean structure: the AND gate achieves 99.67% accuracy against true labels, while ANN predictions align with AND for 42.48% of samples and XOR for 57.52%, together accounting for 100% of all predictions. This is the first study to comprehensively characterize ANN phishing decisions through logic gate interaction patterns, providing a zero-cost interpretability layer for cybersecurity operations.
M. H. Rahman, Z. Abidin, M. A. Hariyadi· G-Tech· 0 citations
Topicality. Phishing attacks remain one of the most common initial access vectors because they combine URL obfuscation, social engineering and rapid changes in domain infrastructure. From the perspective of computer science, the problem can be formulated as the classification of weakly structured textual objects; from the perspective of cybersecurity, it is a risk-reduction task aimed at preventing credential compromise, financial data leakage and malware delivery. The subject of the study is the automated detection of phishing URLs using lexical and structural features without opening or rendering the target webpage. The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module. The following results were obtained. The paper reviews current approaches to phishing mitigation and critically analyzes regulatory, organizational and machine-learning solutions. It is shown that many existing works do not sufficiently balance detection speed, interpretability and resistance to rapidly changing domains. The practical part includes the implementation of a feature extraction module and a simulation dataset of 1600 URLs. Logistic Regression, Decision Tree, Random Forest and Gradient Boosting were tested. The best F1 result was obtained by Random Forest: accuracy - 0.900, precision - 0.910, recall - 0.888, F1 - 0.899. Conclusion. Lexical URL features make it possible to build a fast and interpretable phishing pre-detection mechanism; however, such a model should be used as part of a layered cyber defense system rather than as a single decision-making control.
D. Abrosimov, D. Balagura, A.M. Yevheniev et al.· Terra security· 0 citations