Aug 2026· Journal of High Speed Networks· 0 citations· 18 references
TL;DR
A distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), is presented to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network.
Abstract
Phishing is currently one of the most common and most monetarily devastating types of cyberattacks, and hackers are actively employing it to acquire sensitive usernames and financial information with the use of nefarious uniform resource locators (URLs). The traditional intrusion detection system has failed to perform well against these new threats because they are based on traditional rules and sets of constraints which cannot be modified to suit the new trends of intrusion. The article presents a distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network. The suggested modified XGBoost algorithm is designed to solve the problem of scalability, robustness, and privacy through adapting feature weights, managing features via regularization, and aggregating gradients with the help of encryption. Even though recent advancements in DL architecture, such as convolutional neural networks (CNNs), bidirectional long short-term memory networks, CNN and long short-term memory networks, and deep reinforcement learning have demonstrated competitive performance, they are severely limited, such as high computation complexity and inference latency of between 85 and 145 ms, and hardware requirements based on the use of GPU technology, which is not feasible to implement in a resource-constrained network. The proposed modified XGBoost is characterized by a competitive performance of 96.9% and an F1-score of 0.973, although its inference latency is significantly lower, 18 ms, in the range of 8 times lower than that of DL-based methods, and inherently has the feature-importance analysis that can be interpreted. The importance of such performance increments is checked with the help of one-way analysis of variance and Tukey Honestly Significant Difference tests, the
p
-value of which is established at 0.0003.
Phishing attacks remain a prevalent and rapidly evolving cybersecurity threat, leveraging deceptive Uniform Resource
Locators (URLs) and fraudulent websites to steal sensitive user data, financial credentials, and personal information.
Traditional detection mechanisms, such as blacklist-based and heuristic approaches, struggle to mitigate zero-day phishing
threats due to their reliance on static, manually updated databases. While machine learning and ensemble techniques have
enhanced detection accuracy, existing literature predominantly focuses on offline evaluations using static datasets, offering
limited support for real-time deployment, adaptability to evolving attack patterns, and continuous monitoring. To bridge this gap,
this paper introduces a hybrid machine learning framework for real-time phishing website detection. The proposed architecture
integrates an Artificial Neural Network (ANN) and a Bagging K-Nearest Neighbors (Bagging-KNN) classifier through a
Logistic Regression-based stacking ensemble, combining their complementary learning capabilities to maximize classification
performance while minimizing prediction error. Developed using the PhiUSIIL Phishing URL Dataset, the framework
implements a leakage-free machine learning pipeline encompassing automated data cleaning, a train/test split performed prior
to any preprocessing, feature engineering, StandardScaler-based normalization, SMOTE-based class balancing, and
SelectKBest feature selection, all splitting-dependent steps fitted exclusively on the training partition. The framework’s efficacy
is validated using Accuracy, Precision, Recall, F1-score, ROC-AUC, and Confusion Matrix analysis. Beyond offline validation,
the model is operationalized through two real-time deployment channels: a Gradio-based web interface for on-demand URL
analysis, and a Chrome browser extension that automatically screens the active browser tab using a combination of rule-based
checks, live queries to the deployed model, and a local heuristic fallback. By unifying ensemble learning, a leakage-conscious
preprocessing pipeline, and dual real-time deployment tools, the proposed framework provides an effective, transparently
evaluated solution for real-world phishing detection, while explicitly discussing the boundaries within which its strongest offline
results should be interpreted.
E. Kavya, A. S. Chakravarthy· International Journal for Re...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
I. Shalini, G. Sujini· International Journal for Re...· 0 citations
Phishing persists as a serious cybersecurity concern in which consumers are tricked into divulging private information by using phony websites. It is necessary to accurately and competently identify such hazardous links in order to secure the internet environment. Because Deep Learning (DL) approaches can automatically learn complex patterns, and proved to be effective tools for identifying such attacks. Five DL models were tested in this study using a dataset gathered from Kaggle: Recurrent Neural Network (SimpleRNN), Long Short-Term Memory (LSTM), Multi-Layer Perception (MLP), Conventional Neural Network (CNN), and Gated Recurrent Unit (GRU). The most useful URL attributes were selected using Random Forest-based feature significance techniques and Chi-Square feature selection to maximize the model’s efficiency. To achieve the global performance study, the models were evaluated using a variety of assessment metrics, including accuracy, precision, recall, and F1 score, with the help of loss graphs and confusion matrices. LSTM successfully proved its effectiveness in dealing with sequential patterns in phishing URLs with a highly accurate result of 98.80%. The DL models given in the paper, especially the recurrent neural networks, performed significantly better compared to the highest standard of accuracy and reliability established in the previous papers. The experimental results confirm that a reliable method for identifying phishing URLs can be formed using recurrent DL and effective feature selection.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
The security landscape is increasingly at risk from phishing attackers; individuals engaging in this type of attack successfully persuade users to divulge sensitive data such as identity information or financial resources. Existing blacklist-based solutions and other approaches have proved ineffective because the adversaries are able to adjust to current bottleneck detectors and because machine learning models are based on hand-crafted behavior patterns. Deep learning brings the inductive bias of generalization to the fore while explicitly constraining the architectures to only hold local representations and to limit their capacity to express long-range relationships in data. We present a model based on CapsNet for phishing website detection in this paper. In the framework of CapsNets, dynamic routing is used to fortify the relationship between spatial and hierarchical features in a model that is built upon these orders between features. This approach is mostly to enable the model to gain complex relationships in a URL string and HTML structure. As a result of this property, the architecture is resistant to various types of adversarial perturbations like character replacement, subdomain mimicry, and misphrasing in phishing URLs. The model is evaluated the model using datasets from PhishTank, OpenPhish, and a benign domain list sourced from the Tranco list. Experimental results show that the proposed method is superior to the state-of-the-art deep learning methods and traditional classifiers in terms of accuracy, precision, recall, and ROC-AUC and reduces the false positive rate. The results confirm that CapsNet is a stable and flexible method for phishing classification that can be used for designing and implementing secure reliable web protection systems.
Sujatha Krishna, K. M, Rajesh Natarajan et al.· 2026 4th International Confe...· 0 citations
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
