Jul 2026· Terra security· Vol 2, pp. 5-11· 0 citations· 12 references
TL;DR
The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module and to review current approaches to phishing mitigation.
Abstract
Topicality. Phishing attacks remain one of the most common initial access vectors because they combine URL obfuscation, social engineering and rapid changes in domain infrastructure. From the perspective of computer science, the problem can be formulated as the classification of weakly structured textual objects; from the perspective of cybersecurity, it is a risk-reduction task aimed at preventing credential compromise, financial data leakage and malware delivery. The subject of the study is the automated detection of phishing URLs using lexical and structural features without opening or rendering the target webpage. The purpose of the article is to design and experimentally evaluate a lightweight URL pre-filtering model that can be integrated into an email gateway, browser extension or SOC monitoring module. The following results were obtained. The paper reviews current approaches to phishing mitigation and critically analyzes regulatory, organizational and machine-learning solutions. It is shown that many existing works do not sufficiently balance detection speed, interpretability and resistance to rapidly changing domains. The practical part includes the implementation of a feature extraction module and a simulation dataset of 1600 URLs. Logistic Regression, Decision Tree, Random Forest and Gradient Boosting were tested. The best F1 result was obtained by Random Forest: accuracy - 0.900, precision - 0.910, recall - 0.888, F1 - 0.899. Conclusion. Lexical URL features make it possible to build a fast and interpretable phishing pre-detection mechanism; however, such a model should be used as part of a layered cyber defense system rather than as a single decision-making control.
Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
A hybrid real-time phishing detection system in the form of a Google Chrome extension that uses a trusted domain whitelist for false positives on legitimate banking and government websites and a pattern-based blocklist for piracy and malware domains.
Kavila Moni Sushma Deep, Pavan KumarSeepana, Natasha Rayi et al.· International journal of re...· 0 citations
The increasing prevalence of phishing attacks targeting users of digital banking, e-commerce, and social media platforms highlights the need for phishing detection tools that are transparent and easy to understand. This study aims to develop a Deterministic Finite Automata (DFA)-based phishing URL analysis system that supports cybersecurity awareness through interpretable rule-based detection. The proposed system is implemented as an interactive web application that evaluates URLs using nine phishing indicators, including dangerous keywords, service impersonation, URL shorteners, suspicious top-level domains, IP-based domains, excessive subdomains, URL encoding anomalies, at-sign usage, and unencrypted HTTP connections. These indicators trigger transitions across six DFA states and generate a cumulative risk score used to classify URLs into four risk levels: Safe, Suspicious, Highly Suspicious, and Phishing. The research method consists of DFA modeling, rule-based URL analysis, web-based implementation, and functional testing using ten URL samples with varying characteristics. To enhance educational value, the system visualizes DFA state transitions in real time, enabling users to observe how phishing indicators influence the classification process. The testing results indicate that the proposed rules and DFA transitions operate consistently on the evaluated samples and classify URLs according to predefined criteria. The findings suggest that DFA can provide a transparent and educational approach for illustrating phishing detection mechanisms and improving user understanding of suspicious URL characteristics. The proposed system is intended as a prototype for cybersecurity awareness and learning environments, while further validation using larger and more diverse datasets is required.
M. Pakpahan, Zulfahmi Indra, Sirlia Sahid et al.· bit-Tech· 0 citations
Phishing remains one of the most persistent cyber threats, and almost every campaign ultimately depends on a deceptive Uniform Resource Locator (URL). Existing defences face a structural trade-off: blacklists are reactive and cannot cover newly registered domains during the zero-hour window, while machine-learning detectors, although accurate, are opaque, feature-hungry, and often depend on page content or full DNS telemetry that many organisations cannot collect. This study proposes and evaluates a lightweight, fully interpretable two-level rule-based framework that fuses lexical URL features with domain registration evidence retrieved through the Registration Data Access Protocol (RDAP). Level 1 scores each URL using five transparent lexical rules derived from training-set distributions of domain length, number of dots, number of hyphens, number of digits, and URL entropy. Level 2 applies three RDAP rules covering domain age, days to expiry, and a missing-registration-data flag, targeting the young, short-lived, and poorly documented domains that characterise phishing infrastructure. The two levels are combined through logical OR and AND decision fusion and evaluated on a balanced, held-out set of 400 URLs drawn from a curated corpus of 800. Level 1 achieved 95.50% accuracy (precision 0.9789, recall 0.9300); Level 2 achieved perfect recall (1.0000) at 0.8969 precision; OR fusion preserved perfect recall; and AND fusion delivered the best overall result at 96.50% accuracy with perfect precision, zero false positives, and a Matthews Correlation Coefficient of 0.9323. A confusion-matrix decomposition further shows that the false-positive sets of the two levels are completely disjoint, confirming that lexical and registration evidence fail independently. Exploiting this, a cascaded implementation of AND fusion reproduces identical decisions while issuing RDAP queries for only 47.5% of URLs, a 52.5% reduction in external lookups.
Wan Afifie Aliff Bin Wan Abdullah, Zulkiflee Muslim, Haniza Nahar et al.· International journal of res...· 0 citations
Phishing websites still pose a threat to internet users by using well-known domain names and confusing URL formats to trick them into divulging confidential information. This research proposes a phishing website detection system and a cyberattack prevention system based on a deep learning model designed to detect whether raw URLs are phishing or legitimate, leveraging a transformer model. The system analyzes URL sequences to identify patterns, domain name irregularities, suspicious tokens, unusual lengths, special character usage, and deceptive subdomains. A web interface enables the user to input URLs, and the Flask backend performs pre-processing, tokenization, model inference, and suspicious feature identification. The proposed method fuses the transformer-based semantic representation of the URL and lexical feature analysis to reliably detect phishing and provide explainable warning features. The system creates a prediction label, confidence score, and suspicious features in real time to support the decision-making process. This work provides a practical and scalable solution for phishing identification, user protection, and web-based cyberattack prevention.
Dr. N. Ramadevi, Dr. K. Uday, Kumar et al.· 2026 International Conferenc...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
