An Adaptive Phishing Detection System Based on Heuristic Algorithms, NLP Analysis, and Canopy-Optimized Feature Selection

Abstract

—Phishing attacks are still one of the major threats in the cybersecurity sphere, as these attacks exploit trust and technical defense weaknesses to obtain sensitive information. With increasingly advanced and adaptable phishing methods, attackers have rendered traditional rule-based and single-model detection systems less effective, particularly against zero-day and rapidly evolving attacks. This paper presents an adaptive phishing detection system based on a combination of heuristic intelligence, NLP-based semantic analysis, Canopy-optimized feature selection, and a hybrid machine learning framework. The proposed method extracts lexical, content-based, and technical features from phishing emails and URLs to capture comprehensive attack characteristics. Canopy clustering is employed to remove feature redundancy and reduce dimensionality, thereby improving computational efficiency and generalization. A hybrid learning architecture combines supervised classifiers and unsupervised anomaly detection models, whose outputs are integrated through a stacking ensemble to enhance reliability and adaptability. An extensive experimental evaluation on benchmark phishing datasets comprising approximately 11,000 samples demonstrates that the proposed framework achieves 98.8% accuracy, 98.9% precision, 98.6% recall, and a ROC-AUC score of 0.992, while maintaining a low false-positive rate of 1.4%. Furthermore, the framework achieves an average inference time of 3.6 ms per sample, making it highly suitable for real-time applications such as email gateways and enterprise web security systems. The findings confirm that the proposed adaptive framework is a viable, efficient, and highly effective solution for next-generation phishing detection and prevention