Detecting Phishing Websites Using a Hybrid Approach with DistilBERT, GNN and LightGBM

Abstract

Phishing attacks constitute one of the most pervasive cyber threats, exploiting human behaviour and system vulnerabilities to steal sensitive information such as login credentials and financial data. Existing detection systems frequently rely on singular modelling approaches and thus fall short in addressing the multidimensional and continuously evolving nature of these attacks. To overcome this challenge, the present work proposes a hybrid phishing detection framework that integrates three complementary techniques: DistilBERT (Distilled Bidirectional Encoder Representations from Transformers) for semantic analysis of URL text, Graph Neural Networks (GNN) for modelling structural relationships among URL components, and LightGBM (Light Gradient Boosting Machine) for efficient metadata-based feature classification. The outputs of the three models are fused through a weighted ensemble voting mechanism, enabling the system to leverage textual, structural, and statistical perspectives simultaneously. By replacing the computationally heavy BERT model used in prior work with the lighter DistilBERT variant, the proposed system achieves reduced computational complexity, faster inference, and lower memory consumption while preserving detection quality. Experimental evaluation on a large-scale Kaggle phishing URL dataset demonstrates that the hybrid ensemble yields a weighted phishing probability of 86.9%, with individual model contributions of 0.628 (DistilBERT), 1.000 (GNN), and 0.999 (LightGBM). The system is deployed via a Flask-based web interface that enables real-time URL classification. This multi-level approach underscores the importance of strengthening online security through robust, efficient, and scalable detection mechanisms.