GenAI-augmented ensemble learning framework for phishing URL detection using lexical, host-based and sequential features

Abstract

Phishing remains one of the most persistent cybersecurity threats, and URLs are often the earliest observable indicator of an attack. Although existing phishing URL detection methods achieve high accuracy using lexical, host-based, deep learning, and ensemble approaches, many rely on static evaluation settings that overlook temporal drift, domain leakage, cross-dataset bias, and adversarial URL evolution. This study proposes a leakage-aware phishing URL detection framework that combines lexical, host-based, and sequential URL representations with GenAI-augmented ensemble learning. A safety-filtered synthetic URL generation module produces realistic phishing patterns, including brand impersonation, typosquatting, excessive subdomains, homoglyph variants, suspicious paths, and malicious query structures, without generating live malicious domains. Classical machine learning models, deep sequence networks, transformer-lite models, and ensemble methods are evaluated using random, temporal, domain-disjoint, and cross-dataset splits. The impact of synthetic augmentation ratios (0%, 10%, 25%, and 50%) is assessed using F1-score, ROC-AUC, PR-AUC, false positive rate, and false negative rate. Experimental results show that the proposed stacking ensemble consistently achieves the best overall performance, while a moderate augmentation ratio of 25% provides the highest robustness under temporal and cross-dataset evaluation; higher augmentation levels reduce performance. The proposed framework offers a reproducible and leakage-aware benchmark for evaluating whether GenAI-based data augmentation and multi-signal ensemble learning improve resilience against evolving phishing URL attacks.