PHISHNETGUARD: A Real-Time Phishing

Website Detection Model

Vansh Vikram Singh Mukesh Raj
Department of Computer Science and Engineering Department of Computer Science and Engineering
JSS Academy of Technical Education JSS Academy of Technical Education
Noida,India Noida,India
vikramvansh@[Link] mukeshraj@[Link]

Trishala Singh Srishti Sharan

Department of Computer Science and Engineering Department of Computer Science and Engineering
JSS Academy of Technical Education JSS Academy of Technical Education
Noida,India Noida,India
trishalas91@[Link] srishtisharan955@[Link]

Ajay Kumar Singh

Department of Computer Science and Engineering
JSS Academy of Technical Education
Noida,India
ajay.singh41122@[Link]

Abstract— Phishing is one of the stealthy and ominous resulting in irreversible financial and reputational loss.
tactics used by cybercriminals to deceive individuals and Despite thorough studies and countermeasures, the attackers
gain unauthorized access to their personal information continue to innovate with more advanced techniques,
such as login information, financial and personal rendering traditional detection tools such as rule-based
information by pretending trusted organizations such as heuristics and blacklists insufficient for new or evasive
banks or social media. With security increasing, the attacks. This limitation requires sophisticated, automated
modus operandi of phishing is being studied at a greater means of real-time detection of advanced attacks. To address
pace than conventional detection technologies such as these issues, we propose PhishNetGuard as a solution in this
blacklisting and heuristic-based systems based on static paper, an AI system which uses ML to identify phishing web
rules or known attack signatures. Such technologies fail sites with high accuracy. PhishNetGuard differs from
to detect new or rapidly changing phishing attacks traditional systems by analyzing more informative features
against individuals and businesses, with threats of like URL syntax, domain attributes, web-page content, and
information hijacking and financial deception. The behavioral indicators to identify malicious web sites
traditional systems are limited to learning predefined dynamically. Utilizing deep learning methodologies such as
phishing patterns, ML models can be trained to analyze Long Short-Term Memory (LSTM) networks, the system
complex patterns in website attributes – URL patterns, analyzes sequential and context-dependent URL and web-
traffic abnormalities, and content – to detect malicious content anomalies with fewer false alarms and sensitivity to
intent in real-time. new attack patterns.
This paper introduces PhishNetGuard, an ML-powered
high-accuracy and scalable detector of phishing websites.
By using ensemble approaches and deep neural networks This essay follows the following pattern:
and feature engineering, PhishNetGuard outgrows rule- ● Section II provides a literature survey, highlighting recent
based approaches and provides active defense for zero- advancements in phishing detection and identifying gaps
day phishing attacks. Experimental results show it to be in existing models.
efficient in phishing-versus-legitimate website ● Section III describes the methodology, with the
discrimination across varied datasets and risk architecture of the proposed PhishNetGuard system and
minimization in today's highly connected digital world. the machine learning techniques employed.
Real-time execution and adaptability make it an effective ● Section IV discusses the results, analyzing the
tool to guard user trust and cybersecurity infrastructure. performance metrics across different datasets and model
configurations.
Keywords— Phishing, LSTM, URL Vectorization ● Section V explores future directions for improvement,
such as incorporating hybrid models and federated
I. Introduction learning.
Phishing is among the most widespread and most destructive ● Section VI concludes the paper.
types of cyberattacks, which exploit the trust of human beings ● Section VII includes relevant references.
to utilize sensitive financial and personal information, usually
PhishNetGuard brings the gap between theoretical research could improve its effectiveness and usability in real-world
and practical deployment in real-world cybersecurity close applications.
by. D. “Real-time phishing detection using deep learning
II. LITERATURE SURVEY methods by extensions”, 2024 [4]:
Dam Minh Linh et al., 2024 in [4] introduced a variety of
A. “Improved Detection of Phishing Websites using machine learning models as well as deep learning models,
Machine Learning “, 2024 [1]: including Logistic regression, Decision tree, Random forest,
Sumo Sami M Aldaham et al., 2024 in [1] used multiple Support vector machine, CNN, and CNN-LSTM to detect
machines to detect phishing websites. The paper highlights fake/phished URL dataset using evaluation metrics such as
that increased threats are becoming more advanced over time accuracy, precision, and detection rate (i.e. recall), in order to
and especially in targeted forms like spear phishing and propose a browser extension for real-time phishing detection
whaling and it becomes hard to figure them using the that can be installed on the web browser with the Chromium
traditional rule-based systems. There are four machine kernel (e.g., Google Chrome and Microsoft edge). The
learning models: Decision Tree (DT), Random Forest (RF), extension, developed using JavaScript, receives the URL
Support Vector Machine (SVM), and Artificial Neural from the user's browser, transmits it to a server where it is
Network (ANN) which are evaluated using a dataset classified as phishing or legitimate using a pre-trained CNN,
containing 10,000 samples obtained from [Link]. As and then alerts the user with a pop-up if a malicious URL is
a result, the performance of Decision Tree and Random detected. The model utilized 651,191 URL samples with a set
Forest Models was achieving the accuracy of 96.2% and of 270 characters and an embedding size of 128 to capture
97.4% respectively with low error rate, while SVM and ANN patterns in URL effectively. Hence, CNN algorithm achieved
model showed comparatively lower accuracy, 90.1% and the highest accuracy of 98.4% at an 8:2 train-test split among
88.7% respectively, and needs to be improved specifically in the other models including CNN-LSTM, which, while
reducing false negatives. effective, did not surpass the standalone CNN in accuracy.
This extension identifies malicious sites and alert users, and
B. “A Machine Learning Approach for Phishing Attack
therefore reduces the risk of users falling for phishing attacks.
Detection”, 2023 [2]:
Using two dataset samples, [Link] and UCI, E. “Phishing URL Detection Using CNN-LSTM and
Tarun Choudhary et al., 2023 in [2] discuss the solid basis for Random Forest Classifier”, 2022 [5]:
feature-based phishing detection by employing five In order to enhance phishing URL identification using
algorithms: Random Forest, Extreme Gradient Boosting, techniques like machine learning and deep learning
Logistic Regression, Decision Tree, and Support Vector techniques, Sopnil Nepal et al., 2022 in [5] used a CNN-
Machine and used two dataset samples, [Link] and LSTM model with a Random Forest classifier. For the
UCI, where 25 and 30 features were extracted respectively, Random Forest approach, they used 100 estimators to train
including URL structure, anchor tags, port usage, abnormal the model after extracting 14 features from every URL.
URLs, and use of non-standard ports from UCI dataset. The However, CNN-LSTM segmented URLs at character level,
performance of models was evaluated using K-fold cross- encoded them into embeddings, passed through a 1D
validation, feature selection techniques, and hyperparameter convolution and pooling layer to extract features, then fed
tuning. In addition, this model focuses on traditional machine them into an LSTM layer to learn sequential patterns and
learning models and doesn't use deep learning methods such finally classified as a sigmoid activation function. As
as CNNs or LSTMs, which have shown higher efficiency in Random forest is dependent on manually derived features,
sequence-based data like URLs. Also, the Random Forest this model achieved an accuracy of 70.25%, and CNN-LSTM
model achieved the maximum accuracy of 98.80% on achieved an accuracy of 94.3%, highlighting the ability and
PhishTank and 97.87% on UCI, with precision, recall, and accuracy of deep learning in phishing URL detection.
F1-score values reaching up to 99%, highlighting the ability
and accuracy of ensemble models in phishing detection. F. “Detecting phishing attacks using a combined model of
LSTM and CNN”, 2020 [6]:
C. "Detecting phishing websites using machine learning Another LSTM-CNN model was introduced by Subhash
technique”,2021 [3]: Ariyadasa et al., 2020 [6]. The authors put forward a hybrid
Ashit Kumar Dutta, 2021 in [3] discusses the use of a deep learning model that groups LSTM and CNN to detect
Recurrent Neural Network (RNN) along with an LSTM phishing websites using both URL strings and manually
network for the identification of phishing web pages. The extracted HTML features which helps to find out sequential
model makes use of 14 lexical features extracted from URLs format in URL structures and extract local patterns, hence
and is trained using a dataset that involves 5800 legitimate achieves high accuracy of 98.34% and precision on a large
URLs and 7900 phishing URLs. With the use of LSTM, labeled URL dataset. What's different from other LSTM-
RNNs can retain input sequences over longer durations, CNN models is that this approach uses lightweight, character-
which improves their ability to detect malicious websites level URL embeddings— along with manually extracted
effectively. The author discusses the drawbacks of traditional HTML features but without relying on external metadata like
procedures like blacklists and rule-based heuristics, DNS or WHOIS data, which reduces the need for feature
emphasizing the increasing demand for robust systems that engineering and improves scalability. They use LSTM layers
can adapt by learning from past phishing activities. The after 1D convolution layers to learn sequence patterns and
LURL model achieved an accuracy of over 96% by detecting identify key subsequences, unlike other models where CNN
sequential patterns within URLs and can manage large comes before LSTM. This model has limitations as only
amounts of data efficiently. That said, it currently doesn't relying on URL features won’t work against obfuscated or
analyze webpage content or screenshot-based analysis, nor is lookalike phishing URLs. Performance depends on the
it linked with real-time browser protection, both of which dataset and may not work for new phishing attacks. Also
hybrid architecture increases computational cost and training Year Literature
time which is a problem for real time deployment. and
Cite Main Idea Presented Relevance Research Gaps
G. “Multimodel Phishing URL Detection Using LSTM, No.
Bidirectional LSTM, and GRU Models”, 2022 [7]: CNN-LSTM
Closely mirrors underperform
Sanjiban Sekhar Roy et al., 2022 in [7], introduced a deep Introduced CNN and
PHISHNETGU ed CNN;
CNN-LSTM models
learning solution to phishing URL detection with character- ARD’s real- model limited
2024 for real-time browser
level representation from a labeled phishing and normal URL time and to URL
[4] extension. CNN
browser- string—no
data [Link] of the models get character-level URL processing achieved 98.4%
integrated HTML or
with embeddings so that they can learn sequential patterns accuracy.
goals. domain
without feature [Link] highest accuracy achieved features.
was 99% by Bidirectional LSTM since it can learn both Closely
RF depends
forward and backward contextual information and thus is Combined CNN- on manual
resembles
more efficient in understanding of URL sequences typically LSTM with Random features;
PHISHNETGU
2022 Forest for phishing CNN-LSTM
representing [Link] to the study, the application [5] URL detection. CNN-
ARD's hybrid
accuracy is
of character-level sequences with deep learning models such design and
LSTM achieved lower than
as BiLSTM improves detection in phishing attacks through dual-path
94.3% accuracy. other DL
architecture.
identification of the URL itself without depending upon other benchmarks.
metadata such as WHOIS or domain features. For future LSTM-CNN hybrid Supports hybrid High
work, the authors would like to explore other deep learning with character-level architecture; computational
2020 URL input and unique for cost; may not
algorithms to detect phishing websites using large [6] HTML-based using HTML scale well in
imbalanced datasets. features. Achieved tags with real-time
98.34% accuracy. LSTM. settings.
H. “Enhancing Phishing Detection: A Novel Hybrid Deep Used LSTM, No use of
Learning Framework for Cybercrime Forensics”, 2024 BiLSTM, and GRU
Strong
domain/SSL/
endorsement of
[8]: 2022
models with
sequential deep
content-based
character-level features;
Faisal S. Alsubaei and other authors utilized a novel [7]
embeddings. BiLSTM
models;
purely URL-
hybrid deep learning skeleton called RNT-J for real-time character-level
achieved 99% based
relevance.
phishing detection. This framework is a combination of accuracy. detection.
ResNeXt, used to extract useful patterns from heavy data, Complex
with a GRU (Gated Recurrent Unit) that learns evolving model; higher
Proposed hybrid deep Highly flexible
computational
phishing behavior. To address the problem of imbalanced learning framework hybrid
demand; no
phishing and normal data, SMOTE balances the data set, 2024 (ResNeXt + GRU + architecture;
integration
while an ensemble approach (EARN), which includes [8] ensemble + SMOTE). supports
with browser-
Achieved 98% adaptability to
autoencoders and ResNeXt, digs deeper to feature extract to accuracy. new attacks.
side detection
enhance detection. During the initial stage, the Jaya algorithm or live
updates.
helped improve the model so that the model could efficiently
detect new phishing threats. The model reached an accuracy
of 98%. While the paper acknowledges the fact that methods III. PROPOSED METHODOLOGY
of phishing are evolving continuously, it addresses the
model's flexibility along with generalizability in such This section illustrated the layout and development of the
scenarios. PHISHNETGUARD system in terms of data gathering,
preprocessing it, feature extraction, model building, training.
TABLE I. LITERATURE REVIEW SUMMARY Fig 1. Block diagram of the PHISHNETGUARD system flow.

Year Literature
and
Cite Main Idea Presented Relevance Research Gaps
No.
Establishes
Compared classical No deep
baseline ML
ML models (DT, RF, learning; lacks
performance;
SVM, ANN) on URL sequential
2024 useful for
datasets for phishing pattern
[1] comparison
detection. RF modeling and
with deep
achieved the highest real-time
learning
accuracy of 97.4%. integration.
models.
Strong on No deep
Used ensemble and A. Data Collection
handcrafted learning;
feature-based ML
2023 methods on
feature doesn't Phishing detection models need high-quality, labeled data. A
extraction; capture well-distributed dataset of phishing and legitimate URLs was
[2] PhishTank and UCI
highlights sequential
datasets. RF achieved obtained from public repositories, e.g., the Phishing Websites
importance of URL
98.8% accuracy. Data Set, PhishTank, and so on. The model has the ability to
URL structure. behavior.
Applied RNN + Supports use of
Lacks content recognize unbiased patterns when the classes are evenly
and visual distributed. Additionally, the collected data included
LSTM on lexical URL LSTM for
analysis; not
2021 features. Emphasized sequence
designed for metadata like submission timestamps and domain age,
[3] learning from modeling in providing a comprehensive temporal overview of phishing
real-time or
historical phishing phishing
patterns. detection.
browser-side activity, including both newly registered and existing
detection. phishing domains.
B. Data Preprocessing The model consists of some blocks of convolutional, LSTM,
To enable the data to be consistent we performed the fully connected and dropout regularization, also there is use
following pre-processing: of Sigmoid activation used for the last layer, to achieve binary
● Tokenization: URLs are tokenized into structured
tokens, domain name, path, subdomains, query
parameters and file extensions to capture structural
and contextual patterns.
● Normalization: URLs are converted to lowercase,
special characters are removed and encoding
schemes are normalized to prevent evasion based on
slight text variation.
● Labeling: URLs from legitimate domains are
labelled as "legitimate" whereas in phishing
databases are labelled as "phishing". classification.
● Missing Data Handling: When there is missing Fig 3. Hybrid CNN-LSTM model architecture for phishing
data they are either replaced by calculated values or detection.
omitted depending on the significance of the
missing components. E. Model Training
● Dataset Splitting: Dataset was splitted into 80% for The training procedure was:
training and 20% for testing with a validation set ● Hyperparameter Tuning: Hyperparameter tuning
drawn from the training data for hyperparameter for learning rate, batch size, quantity of CNN filters,
optimization; hence, ensures data is uniform, number of LSTM units and dropout ratios was
normalized and is ready for future analysis and performed by applying Grid or Random Search
model building. upon the validation set.
● Loss Function: We used binary cross-entropy loss
C. Feature Extraction Techniques in binary classification.
Features were designed to improve model performance at ● Optimization Algorithm: The Adam optimizer was
detecting phishing patterns: utilized since it possessed an adaptive learning rate.
● WHOIS-Based Features: Domain age, registrar ● Evaluation Metrics: Accuracy, precision, recall,
and registering country to determine legitimacy of F1-score and AUC-ROC were utilized for the
domain. performance measurement of both phishing and
● SSL Certificate Features: If SSL certificates normal classes.
(HTTPS) are present and valid, then it determines ● Regularization: Dropout and batch normalization
whether the website is encrypted or not. were used to stop overfitting of the model and
● Content-Based Features: Utilization of NLP for generalizing to new data.
suspicious words like (e.g., "login", "secure",
"update") in URLs. F. Model Evaluation
● Visual Features: CNNs to compare visual Final evaluation was done on an independent 20% test set.
similarity of page items (e.g. favicons) to pages on Results were reported using accuracy, precision, recall, F1-
legitimate websites. score and AUC-ROC. Also, a confusion matrix was analyzed
● Reputation-Based Features: DNS and IP level to see the distribution of false positives and false negatives to
checks to verify domain is associated with understand the classification behavior.
recognized malicious networks.
IV. RESULTS
The performance of the model was evaluated against a test
set of URLS, and the features of PHISHNETGUARD were
evaluated and presented in this section, with the help of
different evaluation metrics such as accuracy, precision,
recall, F1-score, confusion matrix, and ROC AUC score.

A. Model Performance Overview:

The capabilities of the model was evaluated with 1,036
URLs, of which half are legitimate URLs and the rest are
Fig 2. Block diagram of feature extraction components. phishing ones. The evaluation demonstrates the model’s
effectiveness in classifying between legitimate URLs and
D. Model Development phishing ones. The actual performance measure summary is
A hybrid deep learning model using Convolutional Neural given below.
Networks (CNN) and Long Short-Term Memory (LSTM)
was used. CNN layers capture local spatial features from B. Confusion Matrix:
tokenized URLs, while LSTM layers learn temporal Below is the confusion matrix of the model:
dependencies across sequences. This permits the model to use Where:
both syntactic as well as behavioral URL traits. True Positives (TP): 489 phishing URLs are classified
correctly as phishing.
True Negatives (TN): 492 legitimate URLs are classified score when scoring quite close to 1, making it the strongest
correctly as legitimate. measure of positives and negatives classification on various
False Positives (FP): 26 legitimate URLs are incorrectly decision thresholds.
classified as phishing. The following are the Receiver Operating Characteristic
False Negatives (FN): 29 phishing URLs are incorrectly (ROC) curve for the model and the area under the curve
classified as legit. (AUC) of 0.9859. This signifies that the model has great
discriminative capacity between phishing URLs from
legitimate ones.

Fig. 4 Confusion Matrix of the PHISHNETGUARD

Fig. 5 ROC Curve for PHISHNETGUARD
The confusion matrix indicates that the model correctly
identifies the maximum of legal and phished URLs, with a F. Additional Evaluation Metrics:
relatively small number of misclassifications, specifically 26 Some additional performance metrics were introduced for
falsely predicted positives and 29 false predicted negatives. more thorough evaluation of strength and reliability in the
phishing detection model over and above the standard ones.
C. Accuracy: As the Matthews Correlation Coefficient (MCC) was
The accuracy of the model as a whole is 94.69%, which calculated to be 0.8938, it indicated a balance between the
translates to almost 95% of the URLs in the set for testing predicted and actual classes. However, it is particularly
are accurately predicted. That is to say, the model reached valuable for both unbalanced and balanced datasets.
an accuracy of almost 95% in discriminating between the The Balanced Accuracy computed was 94.69, which
classes illegitimate and legitimate and represents a correct reflected the same high level of recall across the two classes.
prediction in most cases on the test samples. It also has Specificity 94.98%, indicating the ability for such
a model to recognize a legitimate URL while not flagging it
D. Precision, Recall, and F1-Score: as fake. Log Loss value at 0.1580 means well-calibrated,
The precision, recall, and F1 score were calculated for both confident probabilistic predictions. Cohen's Kappa score of
classes: legitimate and phishing. A comparison of the 0.8938 indicates strong agreement beyond chance. These
different performance metrics (Precision, Recall, F1-Score) metrics then make it a highly discriminative, well-calibrated,
is shown in the table below: and reliable model-suitable for deployment in the real world.
Precision Recall F1-Score Support
Legitimate 94% 95% 95% 518 V. FUTURE DISCUSSION
Our future work will incorporate additional advanced feature
Phishing 95% 94% 95% 518 extraction in real-time phishing website identification and
execution, with features such as WHOIS info, SSL certificate
Accuracy N/A N/A 95% 1036 info, domain age, content analysis using Natural Language
Processing (NLP), and image similarity processing using
Macro 95% 95% 95% 1036 Convolutional Neural Networks (CNNs). Additionally, we
Average
Weighted 95% 95% 95% 1036 shall research modern methods of ensemble learning, online
Average learning, and adversarial training for model revision and
Table 1: Evaluation Results Using Precision, Recall, and F1-Score updating in real-time with proper inputs from the actual data
and reports from users, thus enhancing the overall
Both classes have obtained that high precision signifying the performance of their model.
model has done a good job in keeping the false positives to a On the implementation side, we are concerned with building
minimum. The recalls for both classes are also reasonably of real-time phishing URLs classification; browser
good and signify that the model has done well in minimizing extensions for the simplicity of protection, easy phishing
false negatives. F1 scores for both classes hover around 95%, reporting; and a scalable backend architecture developed on
which, being the harmonic mean of recall and precision, microservices and serverless Computing. As security is
indicates a general balanced performance of the model for paramount, we will implement robust mechanisms to ensure
both classes. that user data will be protected, and the integrity of the system
will be maintained through mechanisms such as data
E. ROC AUC Score sanitization, hashing, encrypting, and audit logs. We will also
An ROC AUC score of the model of 0.9859 implies great explore federated learning, graph neural networks, and
discrimination. A model is one performing very well at explainable AI (XAI) to aid in the ability to take informative
phishing from legitimate URLs discrimination on an AUC and correct decision and transparency in the identification
process. For seamless operation, we will adopt modern [5] Nepal, S., H. Gurung, and R. Nepal. "Phishing URL
deployment practices in the form of CI/CD pipelines, A/B Detection Using CNN-LSTM and Random Forest
testing, and performance monitoring to ensure updates with Classifier." (2022).
minimal disruption. In conclusion, considering that user trust [6] Ariyadasa, Subhash, Subha Fernando, and Shantha
is the most important aspect, we will promote active user Fernando. "Detecting phishing attacks using a combined
engagement through tutorials, anti-phishing training model of LSTM and CNN." Int. J. Adv. Appl. Sci 7.7 (2020):
modules, and a community scoring system. This engagement 56-67.
program will keep users informed about new phishing [7] Roy, Sanjiban Sekhar, et al. "Multimodel phishing URL
attempts, thus enhancing their capacity to improve their detection using LSTM, bidirectional LSTM, and GRU
cybersecurity behaviors and to actively report phishing models." Future Internet 14.11 (2022): 340.
attempts. [8] Alsubaei, Faisal S., Abdulwahab Ali Almazroi, and Nasir
Ayub. "Enhancing phishing detection: A novel hybrid deep
VI. CONCLUSION learning framework for cybercrime forensics." IEEE Access
The increasing importance detection of phishing in real time 12 (2024): 8373-8389.
largely stems from the ever more clever phishing, making it [9] Asiri S, Xiao Y, Alzahrani S, Li T. "PhishingRTDS: A
more personalized and, thus, harder to detect. These attacks real-time detection system for phishing attacks using a Deep
pose threats to the deepest constituents of the user, which is Learning model." Computers & Security. 2024 June
why such detection mechanisms are crucial for protecting 1;141:103843.
users from malicious websites. Phishing detection techniques [10] Sameen M, Han K, Hwang SO. "PhishHaven—An
evolve with the great advancement of machine learning efficient real-time AI phishing URLs detection system."
technology against the ever-evolving attack patterns and IEEE Access. 2020 Apr 30;8:83425-43.
behaviors. Besides detection, the training also involves [11] Aljofey A, Jiang Q, Qu Q, Huang M, Niyigena JP. "An
awareness improvement through modules such as gaming, effective phishing detection model based on character level
simulated phishing, etc., to let users identify threat detection convolutional neural network from URL." Electronics. 2020
independently and observe cybersecurity behaviors well Sep 15;9(9):1514.
afterward. [12] Opara C, Chen Y, Wei B. "Look before you leap:
Our core focus is to bring forward a complete phishing Detecting phishing web pages by exploiting raw URL and
detection system based on deep learning models. We HTML characteristics." Expert Systems with Applications.
conceive a clean hybrid CNN-LSTM model using dual-input 2024 Feb 1;236:121183.
processes capable of managing tokenized URL sequences [13] Dasgupta S, Shahriar KT, Alqahtani H, Alsalman D,
and numeric complementary features at the same time. This Sarker IH. "Modeling hybrid feature-based phishing websites
will improve the model's capacity to capture local sequential detection using machine learning techniques." Annals of Data
prototypes at a high level and, thus, semantically enhance the Science. 2024 Feb;11(1):217-42.
capability of the model to classify accurately. Unlike past [14] Gupta BB, Yadav K, Razzak I, Psannis K, Castiglione
implementations, which always rely on one form of either A, Chang X. "A novel approach for phishing URLs detection
convolutional or recurrent networks, we illustrate how using lexical based machine learning in a real-time
feature fusion is affordable in one model. The multiple layers environment." Computer Communications. 2021 July
are dropout regularized, with hierarchical convolutional 1;175:47-57.
layers in combination with temporal modeling through [15] Sánchez-Paniagua M, Fernández EF, Alegre E, Al-
Nabki W, González-Castro V. Phishing URL detection: A
LSTM, all contributing to better generalization and real-case scenario through login URLs. IEEE Access. 2022
robustness against overfitting. Our comparative study shows Apr 18;10:42949-60
that hybrid architecture provides a relative upsurge in [16] Zamir A, Khan HU, Iqbal T, Yousaf N, Aslam F, Anjum
performance with respect to traditional measures when A, Hamdani M. Phishing website detection using diverse
machine learning algorithms. The Electronic Library. 2020
considering the model’s precision, recall, and overall F1- Mar 19;38(1):65-80.
score. [17] Feng F, Zhou Q, Shen Z, Yang X, Han L, Wang J. The
application of a novel neural network in the detection of
VII. REFERENCES phishing websites. Journal of Ambient Intelligence and
Humanized Computing. 2024 Mar:1-5.
[1] Sumo Sami M Aldaham, Osama Ouda, A.A. Abd El-Aziz,
“Improved Detection of Phishing Websites using Machine [18] Orunsolu AA, Sodiya AS, Akinwale AT. A predictive
Learning”, Int J Intell Syst Appl Eng, vol. 12, no. 21s, pp. model for phishing detection. Journal of King Saud
4619–4633, Mar. 2024. University-Computer and Information Sciences. 2022 Feb
[2] Choudhary, Tarun, et al. "A machine learning approach 1;34(2):232-47.[19] Nagunwa T. AI-driven approach for
for phishing attack detection." Journal of artificial robust real-time detection of zero-day phishing websites.
intelligence and technology 3.3 (2023): 108-113. International Journal of Information and Computer Security.
[3] A. K. Dutta, "Detecting Phishing Websites Using 2024;23(1):79-118.
Machine Learning Technique," PLoS ONE, vol. 16, no. 10,
e0258361,2021.[Online]. [20] Sadique F, Kaul R, Badsha S, Sengupta S. An automated
Available: [Link] framework for real-time phishing URL detection. In 2020
[4] Linh, Dam Minh, Ha Duy Hung, Han Minh Chau, Quang 10th Annual Computing and Communication Workshop and
Sy Vu, and Thanh-Nam Tran. "Real-time phishing detection Conference (CCWC) 2020 Jan 6 (pp. 0335-0341). IEEE.
using deep learning methods by extensions." International
Journal of Electrical and Computer Engineering (IJECE) 14, [21] Almousa M, Zhang T, Sarrafzadeh A, Anwar M.
no. 3 (2024): 3021-3035. Phishing website detection: How effective are deep learning‐
based models and hyperparameter optimization?. Security
and Privacy. 2022 Nov;5(6):e256.