Page 1 of 12 - Cover Page Submission ID trn:oid:::27005:124779488

Implementation [Link]
Datta Meghe Institute of Medical Sciences, Wardha

Document Details

Submission ID

trn:oid:::27005:124779488 8 Pages

Submission Date 4,918 Words

Dec 18, 2025, 4:30 PM GMT+5:30

29,619 Characters

Download Date

Dec 18, 2025, 4:32 PM GMT+5:30

File Name

Implementation [Link]

File Size

451.3 KB

Page 1 of 12 - Cover Page Submission ID trn:oid:::27005:124779488

 Page 2 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

4% Overall Similarity
The combined total of all matches, including overlapping sources, for each database.

Filtered from the Report

Bibliography

Quoted Text

Cited Text

Small Matches (less than 10 words)

Match Groups Top Sources

15 Not Cited or Quoted 4% 2% Internet sources

Matches with neither in-text citation nor quotation marks
1% Publications
0 Missing Quotations 0% 2% Submitted works (Student Papers)
Matches that are still very similar to source material

0 Missing Citation 0%
Matches that have quotation marks, but no in-text citation

0 Cited and Quoted 0%

Matches with in-text citation present, but no quotation marks

Integrity Flags
0 Integrity Flags for Review
Our system's algorithms look deeply at a document for any inconsistencies that
No suspicious text manipulations found. would set it apart from a normal submission. If we notice something strange, we flag
it for you to review.

A Flag is not necessarily an indicator of a problem. However, we'd recommend you

focus your attention there for further review.

Page 2 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

 Page 3 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

Match Groups Top Sources

15 Not Cited or Quoted 4% 2% Internet sources

Matches with neither in-text citation nor quotation marks
1% Publications
0 Missing Quotations 0% 2% Submitted works (Student Papers)
Matches that are still very similar to source material

0 Missing Citation 0%
Matches that have quotation marks, but no in-text citation

0 Cited and Quoted 0%

Matches with in-text citation present, but no quotation marks

Top Sources
The sources with the highest number of matches within the submission. Overlapping sources will not be displayed.

1 Submitted works

University of Wolverhampton on 2025-05-16 <1%

2 Internet

[Link] <1%

3 Internet

[Link] <1%

4 Internet

[Link] <1%

5 Publication

Mahmoodi, Kaywan. "Automated Fault Detection and Time-to-Failure Prediction … <1%

6 Submitted works

University of Mauritius on 2025-12-01 <1%

7 Submitted works

Glyndwr University on 2023-05-14 <1%

8 Submitted works

Leeds Beckett University on 2025-09-15 <1%

9 Submitted works

Sunway Education Group on 2025-07-22 <1%

10 Internet

[Link] <1%

Page 3 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

 Page 4 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

11 Internet

[Link] <1%

12 Internet

[Link] <1%

13 Internet

[Link] <1%

14 Internet

[Link] <1%

Page 4 of 12 - Integrity Overview Submission ID trn:oid:::27005:124779488

 Page 5 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

PHISHING URL DETECTION THROUGH MULTI-SIGNAL

AGGREGATION AND MACHINE LEARNING
Abdul raheem Dr. Thriveni J
Student, Dept. of CSE Professor &Chairperson, Dept. of CSE
University of Visvesvaraya College of Engineering University of Visvesvaraya College of Engineering
Bengaluru, India Bengaluru, India
77abdulraheem@[Link] xxxxxxxxxxxxx@[Link]

Abstract – Phishing continues to be one of the most Their exclusive objective is to deceive victims into
effective vectors for credential theft and online fraud. In providing their login credentials, which are subsequently
this research paper we present a real-time URL collected by the fraudsters. The assailants can exploit the
classification method that combines many different signals obtained credentials to fulfill their objectives, including
to classify a URL as phishing or safe. The classification espionage, slander, impersonation, and other financial
process includes performing reputation checks from benefits. Phishing serves as the predominant catalyst for
recognised threat intelligence sources (URLVoid, McAfee, severe cyber assaults, including ransomware and
Sucuri), validating the SSL certificate and the WHOIS
virus attacks. In the Figure 1 it is illustrates the diverse
information for the domain, and computing topological
improvements associated with a conventional phishing
features for each domain (age of the domain, IP blacklist)
and finally classifying the URL using a LightGBM
attempt.
classifier that has been trained on various labelled
13
phishing datasets. In order to facilitate a large number of
installations in a short period of time, the architecture uses
a multi-tiered filtering technique. The first tier matches
the quickly identified safe domains with the Alexa Top 1
million List, while the second tier examines the rest of the
URLs using external APIs and local blacklists. This
structure provides both accuracy in identifying content
that is potentially dangerous and also speed and efficiency
for deploying this technology in live environments. We
evaluated the system's performance across multiple
datasets, including the PhishTank, OpenPhish, and a
variety of curated benign URLs, by looking at Precision,
Recall, F1-score, and ROC-AUC; additionally, we
examined the robustness against obfuscation techniques,
as well as changing patterns in phishing activities. The
findings showed that the combination of different types of
threat data significantly improves the detection of phishing
compared to model(s) based on using only one source or
9
feature set. This project provides a deployable, real-time
phishing detection system; supports the benefits of multi-
signal aggregation; and offers insight into the importance
of features for ongoing threat monitoring and
improvement efforts.
Keywords – Phishing Detection, URL Classification, Threat
Intelligence Aggregation, Machine Learning, Real-Time
Security, LightGBM, Random Forest.

INTRODUCTION
Phishing is a method employed by adversaries to obtain
victims' social media profiles, email accounts, or
banking credentials by directing them to counterfeit web
pages via links disseminated through various channels,
including spoofed emails, SMS, QR codes, and instant
messages. These counterfeit websites closely resemble
the authentic ones and are specifically crafted, primarily
1 via phishing kits [1]. These tactics exploit the trust users
place in established platforms, making it crucial for
individuals to remain vigilant and recognize signs of
deception. By educating themselves on common
4 phishing techniques, users can better protect their
sensitive information from falling into the wrong hands.

Page 5 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 6 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

Despite extensive research aimed at addressing this connecting to a harmful resource. Table 2 lists some of the
problem, the incidence of reported phishing websites phishing domains that are registered to practice URL
has not diminished in recent years. The APWG (Anti- obfuscation.
Phishing Working Group) study on phishing activity As per a report [10], phishing attacks on brands have almost
trends indicates that reported phishing incidences have doubled in recent years, with 621 brands affected in July 2022.
surged in the post-COVID years beginning in 2020. With LinkedIn being the most phished brand [11], around
Figure 2 depicts phishing sites reported since 2019. 55% of phishing assaults leverage a respected brand to boost
Figure 3 illustrates distinct phishing sites reported their legitimacy. To avert a phishing assault, consumers need
quarterly in the last two years. With 1,624,144 phishing to be cautious and aware of the phishers’ strategies. This is not
assaults in the first quarter of 2023, it was the worst always achievable, as anyone can use the internet, regardless
quarter in APWG history [2] in the context of phishing
of technological proficiency. Organization of training for each
events. Even while there is some slackening in the
internet user to ward off phishers is nearly impossible. Hence,
number of phishing sites detected in the recent few
software-based phishing detection mechanisms are the most
quarters, their number in each quarter is larger than the
viable solutions for the effective neutralization of phishing
yearly records of the pre-COVID era.
attacks.
The biggest issue that can be held responsible for the
victims clicking on the phoney links and visiting the LITERATURE SURVEY
phishing websites is ignorance. The messages, whether This section reviews recent and widely adopted academic
delivered via email, SMS, QR codes, or other media, approaches for phishing website detection.
are intended to appear visually real. In addition, they
deploy manipulative language designed to create An approach employing seven distinct machine learning
emotions such as worry, tension, fear, or hurry, pushing models with diverse feature representations, including NLP-
users to overlook tiny irregularities in the phishing links based, word-vector-based, and hybrid features, is presented in
and act in haste. [12]. The proposed method is capable of detecting zero-day
phishing attacks and operates independently of third-party
services and language constraints. The authors constructed a
large dataset consisting of 73,575 URLs, achieving a
classification accuracy of 97.98% using a Random Forest
classifier with NLP-based features. However, the approach
shows reduced effectiveness when handling URLs with short
domains or missing paths.
In [13], the authors propose a hyperlink-based feature
extraction technique that analyzes website source code to train a
logistic regression classifier, achieving an accuracy of
98.4%. Despite its effectiveness, the method is vulnerable to
evasion techniques such as modifying embedded objects,
favicons, or JavaScript references, as it relies solely on source
code analysis.
A search-engine-based phishing detection method is
introduced in [14], where identity-related keywords are
extracted from webpage titles, meta descriptions, and content
The attackers undertake domain-squatting [3], i.e., using TF-IDF. These keywords are weighted based on their
acquisition of domain names similar to established brands, position of occurrence, and the legitimacy of a website is
and then either share their URL with the victims or wait for determined by checking the presence of its domain in top
the victims to make a typographical mistake and visit the search engine results. The method achieves an accuracy of
7
false web page the attacker has built. There are multiple 89% on a limited dataset of 200 websites and is heavily
variations of domain squatting, which depend on typo dependent on third-party search engines.
errors [4], bit flips [5], homophones [6], combining
another word with the known brand [7], and using similar- A lightweight technique utilizing only nine URL-based
looking letters [8]. Table 1 displays some of the squatting features is proposed in [15] to enable fast phishing detection in
phishing domains together with the domains of real firms. resource-constrained environments such as IoT and mobile
In addition to domain squatting, attackers frequently use devices. Although the approach reports an accuracy of 99.5%,
URL obfuscation [9] to trick victims into interpreting the limited feature set may reduce its robustness in real-world
malicious URLs as legitimate. One frequent approach is scenarios.
preserving the brand name within the URL but placing it as In [16], a combination of URL-based, hyperlink-based, and
a subdomain of a phishing website. Attackers may also textual features is employed and classified using an XGBoost
modify the top-level domain (TLD) or country code TLD model. The authors developed a custom dataset and achieved
(ccTLD) to spoof authenticity. Another frequent an accuracy of 96.76%. Similarly, [17] applies canopy-based
obfuscation approach involves inserting the brand name feature selection followed by ensemble learning with grid
within the URL path or query string, further misleading search and cross-validation, resulting in an accuracy of
users by giving the illusion of legitimacy while really 98.12%.

Page 6 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 7 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

A hybrid phishing detection strategy combining visual normalizing case, the system can compare hosts
and textual features is presented in [18]. The visual against the Alexa Top 1M corpus, WHOIS data,
module analyzes logo characteristics such as position, temporary-domain lists, and typo-squatting
color, and size, while the textual module extracts n- permutations.
grams from webpage content. The outputs of both Path specifies the directory hierarchy on the host.
modules are combined to form a search engine query, and a Token counts, nesting depth, and suspicious folder
webpage is classified as legitimate names are computed from the portion following the
if matching results appear in top search engine rankings. hostname up to any ?.
The method achieves an accuracy of 98.60%. Despite these Query string holds key–value parameters appended
advances, limited research has focused on detecting URL after ? and delimited by &. Although optional, these
obfuscation and domain squatting attacks. Existing parameters often encode tracking data or payloads;
solutions typically generate potential squatting domains the project measures their count and character
from known trademarks or blocklist and evaluate only makeup as lexical features.
those with valid DNS records, making them database-
dependent and ineffective against previously unseen Figure references from the source material translate here to the
squatting patterns. API’s logging outputs, where each component is logged
before feature extraction to maintain auditability.
To address this, [19] proposes a multilingual transformer-
based system capable of generating phonetic squatting
variants and identifying their presence in SSL certificates, SYSTEM WORKFLOW
detecting such patterns in approximately 15% of issued Fig 4 is an illustration of the end-to-end FastAPI-based
certificates. A context-free approach for modelling domain prediction pipeline used in this work. The URL input is
name inconsistencies in banking websites is proposed in received through API requests or through curated CSV
[20], though it is limited to financial domains. files. Once received, the URL is first normalized
(lowercase, whitespace removed, schemes inferred, and the
canonical network location extracted). After URL
normalization, it will be checked against the lists of known
benign and malicious sources, duplicate URIs will be
removed, and class imbalance will be addressed in the
training notebooks. Then, a bad domain analysis will occur
for each URL. The bad domain analysis includes the
A lightweight phishing detection framework for mobile following methods for finding domain squatting and
devices is introduced in [21], emphasizing computational obfuscation indicators: Comparing against the Alexa Top 1
efficiency. Initial experiments using artificial neural million list to look for hosts that are found on it;
networks with URL and HTML features showed degraded Generating typo-squatting permutation URLs from the
performance when restricted to URL-only inputs. typo-squatting module with Levenshtein similarity checks;
Consequently, transformer-based NLP models such as Finding temporary registrars and recently registered
BERT and ELECTRA were applied directly to URLs, domains using the WHOIS data; Validating an IP literal
demonstrating improved learning capability and robustness URL against FireHOL's IP sets. Afterward, multiple threat
compared to traditional feature-based methods intelligence providers (such as URLVoid, Norton, and
METHOLOGY McAfee) and a local blacklist are used as part of the
reputation checking process. URLs that have been
This section outlines how the service decomposes identified as being high-confidence malevolent URLs may
incoming URLs, the provenance and treatment of the be terminated early. URLs that pass through this series are
project’s URL datasets, the preprocessing steps prior to then checked against lexical features. The purpose for these
inference, the feature families extracted, and the end- checks is to create machine learning input vectors based on
to-end scoring architecture used by the FastAPI certain mathematical computations related to the
backend. structural/statistical characteristics of the URL (length,
COMPOSITION OF A URL entropy, token counts, how many digits/hyphens appear,
density of special characters, and whether the URL
A URL is the unique locator for any web resource
contains a malign extension). The LightGBM trained
HTML documents, media objects, API endpoints, or
model will then classify the URL into 2 categories,
downloadable binaries. The detector analyzes every
phishing or legitimate, by using binary classification. The
request by decomposing it into four canonical layers:
results from each of the checks will be compiled into a
Scheme encodes the transport protocol (http, comprehensive weighted scoring model. Each check will
https) and dictates whether TLS is expected. The have an associated penalty applied, starting at a baseline
parser isolates the prefix before ://; mismatches score of 180. This will provide users with a human-
between scheme and certificate state immediately readable JSON-formatted final output that contains the
influence the heuristic score. final verdict, a numerical risk score, which checks
Hostname (subdomain + registered domain + triggered, and which domains may be the focus for a
TLD) uniquely identifies the origin server. By phishing attempt. This pipeline mirrors the offline training
stripping common prefixes (www.) and and preprocessing routines, ensuring consistency and

Page 7 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 8 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

reproducibility between model development and real- Algorithm 2: Lexical URL Feature Extraction
time deployment.
FEATURES EXTRACTED 1: function EXTRACT_LEXICAL_FEATURES
[Link] Normalization & Domain Analysis (normalized_url)
The first algorithm performs URL normalization and 2: L1 ← compute total URL length
domain-level risk analysis to identify high-risk domains 3: L2 ← compute domain Shannon entropy
at an early stage. Each incoming URL is standardized 4: L3 ← detect IP address usage
by converting it to lowercase, trimming whitespace, and 5: L4 ← detect malicious file extensions
inferring a default scheme when missing, followed by 6: L5 ← count query parameters
parsing into its constituent components. The algorithm 7: L6 ← count path tokens
then extracts bad-domain indicators, including Alexa 8: L7 ← count hyphens
Top 1 million membership for early allowlisting, 9: L8 ← count digits
similarity to known brand domains through typo- 10: L9 ← detect special characters (@, !, #, $, %,
squatting permutation analysis, detection of temporary ㅤㅤ ^, &, *, _, +)
registrars using WHOIS data, estimation of domain age 11: return {L1…L9}
to identify newly registered domains, and identification 12: end function
of IP literal URLs validated against FireHOL IP
blacklists. These domain level features provide strong c. Reputation & Transport Analysis
signals for detecting brand jacking, domain squatting, The third algorithm integrates external reputation
and infrastructure abuse before deeper analysis is intelligence and transport-layer security signals to enhance
performed. detection confidence. It queries multiple threat intelligence
14 sources, including URLVoid, Google Safe
Browsing, Norton Safe Web, McAfee SiteAdvisor, and
Algorithm 1: URL Normalization & Domain Analysis Sucuri, along with a locally maintained blacklist. In
parallel, transport level properties such as HTTPS usage
1: Step 1: Normalize the URL and SSL certificate validity are verified to assess the
2: function NORMALIZE_URL(url) authenticity of the connection. These reputation and
3: url ← lowercase(trim(url)) security signals complement locally extracted features by
4: if scheme missing then infer scheme as http providing UpToDate threat context and enabling high-
5: parse url into scheme, hostname, path, query confidence identification of known malicious URLs.
6: return normalized_url
7: end function Algorithm 3: Reputation & Transport Analysis
8: Step 2: Extract bad-domain features
9: function EXTRACT_DOMAIN_FEATURES
1: function REPUTATION_AND_SSL_CHECK(url)
ㅤㅤ (normalized_url) 2: R1 ← query URLVoid
10: D1 ← check Alexa Top 1M membership 3: R2 ← query Google Safe Browsing
11: D2 ← compute typo-squatting similarity with 4: R3 ← query Norton Safe Web
known brands 5: R4 ← query McAfee SiteAdvisor
12: D3 ← check temporary registrar using WHOIS 6: R5 ← query Sucuri blacklist
13: D4 ← check domain age ≥ 3 months 7: R6 ← check local blacklist
14: D5 ← detect IP-literal URL & check FireHOL 8: T1 ← verify SSL certificate validity
ㅤ IP sets 9: T2 ← check HTTPS usage
15: return {D1, D2, D3, D4, D5} 10: return {R*, T*}
16: end function 11: end function
b. Lexical URL Feature Extraction
d. Reputation & Transport Analysis
The second algorithm focuses on extracting lexical
The final algorithm combines domain-level indicators,
1 features that describe the structural and statistical
lexical features, reputation signals, and transport checks to
characteristics of URLs. These features are computed
produce an interpretable phishing verdict. URLs identified
entirely locally to ensure fast and reliable execution.
as safe through early allowlisting are immediately
The extracted lexical attributes include total URL
classified as legitimate, reducing unnecessary computation.
length, Shannon entropy of the domain to capture
Remaining URLs are evaluated using a trained LightGBM
randomness, IP address indicators, malicious file-
classifier operating on lexical features, and a weighted
extension flags, query-parameter count, path-token
scoring mechanism aggregates evidence from all feature
count, hyphen count, digit count, and the presence of
groups. Penalties are applied for failed checks, malicious
special characters such as @, !, #, $, %, ^, &, *, _, and
predictions, and historical reports, producing a final risk
+. Together, these features model common obfuscation
score and classification decision. This multi-stage
and manipulation patterns used in phishing URLs and
aggregation allows the system to balance accuracy,
form the primary input vector for the machine learning
robustness, and real-time performance while providing
classifier.
transparent reasoning for each decision.

Page 8 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 9 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

Algorithm 4: Phishing Classification & Scoring references to the Alexa Top 1 million domains. During
preprocessing, all URLs are normalized through
lowercasing, scheme inference, and netloc extraction,
1: function CLASSIFY_URL(url) followed by deduplication and consolidation across
2: normalized_url ← NORMALIZE_URL(url) sources. Labels are assigned based on source annotations
3: {D1…D5} ← (phishing or benign), with reputation-based cues used only
EXTRACT_DOMAIN_FEATURES to verify consistency during preprocessing. Training and
(normalized_url) validation splits are created within the preprocessing
4: if D1 = = TRUE then notebooks, and class imbalance is addressed through
5: Note URL as Legitimate (early allowlist) sampling or weighting strategies to mitigate benign-skew
6: return Legitimate bias. The finalized LightGBM model artifact is stored for
7: end if deployment.
8: {L1…L9} ←
EXTRACT_LEXICAL_FEATURES Model Training and Hyperparameter Setup
(normalized_url) The final classifier is a LightGBM model selected based on
9: {R*, T*} ← comparative experiments conducted in ModelTrainin, with
REPUTATION_AND_SSL_CHECK a Random Forest model retained as a baseline. The model
(normalized_url) is trained using nine lexical URL features, including URL
10: y_pred ← [Link]({L1…L9}) length, entropy, IP address flag, malicious extension flag,
11: score ← 180 query parameter count, path token count, hyphen count,
12: apply weighted penalties based on D*, R*, T*, digit count, and special-character presence.
ㅤㅤ and y_pred Hyperparameters are tuned over learning rate, number of
12 13: if score < threshold then leaves, tree depth, minimum data in leaf, feature fraction,
14: label URL as Phishing bagging fraction, and boosting iterations, with evaluation
15: else performed using held-out validation or cross-validation.
16: label URL as Legitimate LightGBM was chosen due to its favorable accuracy
17: end if latency trade-off and robustness across feature interactions.
18: return final verdict and score The trained model is loaded at runtime by the FastAPI
19: end function backend for inference.
Computational Complexity Analysis
URL parsing and lexical feature extraction operate in linear
time with respect to URL length. Domain lookups against
the Alexa Top 1 million list currently incur linear-time
complexity due to CSV scanning, though this can be
optimized to constant time using indexed data structures.
Typo-squatting generation and similarity evaluation are
bounded by predefined limits, yielding practical linear
behavior with respect to candidate count. Machine learning
inference using LightGBM incurs low computational
overhead due to shallow trees and limited feature
dimensionality. Overall request latency is primarily
dominated by network-bound reputation queries, while
purely local inference completes within a few milliseconds
per URL.
Threat Model and Assumptions
The adversary is assumed capable of crafting arbitrary
URLs employing obfuscation techniques such as typo
squatting, query stuffing, IP-literal addressing, and short-
lived domain registration. The defender has access to
domain reputation services, benign domain corpora,
WHOIS-derived metadata, IP blacklists, and a trained
lexical machine learning classifier. The system assumes
reasonable availability of WHOIS and reputation services
and treats Alexa Top 1 million membership as a strong
benign prior. Content-based attacks, compromised
legitimate domains, and client-side exploitation are
considered out of scope. In the absence of reputation
Dataset Construction & Labelling signals, detection relies solely on lexical heuristics and
machine learning predictions, with reduced confidence.
The dataset is constructed by aggregating multiple CSV
files located in the data/ directory which combine open
phishing corpora and benign URL lists, including cross

Page 9 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 10 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

8 RESULTS AND DISCUSSION model’s effectiveness in detecting phishing URLs, which is

critical in security-sensitive applications where false
6 1) Experimental Setup
negatives can lead to significant risk.
All experiments were carried out using Python-based
The strong performance of ensemble models validates the
machine learning libraries such as Scikit-learn and
effectiveness of the proposed feature set, which combines
LightGBM. The proposed phishing detection system
domain-level indicators, lexical URL characteristics, and
was evaluated on a large dataset compiled from public
reputation-based signals. This multi-signal representation
phishing sources including Kaggle, PhishTank, and
enables the classifiers to capture both structural
OpenPhish, along with curated benign URLs. After
obfuscation patterns and contextual risk factors commonly
preprocessing, normalization, and removal of
exploited in phishing attacks.
duplicates, the final dataset contained 1,541,538 labeled
URLs, where phishing URLs were marked as 1 and 5) Practical Implications
benign URLs as 0. The results demonstrate that the proposed phishing
10 The dataset was split into training and testing sets using detection framework is well-suited for real-time
standard practices, and class imbalance was handled deployment scenarios such as browser extensions, email
through suitable sampling or weighting techniques. gateways, and network security systems. The reliance on
2 Model performance was assessed using common predominantly URL-based and locally computable features
evaluation metrics Accuracy, Precision, Recall, F1- ensures low inference latency, while the integration of
score, and ROC–AUC which are appropriate for reputation signals enhances detection confidence. The
imbalanced cybersecurity datasets. achieved performance highlights the practical viability of
the proposed approach in mitigating large-scale phishing
2) Dataset Statistics
threats.
Table 3 summarizes the final dataset distribution used in
the experiments. The dataset contains 574,556 phishing CONCLUSION
URLs and 966,982 benign URLs, ensuring both Phishing continues to be a serious cyber threat due to its
diversity and scale for robust evaluation. The large ability to exploit both technical weaknesses and user trust.
dataset size enables the proposed system to generalize This work presents a practical phishing URL detection
effectively to real-world phishing scenarios. framework that combines domain analysis, lexical URL
features, and reputation-based signals with machine
learning to accurately classify URLs in real time.
The experimental results, obtained on a large dataset of
over 1.5 million URLs, show that ensemble-based models
3) Performance Comparison of ML Models achieve strong performance across multiple evaluation
Table 4 summarizes the performance of different metrics. The findings confirm that integrating multiple
machine learning classifiers trained on the proposed complementary signals is more effective than relying on a
3 feature set. The evaluated models include Logistic single feature category, particularly in detecting obfuscated
Regression (LR), Support Vector Machine (SVM), and newly generated phishing URLs. The proposed system
Extreme Gradient Boosting (XGB), Multilayer is computationally efficient, interpretable, and suitable for
Perceptron (MLP), and Random Forest (RF). deployment in real-world security applications such as
5 Performance is reported using Accuracy, Precision, browsers, email gateways, and network protection systems.
Recall, F1-score, ROC–AUC, and PR–AUC to provide
a comprehensive evaluation.
REFERENCES.
[1] B. Tejaswi, N. Samarasinghe, S. Pourali, M. Mannan, and A.
Youssef, ‘‘Leaky kits: The increased risk of data exposure from
phishing kits,’’ in Proc. APWG Symp. Electron. Crime Res.
(eCrime), Nov. 2022, pp. 1–13.
[2] APWG. (2024). Phishing Activity Trends Report. Accessed:
Feb. 2024. [Online]. Available: [Link]
4) Discussion of Results [3] N. Kumar, S. Ghewari, H. Tupsamudre, M. Shukla, and S.
From Table 4, it can be observed that ensemble-based Lodha, ‘‘When diversity meets hostility: A study of domain
models outperform linear and shallow classifiers across squatting abuse in online banking,’’ in Proc. APWG Symp.
all evaluation metrics. Logistic Regression and SVM Electron. Crime Res. (eCrime), Dec. 2021, pp. 1–15.
provide reasonable baseline performance but show [4] Y.-M. Wang, D. Beck, J. Wang, C. Verbowski, and B. Daniels,
‘‘Strider typo-patrol: Discovery and analysis of systematic typo-
limitations in capturing complex non-linear patterns squatting,’’ SRUTI, vol. 6, pp. 31–36, Mar. 2006.
present in phishing URLs. XGBoost and MLP achieve
[5] N. Nikiforakis, S. Van Acker, W. Meert, L. Desmet, F.
improved results due to their ability to model feature Piessens, and W. Joosen, ‘‘Bitsquatting: Exploiting bit-flips for
11 interactions; however, the Random Forest classifier fun, or profit?’’ in Proc. 22nd Int. Conf. World Wide Web, May
achieves the best overall performance. 2013, pp. 989–998.
The Random Forest model attains the highest accuracy [6] [Link], I. Drago, M. Mellia, and F. Cerutti, ‘‘Sound-
(98.5%) and F1-score (98.0%), along with superior skwatter (did you mean: Sound-squatter?) AI-powered
ROC–AUC and PR–AUC values, indicating strong generator for phishing prevention,’’ 2023, arXiv:2310.07005.
discriminative capability and robustness against class [7] P. Kintis, N. Miramirkhani, C. Lever, Y. Chen, R. Romero-
imbalance. The high recall value demonstrates the Gómez, N. Pitropakis, N. Nikiforakis, and M. Antonakakis,

Page 10 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

 Page 11 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488
ㅤㅤ

‘‘Hiding in plain sight: A longitudinal study of transformers for mobile devices,’’ Proc. Comput. Sci., vol. 191,
combosquatting abuse,’’ in Proc. ACM SIGSAC Conf. pp. 127–134, Jan. 2021.
Comput. Commun. Secur., Oct. 2017, pp. 569–586. [25] A. Prasad, S. Chandra, M. Uddin, T. Al-Shehari, N. A. Alsad
[8] F. Quinkert, T. Lauinger, W. Robertson, E. Kirda, and T. han, and S. Sajid Ullah, ‘‘PermGuard: A scalable framework for
Holz, ‘‘It’s not what it looks like: Measuring attacks and Android malware detection using permission-to-exploitation
defensive registrations of homograph domains,’’ in Proc. mapping,’’ IEEE Access, vol. 13, pp. 507–528, 2025, doi:
IEEE Conf. Commun. Netw. Secur. (CNS), Jun. 2019, pp. 10.1109/ACCESS.2024.3523629.
259–267. [26] A. Prasad and S. Chandra, ‘‘BotDefender: A collaborative
[9] H. Tupsamudre, A. K. Singh, and S. Lodha, ‘‘Everything is defense framework against botnet attacks using network traffic
in the name—AURL based approach for phishing analysis and machine learning,’’ Arabian J. for Sci. Eng., vol.
detection,’’ in Proc. Int. Symp. Cyber Secur., Cryptogr., 49, no. 3, pp. 3313–3329,Mar. 2024, doi: 10.1007/s13369-023-
Mach. Learn., 2019, pp. 231–248. 08016-z.
[10] Statista. (2009). Number Brands Legitimate Entities [27] K. Barik, S. Misra, and R. Mohan, ‘‘Web-based phishing URL
Targeted by Phishing Attacks from January 2009 to October detection model using deep learning optimization techniques,’’
2022. Accessed: Feb. 2024. [Online]. Available: Int. J. Data Sci. Anal., vol. 20, no. 5, pp. 4449–4471, Feb. 2025,
[Link] doi: 10.1007/s41060-025 00728-9.
ofbrands-hijacked-by-phishing-attacks/
[28] G. Brezeanu, A. Archip, and C.-G. Artene, ‘‘Phish fighter: Self
[11] StationX. (2024). Top Phishing Statistics for 2024: Latest updat ing machine learning shield against phishing kits based on
Figures and Trends. Accessed: Feb. 2024. [Online]. HTML code analysis,’’ IEEE Access, vol. 13, pp. 4460–4486,
Available: [Link] 2025, doi: 10.1109/ACCESS.2025.3525998.
[12] R. Goenka, M. Chawla, and N. Tiwari, ‘‘A comprehensive [29] G. S. Nayak, B. Muniyal, and M. C. Belavagi, ‘‘Enhancing
survey of phishing: Mediums, intended targets, attack and phishing detection: A machine learning approach with feature
defence techniques and a novel taxonomy,’’ Int. J. Inf. selection and deep learning models,’’ IEEE Access, vol. 13, pp.
Secur., vol. 23, no. 2, pp. 819–848, Apr. 2024 33308–33320, 2025, doi: 10.1109/ACCESS.2025.3543738.
[13] [Link], E. Buber, O. Demir, and [Link], ‘‘Machine [30] S. Remya, M. J. Pillai, B. S. Aparna, S. Rama Subbareddy, and
learning based phishing detection from URLs,’’ Expert Y. Y. Cho, ‘‘BGL-PhishNet: Phishing website detection using
Syst. Appl., vol. 117, pp. 345–357, Mar. 2019. hybrid model-BERT, GNN, and LightGBM,’’ IEEE Access,
vol. 13, pp. 2025, doi: 10.1109/ACCESS.2025.3551542.
[14] B. B. Gupta, K. Yadav, I. Razzak, K. Psannis, A.
Castiglione, and X. Chang, ‘‘A novel approach for phishing
URLs detection using lexical based machine learning in a
real-time environment,’’ Comput. Commun., vol. 175, pp.
47–57, Jul. 2021.
[15] A. K. Jain and B. B. Gupta, ‘‘A machine learning based
approach for phishing detection using hyperlinks
information,’’ J. Ambient Intell. Humanized Comput., vol.
10, no. 5, pp. 2015–2028, May 2019.
[16] [Link],[Link],[Link],[Link],[Link],[Link],[Link]
ng,‘‘An effective detection approach for phishing websites
using URL and HTML features,’’ Sci. Rep., vol. 12, no. 1,
May 2022, Art. no. 8842.
[17] A. K. Jain, S. Parashar, P. Katare, and I. Sharma,
‘‘PhishSKaPe: A content-based approach to escape phishing
attacks,’’ Proc. Comput. Sci., vol. 171, pp. 1102–1109, Jan.
2020.
[18] C. C. L. Tan, K. L. Chiew, K. S. C. Yong, Y. Sebastian, J.
C. M. Then, and [Link], ‘‘Hybrid phishing detection
using joint visual and textual identity,’’ Expert Syst. Appl.,
vol. 220, Jun. 2023, Art. no. 119723.
[19] R. V. Valentim, I. Drago, M. Mellia, and F. Cerutti, ‘‘X-
squatter: AI multilingual generation of cross-language
sound-squatting,’’ ACM Trans. Privacy Secur., vol. 27, no.
3, pp. 1–27, Aug. 2024, doi: 10.1145/3663569.
[20] A. Karim, M. Shahroz, K. Mustofa, S. B. Belhaouari, and S.
R. K. Joga, ‘‘Phishing detection system through hybrid
machine learning based on URL,’’ IEEE Access, vol. 11,
pp. 36805–36822, 2023.
[21] N. Kumar, S. Ghewari, H. Tupsamudre, M. Shukla, and S.
Lodha, ‘‘When diversity meets hostility: A study of domain
squatting abuse in online banking,’’ in Proc. APWG Symp.
Electron. Crime Res. (eCrime), Dec. 2021, pp. 1–15.
[22] A. Costello. (2003). Punycode: A Bootstring Encoding of
Unicode for Internationalized Domain
NamesinApplications(IDNA).[Link]: Jan. 20,
2024. [Online]. Available: [Link]
[23] T. Koide, N. Fukushi, H. Nakano, and D. Chiba,
‘‘PhishReplicant: A language model-based approach to
detect generated squatting domain names,’’ in Proc. Annu.
Comput. Secur. Appl. Conf., Dec. 2025, pp. 1–13.
[24] K. Haynes, H. Shirazi, and I. Ray, ‘‘Lightweight URL-
based phishing detection using natural language processing

Page 11 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

Page 12 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488

Page 12 of 12 - Integrity Submission Submission ID trn:oid:::27005:124779488