AI-Integrated Phishing Detection and Automated Incident Response System Using n8n, VirusTotal, urlscan.io, and Large Language Models

References

[1] Anti-Phishing Working Group (APWG). (2024). Phishing Activity Trends Report, Q4 2023. APWG. Available: https://apwg.org/trendsreports/

[2] Verizon. (2023). 2023 Data Breach Investigations Report (DBIR). Verizon Communications Inc. Available: https://www.verizon.com/business/resources/reports/dbir/

[3] National Institute of Standards and Technology (NIST). (2018). Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. NIST, Gaithersburg, MD. DOI: 10.6028/NIST.CSWP.04162018

[4] VirusTotal. (2024). VirusTotal API v3 Documentation. Google Cloud. Available: https://developers.virustotal.com/reference/overview

[5] urlscan.io. (2024). urlscan.io API Documentation. Available: https://urlscan.io/docs/api/

[6] n8n GmbH. (2024). n8n Workflow Automation Documentation. Available: https://docs.n8n.io/

[7] Purkait, S. (2012). Phishing counter measures and their effectiveness – literature review. Information Management & Computer Security, 20(5), 382–420. DOI: 10.1108/09685221211286548

[8] Garera, S., Provos, N., Chew, M., & Rubin, A. D. (2007). A framework for detection and measurement of phishing attacks. Proceedings of the 2007 ACM Workshop on Recurring Malcode (WORM), pp. 1–8.

[9] Zhang, G., Yan, C., Ji, X., Zhang, T., Zhang, T., & Shao, W. (2011). PhishDet: Exploring the problematic websites behind phishing emails. 2011 International Conference on Cloud and Service Computing, pp. 233–238.

[10] Thomas, K., Bursztein, E., Grier, C., Ho, G., Jagpal, N., Kapravelos, A., McCoy, D., Nappa, A., Paxson, V., Rajab, M. A., Ruesink, C., & Savage, S. (2016). Investigating commercial pay-per-install and the distribution of unwanted software. Proceedings of the 25th USENIX Security Symposium, pp. 721–739.

[11] Le Page, J., Pelletier, M., & Somé, D. (2018). Analysing and detecting emerging internet threats by monitoring underground forums. International Journal of Information Security, 17(6), 663–678.

[12] Ferrag, M. A., Hadjadj-Aoul, Y., Maglaras, L., Janicke, H., & Deltimple, M. (2023). SecurityBERT: A novel pre-trained language model for cybersecurity NLP. 2023 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 1–6.

[13] Chismon, D., & Ruks, M. (2015). Threat intelligence: Collecting, analysing and sharing for rapid incident response. SANS Institute Reading Room.

[14] Federal Bureau of Investigation (FBI). (2023). Internet Crime Report 2022. IC3, FBI. Available: https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf

[15] Motlagh, F. H., Hajizadeh, M., Majd, M., Najafi, P., Cheng, F., & Meinel, C. (2024). Large Language Models in Cybersecurity: State-of-the-Art. arXiv preprint arXiv:2402.00891.

[16] Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., & Cao, Y. (2023). ReAct: Synergizing reasoning and acting in language models. ICLR 2023. arXiv: 2210.03629

[17] Sahingoz, O. K., Buber, E., Demir, O., & Diri, B. (2019). Machine learning based phishing detection from URLs. Expert Systems with Applications, 117, 345–357.

[18] Shackleford, D. (2016). Who’s Using Cyberthreat Intelligence and How? SANS Institute Survey Report.

[19] Wagner, T. D., Mahbub, K., Palomar, E., & Abdallah, A. E. (2019). Cyber threat intelligence sharing: Survey and research directions. Computers & Security, 87, 101589.

[20] IBM Security. (2023). Cost of a Data Breach Report 2023. IBM Corporation. Available: https://www.ibm.com/reports/data-breach

@article{1718132,
      author = {Rohit Chaudhary, Shubham Mahajan, Shiksha Panday},
      title = {AI-Integrated Phishing Detection and Automated Incident Response System Using n8n, VirusTotal, urlscan.io, and Large Language Models},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {9},
      number = {11},
      pages = {2433-2442},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1718132.pdf},
      abstract = {In today’s enterprise landscape, the top method for credential theft, ransomware delivery and business email compromise (BEC) is phishing. Highly targeted social-engineering attacks are outsmarting traditional, rule-based email security filters and signature-matching anti-virus tools, thanks to the use of legitimate cloud systems, obfuscated redirect chains and polymorphic file attachments. In this paper, we present the design and implementation of a fully automated pipeline for phishing detection and incident response (IDIR) using the n8n open-source workflow automation platform, and empirically test the system’s performance. It is integrated with Gmail as the (monitored) email surface, VirusTotal’s threat intelligence API to analyze file attachments as well as URLs (including over 70 antivirus engines), urlscan.io for URL behavior sandboxing and Groq-hosted LLaMA 3 large language models for AI-driven structured incident reports. A 41-node directed acyclic graph (DAG) workflow ensures a sender allowlist, categorizes incoming email messages into 4 threat scenarios, carries out multiple queries on threat intelligence with various APIs, produces HTML-based email phishing reports per branch via LLM inference, and sends automated Gmail notifications with quarantine labelling. Empirical testing has shown that the system is able to detect an incident after about 5 seconds and respond after 20–35 seconds, orders of magnitude quicker than the manual workflow for an analyst to respond. It is a modular, extensible and immediate use for SOC automation deployment and Security Orchestration, Automation and Response (SOAR) deployments.},
      keywords = {Phishing Detection, Email Security, VirusTotal, urlscan.io, Large Language Models, LLaMA 3, n8n, SOAR, Incident Response, Threat Intelligence, Cybersecurity Automation, Groq},
      month = {May},
      doi = {https://doi.org/10.64388/IREV9I11-1718132}
  }