SmartPhish: A Confidence-Gated Two-Tier Learning Framework for Latency-Aware Phishing Website Detection

References

[1] Mohammad RM, Thabtah F, McCluskey L. Predicting phishing websites based on self-structuring neural network. Neural Computing and Applications. 2014;25(2):443–458.

[2] Sahingoz OK, Buber E, Demir O, Diri B. Machine learning based phishing detection from URLs. Expert Systems with Applications. 2019;117:345–357.

[3] Rao RS, Pais AR. Detection of phishing websites using an efficient feature-based machine learning framework. Neural Computing and Applications. 2019;31(8):3851–3873.

[4] Jain AK, Gupta BB. Towards detection of phishing websites on client-side using machine learning based approach. Telecommunication Systems. 2018;68(4):687–700.

[5] Zhang Y, Hong JI, Cranor LF. CANTINA: a content-based approach to detecting phishing web sites. In: 16th International Conference on World Wide Web; 2007. p. 639–648.

[6] Xiang G, Hong J, Rose CP, Cranor L. CANTINA+: a feature-rich machine learning framework for detecting phishing web sites. ACM Transactions on Information and System Security. 2011;14(2):1–28.

[7] Tan CL, Chiew KL, Wong K, Sze SN. PhishWHO: phishing webpage detection via identity keywords extraction and target domain name finder. Decision Support Systems. 2016;88:18–27.

[8] Ma J, Saul LK, Savage S, Voelker GM. Beyond blacklists: learning to detect malicious web sites from suspicious URLs. In: 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining; 2009. p. 1245–1254.

[9] Marchal S, François J, State R, Engel T. PhishStorm: detecting phishing with streaming analytics. IEEE Transactions on Network and Service Management. 2014;11(4):458–471.

[10] Le H, Pham Q, Sahoo D, Hoi SCH. URLNet: learning a URL representation with deep learning for malicious URL detection. arXiv:1802.03162. 2018.

[11] Bahnsen AC, Bohorquez EC, Villegas S, Vargas J, González FA. Classifying phishing URLs using recurrent neural networks. In: APWG Symposium on Electronic Crime Research (eCrime). IEEE; 2017. p. 1–8.

[12] Aljofey A, Jiang Q, Qu Q, Huang M, Niyigena JP. An effective phishing detection model based on character level convolutional neural network from URL. Electronics. 2020;9(9):1514.

[13] Breiman L. Random forests. Machine Learning. 2001;45(1):5–32.

[14] Friedman JH. Greedy function approximation: a gradient boosting machine. Annals of Statistics. 2001;29(5):1189–1232.

[15] Chen T, Guestrin C. XGBoost: a scalable tree boosting system. In: 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining; 2016. p. 785–794.

[16] Ke G, Meng Q, Finley T, Wang T, Chen W, Ma W, Ye Q, Liu TY. LightGBM: a highly efficient gradient boosting decision tree. In: Advances in Neural Information Processing Systems; 2017. Vol. 30. p. 3146–3154.

[17] Korkmaz M, Sahingoz OK, Diri B. Detection of phishing websites by using machine learning based URL analysis. In: 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT). IEEE; 2020. p. 1–7.

[18] Zouina M, Outtaj B. A novel lightweight URL phishing detection system using SVM and similarity index. Human-centric Computing and Information Sciences. 2017;7(1):17.

[19] Verma R, Das A. What’s in a URL: fast feature extraction and malicious URL detection. In: 3rd ACM International Workshop on Security and Privacy Analytics; 2017. p. 55–63.

[20] Vrbančič G, Fister I Jr, Podgorelec V. Datasets for phishing websites detection. Data in Brief. 2020;33:106438.

[21] Viola P, Jones M. Rapid object detection using a boosted cascade of simple features. In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR); 2001. Vol. 1. p. 511–518.

[22] Teerapittayanon S, McDanel B, Kung HT. BranchyNet: fast inference via early exiting from deep neural networks. In: 23rd International Conference on Pattern Recognition (ICPR). IEEE; 2016. p. 2464–2469.

[23] Pedregosa F, Varoquaux G, Gramfort A, et al. Scikit-learn: machine learning in Python. Journal of Machine Learning Research. 2011;12:2825–2830.

[24] Dietterich TG. Approximate statistical tests for comparing supervised classification learning algorithms. Neural Computation. 1998;10(7):1895–1923.

@article{1723029,
      author = {Priti Mishra},
      title = {SmartPhish: A Confidence-Gated Two-Tier Learning Framework for Latency-Aware Phishing Website Detection},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {3},
      pages = {4163-4172},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1723029.pdf},
      abstract = {Phishing is the most prevalent first-access point for credential theft and financial fraud on the Internet, and machine-learning detectors are the preferred defence. The accuracy figures reported in the literature, however, almost always come from feature vectors that tacitly assume that third-party infrastructure is always available: WHOIS registration databases, recursive DNS, TLS validators and search-engine index queries. These take hundreds of milliseconds per URL, disclose the browsing history of the user to outside parties, and do not work at all on a freshly registered phishing domain. This paper takes up a question that has received little attention in the literature on accuracy: how much of the reported accuracy actually requires the network? We provide an empirical answer on a public set of 88,647 labelled URLs described by 111 attributes, which we curate to 87,209 unique instances and 98 informative attributes. We first divide the feature space into 85 purely lexical attributes, computable from the URL string itself in 17.8 μs on a single core, and 13 external attributes, each requiring a query to a remote service. A comparative study of nine classifiers shows that histogram-based gradient boosting (HGB) is the best core learner, with an accuracy of 97.00%, an F1 score of 95.70% and an AUC of 99.56%. We then show that the lexical group alone reaches 93.50% accuracy while the external group alone reaches only 87.70%, and that the residual value of the external group is concentrated in a small set of hard-to-classify URLs that the system can identify in advance. We therefore propose a two-tier confidence-gated cascade in which a lexical-only model classifies every URL and a full-feature model is consulted only when the posterior of the lexical model falls inside an uncertainty band. Querying external services for only 19.72% of URLs, SmartPhish attains 96.60% accuracy and 95.10% F1 and cuts the expected end-to-end latency from 921 ms to 182 ms, a 5.1× improvement. All results are reproducible from public data and open-source software.},
      keywords = {cascade classifier, feature engineering, gradient boosting, latency-aware machine learning, Phishing detection, web security},
      month = {September},
      doi = {https://doi.org/10.64388/ire1723029}
  }