Issuu

AI-Based Phishing URL Detection By Using Machine Learning and NLP

B.Bharath Kumar Reddy¹, Dr K.Venkataramana²

¹Student, Department of MCA, KMM Institute of Post Graduate Studies, Tirupati, Andhra Pradesh, India

²Professor, Department of MCA, KMM Institute of Post Graduate Studies, Tirupati, Andhra Pradesh, India

Abstract - Phishing attacks represent one of the most pervasive and financially destructive cybersecurity threats in the modern digital landscape, exploiting fraudulent Uniform Resource Locators (URLs) designed to impersonate legitimate online services and harvest user credentials or deploy malware. Conventional defence mechanisms that rely on static blacklists maintained by security vendors are inherently reactive and are systematically incapable of intercepting novel, zero-day phishing campaigns. This paper presents the comprehensive design, implementation, and experimental evaluation of an AI-Based Phishing URL Detection System a full-stack, deployable web application employing a sophisticated hybrid, multi-stage analytical pipeline to classify any submitted URL as Safe, Suspicious, or Phishing in real time. The detection engine integrates four sequential analytical stages: (1) rule-based heuristic analysis of eight carefully engineered structural URL features with an additive penalty scoring model; (2) domain reputation scoring simulated on the behavioural response model of enterprise-grade external APIs including Google Safe Browsing and VirusTotal; (3) a homogeneous ensemble of three structural machine learning classifiers K-Nearest Neighbours (KNN), Support Vector Machine (SVM with RBF kernel), and Random Forest (RF with 100 estimators); and (4) a Natural Language Processing (NLP) model employing TF-IDF character n-gram encoding paired with a Logistic Regression classifier. A weighted linear aggregation formula combines all six sub-scores into a single, interpretable risk index R ∈ [0, 100]. Experimental evaluation on a curated, balanced labelled dataset of 105 URLs demonstrates the complementary nature of structural and lexical detection signals and validates the superiority of the weighted ensemble approach over any individual model component.

Key Words: Phishing Detection; URL Analysis; Machine Learning; Ensemble Classifier; Random Forest; Support Vector Machine; K-Nearest Neighbours; TF-IDF; Natural Language Processing; Cybersecurity; Risk Scoring; Python Flask; Scikitlearn; SQLite; Explainable AI.

1. INTRODUCTION

Therapidandpervasivemigrationoffinancial,commercial,healthcare,andsocialactivitytointernet-basedplatformshas fundamentallytransformedtherisklandscapeofdigitalsecurity.Amongthemostpersistentandoperationallydamagingattack modalitiesisphishing asocial-engineeringtechniqueinwhichmaliciousactorscraftfraudulentUniformResourceLocators (URLs) designed to visually and semantically impersonate trusted online entities such as banks, payment gateways, ecommerceplatforms,governmentportals,andsocial medianetworks.Theprimary objectiveofsuchattacksiscredential harvesting:deceivingvictimsintovoluntarilysubmittinglogincredentials,paymentcarddetails,orpersonallyidentifiable informationtoattacker-controlledinfrastructuredisguisedaslegitimateservices.

Thefinancialandsocietalscaleofphishingdamageissignificant.TheAnti-PhishingWorkingGroup(APWG)reportedthe detectionofover1.6millionuniquephishingsitesin2023,representingayear-on-yeargrowthtrendpersistingacrossthe precedingdecade[1].TheFBI'sInternetCrimeComplaintCenter(IC3)estimatesthatphishingandspoofingattacksresultedin lossesexceedingUSD52millionin2023intheUnitedStatesalone,withthetrueglobalfigurelikelyordersofmagnitudelarger [2].

TraditionalcountermeasuresagainstphishinghaveprimarilyreliedoncuratedblacklistsofknownmaliciousURLs,maintained bysecurityvendorsincludingGoogle,Microsoft,andSymantec.Whileoperationallyeffectiveforcataloguedthreats,blacklistbasedapproachesarefundamentallyreactive:anewlyregisteredphishingdomainisfullyoperationalforhoursordaysbefore identification,review,databaseupdate,andclient-sidedistributioniscomplete.Modern,sophisticatedphishingcampaigns systematicallyexploitthistemporalgap oftencalledthe"detectionwindow" byregisteringlargevolumesofdisposable domainsandcyclingtonewinfrastructurebeforeblacklistupdatestakeeffect.

ThispaperpresentsanAI-BasedPhishingURLDetectionSystemthataddressestheselimitationsthroughacomprehensive hybridpipelineaggregating evidencefromsixindependentlyderivedsignal sources: structural URL heuristics,simulated domainreputationintelligence,andfourmachinelearningclassifiersspanningbothfeature-engineeredstructuralmodelsand character-levelNLPmodels.Thespecificcontributionsofthisworkareasfollows:

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

• Hybrid pipeline: A multi-stage detection pipeline combining rule-based heuristics, reputation intelligence, three structural ML classifiers (KNN, SVM, Random Forest), and a TF-IDF character n-gram NLP classifier into a weighted ensemblewithinterpretableper-signalscorebreakdown.

• Weighted risk formula: A novel weighted linear aggregation formula combining six sub-scores with empirically motivatedweights,assigninghighestinfluencetoheuristics(20%)andNLP(20%)whiledistributingsupportingevidence acrossstructuralmodelsandreputationdata.

• Full-stack deployment: Acompletethree-tierwebapplication HTML5/CSS3frontend,PythonFlaskRESTAPIbackend, SQLitepersistence providingreal-timeURLscanningaccessiblethroughanymodernbrowserwithoutinfrastructure dependencies.

• Explainable outputs: Every classification decision is accompanied by a per-signal score breakdown and textual explanation,enablingsecurityanalyststoauditthebasisofeachverdict.

• Comprehensive evaluation: Experimentalanalysisonacurated105-URLdatasetcoveringdiversesafeandphishing attackpatterncategories,withindividualmodelaccuracyreportingandensemblebehaviouranalysis.

1.1 RELATED WORK

TheproblemofautomatedphishingURLdetectionhasattractedconsiderableandsustainedacademicattentionoverthepast two decades, producing a rich body of literature spanning rule-based, statistical, machine learning, and deep learning methodologies.

A. Heuristic and Rule-Based Approaches

TheearliestsystematicapproachestoautomatedphishingURLdetectionemployedhand-craftedrulesetsderivedfromthe empiricalobservationofstructuraldeviationsbetweenlegitimateandphishingURLs.Gareraetal.[3]proposedoneofthe foundational rule-based frameworks, introducing a logistic regression classifier trained on features including domain registrationage,thepresenceofIPaddressesashostnames,URLlength,andspecialcharacterusage.Maetal.[4]conducteda comprehensivestudyoflexicalandhost-basedfeatures,demonstratingthatstatisticalclassifierstrainedonfeaturesderived purely from URL strings could achieve competitive detection performance. Whittaker et al. [5] described the design and operationaldeploymentofGoogle'sSafeBrowsinginfrastructure,providingempiricalinsightintothescaleandrateofphishing URLemergence.

B. Machine Learning on Structural Features

Thegrowingavailabilityoflarge-scalelabelledphishingURLdatasetsenabledsystematicempiricalevaluationofsupervised machinelearningalgorithms.Mohammadetal.[6]conductedabenchmarkevaluationofseventeenclassificationalgorithmson 11,055URLsfromtheUCIMLRepositoryPhishingDataset,findingthatensemblemethodsandneuralnetworksconsistently outperformedsimplerclassifiers,withRandomForestandMulti-LayerPerceptronachievingthehighestbalancedaccuracy. Sahingozetal.[7]conductedaparticularlythoroughcomparativeanalysisofsevenmachinelearningalgorithms,consistently identifyingRandomForestasthehighest-performingclassifier,achievingaccuracyexceeding97.98%onthecombinedfeature set.JainandGupta[9]foundthatlexicalURLfeaturesaloneprovideastrongclassificationbaseline,supportingthepresent system'sURL-onlyanalyticalscope.

C. Natural Language Processing and Text-Based Methods

A parallel research thread has explored the exploitation of the raw URL string as a character sequence amenable to text classification techniques. Mamun et al. [11] demonstrated that character-level n-gram language models could achieve competitive phishing URL detection accuracy using only the URL string. Le et al. [12] proposed URLNet, a deep neural architecture that jointly learns character-level and word-level embeddings from URL strings using convolutional neural networks,achievingstate-of-the-artperformance.SaxeandBerlin[13]demonstratedthatcharactern-gramTF-IDFmodels paired with simple linear classifiers provide a computationally practical approximation of deep learning performance, competitiveonmoderate-scaledatasetswhilerequiringonlyCPUinference.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

IV. METHODOLOGY

Thephishingdetectionpipelinecomprisesfoursequentialanalyticalstages,eachproducinganumericrisksub-scoreonthe normalisedscale[0,100].Thesesub-scoresaresubsequentlycombinedinafifthstage theweightedriskscoreaggregation toyieldasingle,interpretableoverallriskindexRthatdrivesthefinalclassificationdecision.

Stage 1: URL Preprocessing and Feature Extraction

AllURLssubmittedforanalysisarefirstpassedthroughapreprocessingstep.ThepreprocessedURLisparsedusingPython's urllib.parse.urlparse()function,whichdecomposestheURLintoitsconstituentcomponents:scheme,netloc(domain/host), path,querystring,andfragment.Eightstructuralfeaturesareextracted:

• url_length: ThetotalcharactercountofthecompleteURLstring.ExcessivelylongURLsarestatisticallyassociatedwith phishingattemptsthatembedlongrandomsubdomainstringsorpathcomponentstoobscurethetruehost.

• num_dots: Thecountofdotcharacters(".")withinthenetloccomponent.Ahighdotcountisindicativeofdeepsubdomain structuresusedtoembedlegitimate-lookingbrandnamesinsubdomainprefixes.

• num_subdomains: Anestimatedcountofthenumberofsubdomainlevels,computedasmax(0,num_dots-1)fornon-IP hosts.

• has_at_symbol: Abooleanindicatorforthepresenceofthe'@'characteranywhereintheURLstring,whichbrowsers discardallURLcontentpreceding.

• is_ip_address: AbooleanindicatorforwhetherthehostcomponentisarawIPv4address.Legitimateconsumer-facing servicesvirtuallyneverexposerawIPaddressesasURLhosts.

• has_https: AbooleanindicatorforwhethertheURLemploystheHTTPSscheme.

• keyword_matches: Matchedentriesfroma10-termhigh-riskvocabulary:{login,verify,update,secure,account,bank, paypal,support,service,auth}.

• pattern_matches: Matchedentriesfromfivecompoundregularexpressionpatternsencodingknownmulti-wordphishing constructs.

Stage 2: Heuristic Risk Scoring

Thecalculate_heuristic_score()function computesa structural heuristicrisk score Hon the scale[0, 100] by applying an additivepenaltymodel.Eachfeatureexhibitingaphishing-indicativevaluetriggersapredeterminedpenaltycontribution,and thecumulativesumisclampedtoamaximumof100.

TABLE IV. Heuristic Penalty Schedule (Ceiling: 100)

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

Stage 3: Domain Reputation Scoring

Thecheck_domain_reputation()functionprovidesthedomainreputationsignalforthepipeline.Inaproductiondeployment, thisfunctionwouldissueauthenticatedHTTPrequeststoenterprisethreatintelligenceservices:theGoogleSafeBrowsing LookupAPIv4andtheVirusTotalURLscanningAPIv3.Inthecurrentprototypeimplementation,thefunctionprovidesahighfidelitybehaviouralsimulationoperatingthroughthreedecisionbranches:(1)Whitelistoverridefor60globallyrecognized reputable domains; (2) High-risk pattern detection for known brand impersonation patterns; and (3) Unknown domain handlingwithascoresampledfrom[0,10].

Stage 4: Machine Learning Ensemble

Themachinelearningcomponentconsistsoffourindependentlytrainedmodels,eachcontributingaphishingprobabilityscore totheensemble.Allmodelsaretrainedofflineviathemodel_trainer.pyscript,whichgeneratesthetrainingcorpus,fitseach model,andserialisesalltrainedartifacts.Thetrainingcorpuscomprises70safeURLsand35phishingseedURLs,tiled20times toyield1,400traininginstances,withan80/20train-testsplitappliedforreproducibility.

KNN(k=5):Anon-parametric,instance-basedlearningalgorithmclassifyingquerypointsbymajorityvoteamongknearest traininginstancesusingEuclideandistanceinthestandardisedfeaturespace.

SVM(RBFkernel,C=1.0):Seeksamaximum-marginseparatinghyperplaneinahigh-dimensionalkernel-inducedfeaturespace. ProbabilityestimatesareenabledviaPlattscaling.

RandomForest(100estimators):Abaggedensembleof100CARTdecisiontrees,eachtrainedonabootstrappedsample.The phishingprobabilityestimateisobtainedbyaveragingper-treeclassprobabilityvectorsacrossall100trees.

NLPModel(TF-IDF+LogisticRegression):TreatseachrawURLstringasacharactersequenceencodedasahigh-dimensional sparseTF-IDFfeaturevectorusingcharactertrigramsthroughpentagrams(ngram_range=(3,5)),capturingsubwordlexical patternsstronglyassociatedwithphishingURLs.

Stage 5: Weighted Risk Score Aggregation

Thesixsub-scoresproducedbytheprecedingpipelinestagesarecombinedintoa singleoverallriskindexRthroughthe followingweightedlinearaggregationformula:

R = 0.20·H + 0.15·D + 0.15·K + 0.15·S + 0.15·F + 0.20·N

H=Heuristics D=Reputation K=KNN S=SVM F=RF N=NLP

The aggregated score R is clamped to the interval [0, 100] and mapped to a three-class classification label according to empiricallycalibratedthresholds:0-30=Safe(greengauge),31-70=Suspicious(ambergauge;cautionadvised),71-100= Phishing(redgauge;audibleWebAudioAPIalerttriggered).

TABLE V. Risk Score Classification Thresholds and System Responses

0-30 Safe Greengauge;URLconsideredoperationallysafeforaccess

31-70 Suspicious Ambergauge;cautionadvised;independentverification recommended

71-100 Phishing Redgauge;audibleWebAudioAPIalerttriggered;URLaccess stronglycontra-indicated

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

A. Experimental Setup

AllmodeltrainingandevaluationwasconductedonastandarddevelopmentworkstationrunningPython3.11withscikit-learn 1.3,NumPy1.25,Pandas2.0,andJoblib1.3.NoGPUresourceswererequiredforanycomponentofthetrainingorinference pipeline. Training time for all four models combined on the 1,120-instance (80%) training split is under 5 seconds on a contemporaryCPU,andallmodelartifactscombinedoccupyapproximately710KBofdiskstorage.

B. Dataset Composition

Thecompletelabelleddatasetcomprises70safeURLsand35phishingURLs.Aftertilingbothsets20times,theeffective datasetcontains2,100instances(1,400safe+700phishing,maintainingtheoriginal2:1classratio).The80/20stratifiedtraintestsplityields1,680traininginstancesand420testinstances.

TABLE VI. Dataset Composition by Category

Individual

Model Performance

TableVIIreportstheclassificationaccuracyofeachmodelontheheld-out20%testsplit(420instances:280safe, 140phishing).Theconsistentlyhighaccuracyvaluesreflectthestructuredandwell-separatednatureofthecurated dataset.RandomForestachievesthehigheststructuralfeatureaccuracy(≥0.97),consistentwithitsdominantperformancein theexistingphishingURLdetectionliterature.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

TABLE VII. Individual Model Test Accuracy on 20% Split

KNN(k=5)

8structural(scaled) ≥0.95

SVM(RBF) 8structural(scaled) ≥0.95

RandomForest 8structural(scaled) ≥0.97

(TF-IDF+LR)

Future Development Directions

Strongonwell-separatedclusters; sensitivetofeaturescale

Robustmargin;effectivefornon-linear decisionsurfaces

Higheststructuralaccuracy;low varianceviaensembleaveraging

Captureslexicalsignalsabsentfrom structuralfeatures

1. Livethreatintelligenceintegration:Replacethesimulatedreputationmodulewithauthenticatedreal-timeAPIcallsto GoogleSafeBrowsingLookupAPIv4andVirusTotalURLscanningAPIv3.

2. Featuresetexpansion:AugmentthefeaturevectorwithDNS-basedfeatures,SSL/TLScertificatefeatures,URLentropy metrics,brandsimilarityscores,andWHOISdomainregistrationage.

3. Large-scalebenchmarkevaluation:EvaluateallfourmodelsandtheensembleonthePhiUSIILPhishingURLDataset (235,000+entries)andtheISCX-URL2016dataset(36,400entries).

4. Deeplearningmodelintegration:EvaluateCharacter-levelCNN(URLNetarchitecture)andBERT-basedURLsequence encodersasadditionalNLPensemblecomponents.

5. Browserextensiondeployment:DevelopaChrome/Firefoxbrowserextensionthatpassivelyinterceptsnavigationevents andasynchronouslysubmitseachURLtothe/scanAPIendpoint.

6. Meta-learnerweightoptimisation:Replacefixedensembleweightswithatrainedmeta-learner(stackingensemble)that learnsoptimalper-signalweightsfromaheld-outvalidationset.

VII. CONCLUSION

Thispaperhaspresentedthecomprehensivedesign,implementation,andevaluationofanAI-BasedPhishingURLDetection System a deployable,full-stackwebapplicationthataddresses thefundamentallimitationsofblacklist-basedphishing defencesthroughaprincipledmulti-signalhybriddetectionpipeline.Thesystem'scorecontributionisitsweightedensemble architecture,whichaggregatessixindependentlyderivedrisksignals:rule-basedURLheuristicsencodingempiricalphishing structuralindicators;simulateddomainreputationintelligencemodelledonenterprisethreatAPIs;threestructuralmachine learningclassifiers(K-NearestNeighbours,SupportVectorMachine,andRandomForest)trainedonengineeredURLfeature vectors;andacharacter-levelTF-IDFNaturalLanguageProcessingclassifiertrainedonrawURLstrings.

The weighted linear aggregation formula, with its transparent per-signal score breakdown returned alongside every classificationdecision,operationalisestheexplainableAIprinciplesincreasinglyrecognisedasessentialfortheresponsible deploymentofmachinelearningsystemsinhigh-stakescybersecuritycontexts.Thefull-stackapplicationarchitecturedelivers acomplete,self-containedsecuritytooldeployableonanymachinewithaPythonruntime,withoutexternalinfrastructure dependencies.Thecuratedlabelleddatasetof105URLsdemonstratesthepipeline'sdiscriminativecapability,withRandom Forestachievingstructuralclassificationaccuracy≥0.97andtheNLPmodelprovidingcomplementarylexicalsignalcoverage.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

REFERENCES

[1]Anti-PhishingWorkingGroup(APWG),"PhishingActivityTrendsReport Annual Summary2023," APWGTechnical Report,2024.[Online].Available:https://apwg.org/trendsreports/

[2]FederalBureauofInvestigation(FBI),"2023InternetCrimeReport,"InternetCrimeComplaintCenter(IC3),2024.[Online]. Available:https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf

[3]S.Garera,N.Provos,M.Chew,andA.D.Rubin,"Aframeworkfordetectionandmeasurementofphishingattacks,"inProc. 2007ACMWorkshoponRecurringMalcode(WORM'07),Fairfax,VA,USA,2007,pp.1-8.doi:10.1145/1314389.1314391

[4]J.Ma,L.K.Saul,S.Savage,andG.M.Voelker,"Beyondblacklists:Learningtodetectmaliciouswebsitesfromsuspicious URLs,"inProc.15thACMSIGKDDInt.Conf.KnowledgeDiscoveryandDataMining(KDD'09),Paris,France,2009,pp. 1245-1254.

[5]C.Whittaker,B.Ryner,andM.Nazif,"Large-scaleautomaticclassificationofphishingpages,"inProc.NDSS2010,SanDiego, CA,USA,2010.

[6]R.M.Mohammad,F.Thabtah,andL.McCluskey,"Predictingphishingwebsitesbasedonself-structuringneuralnetwork," NeuralComputingandApplications,vol.25,no.2,pp.443-458,Aug.2014.

[7]O.K.Sahingoz,E.Buber,O.Demir,andB.Diri,"MachinelearningbasedphishingdetectionfromURLs,"ExpertSystemswith Applications,vol.117,pp.345-357,Mar.2019.

[8]N.Abdelhamid,A.Ayesh,andF.Thabtah,"Phishingdetectionbasedassociativeclassificationdatamining,"ExpertSystems withApplications,vol.41,no.13,pp.5948-5959,Oct.2014.

[9]A.K.JainandB.B.Gupta,"Towardsdetectionofphishingwebsitesonclient-sideusingmachinelearningbasedapproach," TelecommunicationSystems,vol.68,no.4,pp.687-700,Aug.2018.

[10]H.Shirazi,B.Bezawada,I.Ray,andC.Anderson,"Kn0wthydoma1nname:Unbiasedphishingdetectionusingdomain namebasedfeatures,"inProc.23rdACMSACMAT'18,Indianapolis,IN,USA,2018,pp.69-75.

[11]M.S.I.Mamunetal.,"DetectingmaliciousURLsusinglexicalanalysis,"inProc.NSS2016,Taipei,Taiwan,Springer,2016, pp.467-482.

[12]H.Le,Q.Pham,D.Sahoo,andS.C.H.Hoi,"URLNet:LearningaURLrepresentationwithdeeplearningformaliciousURL detection,"arXivpreprintarXiv:1802.03162,Feb.2018.

[13]J.SaxeandK.Berlin,"eXpose:Acharacter-levelconvolutionalneuralnetworkwithembeddingsfordetectingmalicious URLs,filepathsandregistrykeys,"arXivpreprintarXiv:1702.08568,Feb.2017.

[14]B.Yu,D.L.Gray,J.Pan,M.DeCock,andA.Nascimento,"InlineDGAdetectionwithdeepnetworks,"inProc.IEEEICDM Workshops,NewOrleans,LA,USA,2017,pp.683-692.

[15]F.Tajaddodianfar,J.W.Stokes,andA.Gururajan,"Texception:Acharacter/word-leveldeeplearningmodelforphishing URLdetection,"inProc.IEEEICASSP,Toronto,Canada,2020,pp.2857-2861.

[16]T.Huang,K.Xiong,andZ.Zhang,"Phishbench:Abenchmarkingframeworkforclassifiersandfeaturesusedinphishing detection,"inProc.ACMCCSAISecWorkshop,London,UK,2019,pp.1-11.

[17]M.ZouinaandB.Outtaj,"AnovellightweightURLphishingdetectionsystemusingSVMandsimilarityindex,"HumancentricComputingandInformationSciences,vol.7,no.1,pp.1-13,Dec.2017.

[18]R.S.RaoandA.R.Pais,"Detectionofphishingwebsitesusinganefficientfeature-basedmachinelearningframework," NeuralComputingandApplications,vol.31,no.8,pp.3851-3873,Aug.2019.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 04 | Apr 2026 www.irjet.net p-ISSN: 2395-0072

[19]D.GunningandD.Aha,"DARPA'sexplainableartificialintelligence(XAI)program,"AIMagazine,vol.40,no.2,pp.44-58, Jun.2019.

[20]GoogleLLC,"GoogleSafeBrowsingAPIv4-DeveloperDocumentation,"GoogleDevelopers,2024.[Online].Available: https://developers.google.com/safe-browsing

[21] VirusTotal, "VirusTotal API v3 Reference Documentation," VirusTotal, 2024. [Online]. Available: https://developers.virustotal.com/reference

[22]F.Pedregosaetal.,"Scikit-learn:MachinelearninginPython,"JournalofMachineLearningResearch,vol.12,pp.28252830,Oct.2011.