The Answer is in the Text: Multi-Stage Methods for Phishing Detection Based on Feature Engineering

Detecting phishing websites is a rapidly evolving field aimed at identifying and mitigating cyberattacks targeting individuals, organizations, and governments. Ongoing progress in artificial intelligence (AI) has the potential to revolutionize phishing detection by enhancing model accuracy and improving transparency through eXplainable AI (XAI). However, significant challenges remain, particularly in integrating feature engineering with XAI to address sophisticated phishing strategies including zero-day attacks, that evade traditional detection mechanisms. To overcome these challenges, this examines the impact of feature engineering and XAI in phishing detection, emphasizing their ability to enhance accuracy while providing interpretability. By integrating feature extraction with interpretable models, these techniques improve decision-making transparency and system robustness. This paper presents the first systematic literature review (SLR) focusing on the impact of feature engineering and XAI on state-of-the-art phishing detection approaches. Additionally, it identifies critical research gaps and challenges, including scalability issues, the evolution of phishing techniques, and balancing complexity with interpretability. The findings provide valuable academic insights while offering practical recommendations for developing accurate and interpretable phishing detection systems, aiding organizations in strengthening cybersecurity measures.

Due to the onset of the pandemic in previous years, industries have shifted to the use of digitalized services. Since most transactions were done online, people have become more susceptible to phishing attacks. With this, a steady rise in phishing attacks has been observed. Though cybersecurity awareness can help counter phishing attacks, improvement of existing phishing detection approaches remains desirable. Evolution of phishing websites is inevitable as phishers persist in bypassing current phishing detection approaches. This study then suggests a phishing detection model that makes use of URL-based features to detect phishing websites. Models were developed using two well-known classifiers, XGBoost and Random Forest. XGBoost classifier demonstrated the most promising performance with an accuracy of 96.51% and a kappa of 0.930.

Phishing is an attempt by an individual or a group of person to steal personal information such as password, banking account and credit card information, etc. Most of these phishing web pages look similar to the real web pages in terms of website interface and uniform resource locator (URL) address. Many techniques have been proposed to detect phishing websites, such as Blacklist-based technique, Heuristic-based technique, etc. However, these techniques are still inefficient. While Blacklist-based techniques cannot detect the phishing sites that are not in the blacklist database, the weights of the heuristic in the heuristic-based approach significantly depend on the statistics from the training dataset. Therefore, a new phishing detection approach in which either the new phishing websites can be detected or the weights of the heuristic are derived objectively is necessary. In this paper, an efficient approach for detecting phishing websites based on the single-layer neural network is proposed. Specifically, the proposed technique calculates the value of heuristics objectively. Then, the weights of heuristic are generated by a single-layer neural network. The proposed technique is evaluated with a dataset of 11,660 phishing sites and 10,000 legitimate sites. The results show that the technique can detect over 98% phishing sites.

With increasing technology developments, there is a massive number of websites with varying purposes. But a particular type exists within this large collection, the so-called phishing sites which aim to deceive their users. The main challenge in detecting phishing websites is discovering the techniques that have been used. Where phishers are continually improving their strategies and creating web pages that can protect themselves against many forms of detection methods. Therefore, it is very necessary to develop reliable, active and contemporary methods of phishing detection to combat the adaptive techniques used by phishers. In this paper, different phishing detection approaches are reviewed by classifying them into three main groups. Then, the proposed model is presented in two stages. In the first stage, different machine learning algorithms are applied to validate the chosen dataset and applying features selection methods on it. Thus, the best accuracy was achieved by utilizing only 20 features out of 48 features combined with Random Forest is 98.11%. While in the second stage, the same dataset is applied to various fuzzy logic algorithms. As well the experimental results from the application of Fuzzy logic algorithms were incredible. Where in applying the FURIA algorithm with only five features the accuracy rate was 99.98%. Finally, comparison and discussion of the results between applying machine learning algorithms and fuzzy logic algorithms is done. Where the performance of using fuzzy logic algorithms exceeds the use of machine learning algorithms.

Accurate and reliable lithological mapping through satellite-borne remote sensing data and image classification approaches has a critical role since it can automatically and promptly identify lithological units over large areas. Most available Pixel-Object Based comparative classification studies have been applied to land use land cover (LULC) studies; however, this research aims to evaluate and compare the performance of these digital classification methods in the field of geological mapping in semi-arid areas, by integrating spectral bands and neo-bands, particularly the Minimum noise fraction (MNF) and the principal component analysis (PCA), of Sentinel-2A satellite imagery, to map the southern of Skhour Rehamna which is located at the western Moroccan Meseta. The analysis results from two different methods, namely, pixel-based image analysis (PBIA) with k-nearest neighbour (K-NN) and Random Forest (RF) machine learning algorithms (MLAs), and Geographic Object-Based Image Analysis (GEOBIA) were assessed and compared. PBIA method involved selection of training areas whether it was k-NN or RF MLAs, and produced lithological maps that exhibit “salt and pepper” effects as well as problems associated to delineating accurate lithological boundaries, while GEOBIA approach involved multi-resolution segmentation step where scale, shape and compactness parameters should be adjusted as accurate as possible, in order to segment the image into homogeneous and meaningful regions so that the resulted samples were classified using Standard Nearest Neighbour algorithm. Therefore, the resulting lithological maps were assessed by comparing both techniques using confusion matrix, overall accuracy (OA) and Kappa coefficient (K). The results show that the GEOBIA approach had higher overall agreement (83.46% OA and 0.76 K) than RF (81.92% OA and 0.72 K) and k-NN (80.79% OA and 0.70 K) PBIA approaches. Overall, the results clearly indicate the potential of GEOBIA technique for lithological mapping applications to produce more realistic maps.

In the era of digitalization, electronic gadgets such as Google Translate, Siri, and Alexa have at least one characteristic: They are all the products of natural language processing (NLP). “Natural Language” refers to a human language used for daily communication, such as English, Hindi, Bengali, etc. Natural languages, as opposed to artificial languages such as computer languages and mathematical nomenclature, have evolved as they have been transmitted from generation to generation and are challenging to explain with clear limits in the first instance. In natural language processing, artificial intelligence (Singh et al., 2021), linguistics, information processing, and cognitive science are all related fields (NLP). NLP aims to use intelligent computer techniques to process human language. However, NLP technologies such as voice recognition, language comprehension, and machine translation exist. With such limited obvious exclusions, machine learning algorithms in NLP sometimes lacked sufficient capacity to consume massive amounts of training data. In addition, the algorithms, techniques, and infrastructural facilities lack enough strength. Humans design features in traditional machine learning, and feature engineering is a limitation that requires significant human expertise. Simultaneously, the accompanying superficial algorithms lack depiction capability and, as a result, the ability to generate layers of duplicatable concepts that would naturally separate intricate aspects in forming visible linguistic data. Deep learning overcomes the challenges mentioned earlier by using deep, layered modelling architectures, often using neural networks and the corresponding full-stack learning methods. Deep learning has recently enhanced natural language processing by using artificial neural networks based on biological brain systems and Backpropagation. Deep learning approaches that use several processing layers to develop hierarchy data representations have produced cutting-edge results in various areas. This chapter introduces natural language processing (NLP) as an AI component. The history of NLP is next. Distributed language representations are the core of NLP's profound learning revolution. After the survey, the boundaries of deep learning for NLP are investigated. The paper proposes five NLP scientific fields.

Phishing attacks are considered to be one of the most widespread cybersecurity threats, and attackers are becoming more successful by using advances in the field of artificial intelligence and natural language generation, in order to deceive consumers via email, SMS, and web. The existing rule-based and heuristic methods of detection cannot keep up with these dynamic and context-sensitive attacks, hence a high false-negative rate. The given work carries out a critical evaluation of the methods of artificial intelligence (AI), natural language processing (NLP)-based phishing detection, and concentrates on the deep learning, explainable artificial intelligence (XAI) methods. It was selected using IEEE Xplore, Scopus, Web of Science, ACM Digital Library, and ScienceDirect according to the PRISMA guidelines and 45 primary studies published between 2017 and 2025. This paper discusses preprocessing techniques, feature extraction techniques, machine learning, deep learning architectures, hybrid detection models, and explainability mechanisms of phishing detection. The findings indicate that hybrid systems incorporating convolutional neural networks, recurrent models, and transformer-based embeddings are able to perform better than traditional classifiers and are able to achieve over 95% accuracy when using various communication channels. Nevertheless, the majority of high-performing models remain opaque and, therefore, cannot be used in controlled cases. This research reveals the following gaps in research: poor cross-platform generalization, inadequate semantic resistance to paraphrased phishing messages, and a lack of explainability incorporation. The article gives a systematic overview of the current methodologies and gives future research directions in explainable, scalable, and adaptable phishing detection systems.

Phishing attacks are a persistent cybersecurity threat, exploiting human vulnerabilities via deceptive emails and malicious URLs. This project introduces a novel Reinforcement Learning (RL)-based system to automate phishing detection and response. By employing advanced RL algorithms, such as Deep Q-Learning and Policy Gradient methods, the system dynamically learns to identify phishing indicators within email content and URLs through Natural Language Processing (NLP) and feature extraction techniques. The RL agent continuously adapts its detection strategies based on evolving threats and user feedback, aiming to minimize false positives while accurately identifying malicious activities. Upon detecting potential threats, the system initiates automated responses, including alert notifications, URL blocking, and user warnings, thereby enhancing security measures. Implementing this RL-based solution within Security Operations Centers (SOCs) or email security platforms offers a scalable, real-time defense against phishing attacks. This approach effectively safeguards sensitive information and strengthens organizational resilience against cyber threats.

Phishing websites are still a major threat in today's Internet ecosystem. Despite numerous previous efforts, similarity-based detection methods do not offer sufficient protection for the trusted websites, in particular against unseen phishing pages. This paper contributes VisualPhishNet, a new similarity-based phishing detection framework, based on a triplet Convolutional Neural Network (CNN). VisualPhishNet learns profiles for websites in order to detect phishing websites by a similarity metric that can generalize to pages with new visual appearances. We furthermore present VisualPhish, the largest dataset to date that facilitates visual phishing detection in an ecologically valid manner. We show that our method outperforms previous visual similarity phishing detection approaches by a large margin while being robust against a range of evasion attacks.

Kernels are widely used in Natural Language Processing as similarity measures within inner-product based learning methods like the Support Vector Machine. The Vector Space Model (VSM) is extensively used for the spatial representation of the documents. However, it is purely a statistical representation. In this paper, we present a Concept Vector Space Model (CVSM) representation which uses linguistic prior knowledge to capture the meanings of the documents. We also propose a linear kernel and a latent kernel for this space. The linear kernel takes advantage of the linguistic concepts whereas the latent kernel combines statistical and linguistic concepts. Indeed, the latter kernel uses latent concepts extracted by the Latent Semantic Analysis (LSA) in the CVSM. The kernels were evaluated on a text categorization task in the biomedical domain. The Ohsumed corpus, well known for being difficult to categorize, was used. The results have shown that the CVSM improves performance compared to the VSM.

The detection and identification of Distributed Denial-of-Service (DDoS) attacks remains a challenge in cloud/edge/fog computing environments. It usually requires network middleboxes, such as deep packet inspectors (DPI), for detection task mostly. But clouds and fogs have native powerful telemetry systems that are not yet fully exploited for DDoS detection; and provide so much information that could aid attack identification tasks as well. Machine Learning (ML) algorithms can help one diving into the richness of cloud’s native data collection services, which have a multitude of metrics from both physical and virtual hosts. This paper evaluates the use of ML algorithms over datasets collected from a experimental testbed based on OpenStack. Controlled attack scenarios were used to investigate the ability of ML for tasks such as detecting and identifying SYN_Flood and GET_Flood DDoS attacks mixed, in different proportions, with legitimate clients. kNN and Random Forest ML algorithms were trained and tested, and for evaluation the metrics accuracy, recall, precision, and F1-score were used. Our experiments presented about 87% of accuracy in the detection of SYN_Flood and GET_Flood DDoS attacks, whereas Snort IDS mostly fails to detect the latter attack by processing the corresponding packet traces. Also, the detection of PING_Flood DDoS attack was tested without training as an initial evaluation towards the generalization of the proposal.

QuantNet is an integrated web-based environment consisting of different types of statistics-related documents and program codes. Its goal is creating reproducibility and offering a platform for sharing validated knowledge native to the social web. To increase the information retrieval (IR) efficiency there is a need for incorporating semantic information. Three text mining models will be examined: vector space model (VSM), generalized VSM (GVSM) and latent semantic analysis (LSA). The LSA has been successfully used for IR purposes as a technique for capturing semantic relations between terms and inserting them into the similarity measure between documents. Our results show that different model configurations allow adapted similarity-based document clustering and knowledge discovery. In particular, different LSA configurations together with hierarchical clustering reveal good results under M3 evaluation. QuantNet and the corresponding Data-Driven Documents (D3) based visualization can be found and applied under quantlet. The driving technology behind it is Q3-D3-LSA, which is the combination of “GitHub API based QuantNet Mining infrastructure in R”, LSA and D3 implementation.

Phishing scams are internet frauds that target people by sending them harmful links. Many victims ranging from individuals to big companies, have suffered numerous losses due to phishing, highlighting the increasing need to effectively detect and prevent a phishing attack as soon as it is received. This paper applied machine and deep learning models to detect phishing attacks by natural language processing of Uniform Resource Locators. Machine learning algorithms such as Logistic Regression and Multi-Naive Bayes were used Uniform Resource Locators for classification of legitimate and phishing. Additionally, Long Term Short Memory, Gated Recurrent Units, and Bidirectional Recurrent Neural Networks were used as Deep Learning models. Two of the used models are Long Term Short Memory and Gated Recurrent Units models possess significantly high training and validation scores with an overall accuracy of 95%. The Bidirectional Recurrent Neural Net using Gated Recurrent Units and Bidirectional Recurrent Neural Net using LTSM shows 97% accuracy. Therefore, using multiple deep learning models to predict whether URLs are phishing or legitimate is a significant assistance in reviewing websites. Further research for other parameters aside from using Uniform Resource Locators with different deep learning models can be used to improve the accuracy of phishing detection.

In today’s digital world, phishing attacks have become one of the most serious cybersecurity threats. Cybercriminals use fake emails, messages, and websites to trick users into sharing sensitive information such as passwords, bank details, and personal data. Traditional phishing detection methods are often unable to detect advanced and evolving attacks effectively. Artificial Intelligence (AI) combined with Natural Language Processing (NLP) provides a powerful solution to detect phishing attacks. NLP helps in analyzing the textual content of emails and messages to identify suspicious patterns, keywords, and malicious intent. AI models such as machine learning and deep learning improve detection accuracy by learning from large datasets. This research paper focuses on the use of AI and NLP techniques for phishing detection. It explains the working process, methodologies, advantages, and challenges of implementing such systems. The study also highlights how these technologies can improve cybersecurity and protect users from online fraud. KEYWORDS Phishing Detection, Artificial Intelligence (AI), Natural Language Processing (NLP), Machine Learning, Cybersecurity, Email Filtering, Text Classification

<p>The presence of subglacial sediments is important in enabling streaming ice flow and may be a critical controlling factor in determining the onset regions of ice streams. Improving our knowledge of the location of sedimentary basins underlying large ice sheets will improve our understanding of how the substrate influences the ice streams.  Advancing our understanding of the interaction between subglacial sediments and ice flow is critical for predictions of ice sheet behavior and the consequences on future climate change. To date, no comprehensive distribution of onshore and offshore sedimentary basins over Antarctica has been developed. The goal of this project is to use a combination of large-scale datasets to characterize known basins and identify new sedimentary basins to produce a continent-wide mapping of sedimentary basins and provide improved basal parametrizations conditions that have the potential to support more realistic ice sheet models. The proposed work is divided into three main steps. In the first step, the Random Forest (RF), a supervised machine learning algorithm, is used to identify sedimentary basins in Antarctica. In the second step, a regression analyses between aerogravity data and topography is done to evaluate the gravity signal related to superficial heterogeneities (i.e. sediments) and compare the results to the depth of magnetic sources using the Werner deconvolution method. Last, the correlation between sedimentary basins and ice streams is investigated. Here, we will present the preliminary results from Step 1. The Random Forest uses ensemble learning method for classification and regression. The classification rules for this present work are based on the geophysical parameters of major known sedimentary basins. First we classify the known basins with all available geophysical compilations including topography, gravity and magnetic anomalies, sedimentary thickness, crustal thickness, geothermal heat flux, information on the geology, rocky type and bedrock geochemistry, and then use the Random Forest machine learning algorithm to classify the geology underneath the ice into consolidated rock and sediments based on these parameters.</p>