Phishing URL Detection Using Deep Learning: A Resilient Approach to Mitigating Emerging Cybersecurity Threats

In the digital landscape, phishing has become one of the most pervasive and rapidly evolving cyber threats, targeting individuals and organizations worldwide. According to the APWG Phishing Activity Trends Report, over 1,077,501 phishing attacks were recorded in Q4 2023, marking a continuous surge in these malicious activities and underscoring the urgency for robust detection mechanisms [1, 2]. As attackers develop increasingly deceptive tactics, traditional security measures often fail to keep pace, necessitating advanced, AI-driven solutions [3-5].

Phishing is a social engineering attack in which cybercriminals use fraudulent communication channels, such as emails, SMS (smishing), or phone calls (vishing), to deceive victims into revealing sensitive credentials or installing malware. Among these, phishing via URLs has become particularly concerning, as attackers craft deceptive web links that mimic legitimate domains, exploiting human cognitive biases and URL mis-interpretation vulnerabilities [6-8]. These attacks leverage typo squatting, homoglyph substitutions, and domain spoofing techniques to evade detection, making them increasingly difficult to identify with conventional methods.

Existing phishing detection approaches fall into two primary categories: heuristic based techniques and machine learning (ML)-based models [9]. Heuristic approaches rely on manually defined rules, such as blacklist databases and URL pattern matching, but they struggle to detect newly crafted phishing URLs [10]. Machine learning-based methods, on the other hand, require extensive feature engineering, where human experts define characteristics such as domain age, URL length, and lexical patterns to train classification models [11-13]. But these methods are sometimes con-strained by their reliance on domain-specific knowledge and their incapacity to dynamically change assault tactics [14-16].

To address these limitations, this research suggests using deep learning to handle raw URLs without the need for manually created characteristics. Particularly, we pro-vide a hybrid architecture that integrates character-level embeddings with a parallel Convolutional Neural Network (CNN) and a Bidirectional Gated Recurrent Unit (BiGRU) for improved sequential learning and feature representation.

Character-level embedding is a method whereby each character is considered as an atomic unit of information, hence transforming raw URLs into dense numerical representations [17]. Otherwise, word-based embeddings, which struggle to detect subtle obfuscation techniques (e.g., replacing ‘o’ with ‘0’ in ‘g00gle.com’), character embeddings allowed the model to learn fine-grained textual patterns, making them highly effective for phishing detection [18, 19]. Additionally, this approach eliminates the need for domain expertise in feature selection, thereby enhancing scalability and adaptability to new phishing tactics.

CNNs are well-suited for extracting local n-gram patterns within URLs, identifying common substrings frequently used in phishing domains [20, 21]. Meanwhile, the BiGRU component efficiently captures long-range dependencies and contextual relationships within URL sequences [22, 23]. Unlike traditional recurrent neural networks (RNNs), BiGRUs utilize gating mechanisms that mitigate vanishing gradient issues and improve training efficiency [24, 25]. Furthermore, the bidirectional processing capability of BiGRU ensures that critical phishing-indicative patterns are detected regardless of their position in the URL [26, 27].

The main contributions of this research are as follows:

• A comprehensive evaluation of recent deep learning-based phishing detection models, identifying their strengths and limitations.
• Development of a data preprocessing pipeline to enhance the quality and balance of phishing URL datasets.
• Proposal of a novel hybrid Parallel CNN-BiGRU architecture that improves phishing detection accuracy by effectively capturing both local and sequential URL features.

These contributions advance the state-of-the-art in phishing detection, offering a scalable, efficient, and end-to-end deep learning solution that enhances cybersecurity defenses against sophisticated phishing attacks.

The remainder of this paper is structured as follows: Section 2 presents a com-prehensive literature review, examining recent advancements in deep learning for phishing detection. Section 3 outlines the proposed methodology, detailing the dataset, model architecture, and training procedures. Section 4 discusses experimental results and comparative analysis, and Section 5 concludes the study by summarizing key findings and future research directions.

This section outlines the methodology adopted to develop, train, and evaluate the deep learning (DL) model for phishing URL detection. The process involves dataset selection, preprocessing, model architecture design, training strategy, and performance evaluation. The proposed hybrid architecture integrates CNNs and a BiGRU to enhance feature representation and detection accuracy. Figure 1 provides an overview of the methodological workflow.

1.png

Figure 1. Proposed method for phishing detection

3.1 Dataset

The Malicious URLs Dataset [35], obtained from Kaggle, was used for training and evaluating the phishing detection model. This dataset comprises 651,191 URLs, categorized into 32,520 malware URLs, 94,111 phishing URLs, 96,457 defacement URLs, and 428,103 benign URLs. The data was sourced from five repositories to ensure a diverse representation of phishing and benign URLs. The ISCX-URL-2016 dataset provided the primary data, supplemented with phishing and malware samples from the Malware Domain Blacklist. Additional benign URLs were obtained from Faizan’s GitHub repository, while the Phishtank and PhishStorm datasets contributed further phishing URLs.

Since the study focuses on phishing detection, only the phishing and benign classes were retained, reducing the dataset to 522,214 URLs. The dataset was further preprocessed to enhance model performance.

3.2 Data preprocessing

Several preprocessing techniques were applied to prepare the dataset for deep learning-based classification. First, non-relevant categories (malware and defacement) were removed, and phishing and benign labels were numerically encoded as 1 and 0, respectively. The primary feature used for model training was the raw URL itself.

To convert URLs into a machine-readable format, character-level tokenization was employed. This method treats each character in the URL as a unique token, ensuring that the model captures fine-grained structural patterns indicative of phishing attempts. A tokenizer was used to map characters to unique integer values, and sequences were padded to a uniform length of 200 characters to standardize input dimensions.

The dataset was divided into three subsets: 70% for training, 15% for validation, and 15% for testing. This 70-15-15 split was selected specifically because of the large size of the dataset used in this study. Allocating 70% of the data to training provided the model with sufficient data to learn meaningful and robust patterns. Meanwhile, setting aside 15% each for validation and testing enabled more comprehensive evaluation and hyperparameter tuning. This broader allocation for evaluation helped reduce overfitting and improved the model’s ability to generalize, which is crucial for real-world phishing detection tasks. However, the improved performance observed in this study cannot be attributed solely to the choice of data split. Linh et al. [33], who used the same dataset, experimented with various split ratios such as 70:30 and 80:20. Despite trying these configurations, their models did not achieve the same level of performance as the one proposed in this study. This demonstrates that the improved results stem from the model architecture and training methodology, not simply from altering the data partition.

To maintain class distribution across all subsets, stratified sampling was used to split the dataset. However, an imbalance was observed, with phishing URLs significantly underrepresented. To address this, the Synthetic Minority Oversampling Technique (SMOTE) [36] was applied. SMOTE was preferred over other balancing methods such as random oversampling of minority class or undersampling of majority class because it generates new, synthetic samples rather than duplicating existing ones or discarding valuable data. This approach helped enrich the minority class, reduce overfitting, and improve the model’s ability to learn more generalizable patterns without sacrificing data diversity or size.

3.3 Deep learning model architecture

The proposed phishing detection model, illustrated in Figure 2, employs a hybrid Parallel CNN-BiGRU architecture designed to capture both local and sequential patterns in phishing URLs.

1. Character Embedding Layer: The input URLs, after tokenization, are passed through an embedding layer of dimension 64, transforming characters into dense vector representations that preserve semantic relationships.
2. Parallel 1D CNN Layers: Three parallel 1D CNN layers with different kernel sizes of 3, 5, and 7 capture n-gram patterns of diverse lengths that are commonly found in phishing URLs. These varying kernel sizes allow for capturing a richer range of features.

2.png

Figure 2. Deep learning model architecture

a. 3-character kernel: captures short character patterns, such as prefixes or suspicious short tokens, which often appear at the beginning or end of phishing URLs and are usually indicators of phishing attempts.

b. 5-character kernel: captures mid-length substrings, like parts of legitimate brand names (e.g., "apple", "Gmail") being used deceptively or short word combinations designed to mislead users.

c. 7-character kernel: captures longer, high-level structural phishing-specific patterns.

Each CNN layer consists of 128 filters, followed by a global max-pooling layer, reducing feature maps to a compact vector representation.

3. BiGRU Layer: The concatenated outputs from the CNN layers are passed into a Bidirectional GRU (BiGRU) layer with 128 neurons (64 per direction). The BiGRU enhances the model’s ability to learn contextual dependencies within URL sequences.
4. Fully Connected Layers: A 256-neuron dense layer, followed by dropout regularization (0.2), refines the extracted features before classification.
5. Output Layer: A sigmoid activation function generates a probability score between 0 and 1, representing the likelihood of a URL being phished. A threshold of 0.5 is used for classification.

3.4 Model training strategy

The training of the phishing detection model was performed using Google Colab with V2-8 TPUs, ensuring efficient computation. The Adam optimizer was employed due to its adaptive learning rate properties, facilitating faster convergence. The initial learning rate was set to 0.001, with the ReduceLROnPlateau technique applied to decrease the learning rate dynamically if validation loss stagnated. This approach prevents overshooting the optimal parameters and stabilizes training. The binary cross-entropy loss function was used, as it is well-suited for binary classification tasks. The training was conducted using a batch size of 32 over a maximum of 20 epochs, with early stopping implemented to terminate training if no improvement in validation loss was observed for five consecutive epochs. The model checkpoint mechanism is used to enhance training efficiency, ensuring that the model maintains high accuracy.

3.5 Evaluation metrics

In this research, multiple metrics were used to evaluate the effectiveness and capability of the model, including accuracy, precision, recall, F1 test, and area under the curve (AUC CURVE). Accuracy is a general metric but may not be appropriate in the case of imbalanced data. Therefore, precision and recall were combined to evaluate the ability of the model to correctly identify fraudulent URLs while minimizing false positives and false negatives. The F1 score, which is the balance between precision and recall, is particularly critical in determining the reliability of the model in real-world applications where both types of errors have security implications.

The AUC CURVE score was also calculated to measure the ability of the model to distinguish between fraudulent and benign URLs across different classification thresholds.

The evaluation metrics were computed using the following formulas:

(1) Accuracy (ACC): Measures overall classification correctness.

$Accuracy =\frac{T P+T N}{T P+T N+F N+F P}$           (1)

(2) Precision (P): Indicates the proportion of correct phishing predictions.

$Precision =\frac{T P}{T P+F P}$           (2)

(3) Recall (R): Evaluates how well the model captures phishing instances.

$Recall =\frac{T P}{T P+F N}$           (3)

(4) F1-Score: A harmonic mean of Precision and Recall, balancing false positives and false negatives.

$\mathrm{F} 1-$ Score $=\frac{2 \times( { Precision } \times  { Recall })}{({ Precision }+  { Recall })}$           (4)

(5) AUC CURVE (Area Under the Receiver Operating Characteristic Curve): Measures the model’s ability to distinguish between phishing and benign URLs across different classification thresholds.

The evaluation metrics they were used in this research provide a comprehensive assessment of the model’s strengths and weaknesses, proving it is reliable in re-al-world deployment scenarios.

The performance results of this research justify the effectiveness of the proposed parallel CNN-BiGRU model in phishing URL detection with 98.46% accuracy, surpassing other state-of-the-art deep learning-based techniques. Through the fusion of character-level embeddings, parallel CNN layers, and BiGRU, the model can learn local textual patterns and long-range dependencies of URLs, respectively, hence being more robust to obfuscation techniques used by attackers. The ability of the proposed model to process raw URLs without requiring hand-engineered features makes it more flexible to adapt to new and future phishing techniques. To fully appreciate the applicability of these findings, this discussion reflects on the relative performance of the model compared to prior studies, the impact of data balancing, error analysis, and its computational feasibility for real-world applications. Additionally, key limitations and future directions are outlined to highlight areas for improvement.

5.1 Comparative analysis with existing studies

To assess the effectiveness of the proposed approach, we compare its performance with prior phishing detection models. Table 2 provides an overview of existing deep learning-based phishing detection methods and their reported accuracy. Traditional CNN-based approaches, such as those presented in [29, 33], achieved 98.01% and 98.42% accuracy, respectively, whereas recurrent models like LSTM and BiGRU-based methods have demonstrated improved sequential learning capabilities but often struggle with feature extraction.

The superior accuracy (98.46%) of our model can be attributed to its hybrid architecture, which combines:

• Parallel CNNs for extracting multi-scale features (character n-grams, sub-strings, domain structures).
• BiGRU, which enables bidirectional sequence learning to detect phishing-indicative patterns regardless of their position in the URL.
• Character-level embeddings, which eliminate the need for handcrafted feature engineering, enhancing scalability and adaptability:

Table 2. Comparison with similar studies

5.2 Impact of data balancing on model performance

Phishing URL detection presents a significant class imbalance challenge, as benign URLs vastly outnumber phishing URLs in real-world datasets. This study addressed the issue using SMOTE, an oversampling technique that generates synthetic phishing samples, thereby improving class distribution. As illustrated in Figures 3 and 4, applying SMOTE resulted in a more balanced dataset, which in turn enhanced the model’s ability to learn phishing patterns effectively.

The effect of SMOTE is evident in the model's precision-recall trade-off. Without balancing, the model exhibited a higher false negative rate, where phishing URLs were misclassified as benign. After balancing, the model maintained a high recall (98.46%), ensuring that a greater proportion of phishing URLs were correctly detected. The ability to detect phishing URLs without significantly increasing false positives is crucial for real-world deployment, as excessive false alarms can reduce user trust in cybersecurity systems.

5.3 Error analysis and model limitations

Despite its strong performance, the model is not without limitations. A detailed error analysis highlights two key challenges:

• False negatives (misclassified phishing URLs): The model failed to detect 709 phishing URLs, which could pose a security risk in practical scenarios.
• False positives (misclassified benign URLs): While the false positive rate was relatively low (0.78%), the incorrect classification of 500 legitimate URLs as phishing could lead to unnecessary blocking of harmless websites.

The misclassification errors suggest potential areas for refinement. One approach to reduce false negatives could involve attention mechanisms that prioritize high-risk URL segments. Similarly, reducing false positives may require integrating external contextual features, such as domain registration data or WHOIS lookup information.

5.4 Computational efficiency and real-world applicability

While deep learning models provide high accuracy, their practical deployment depends on computational efficiency. The proposed Parallel CNN-BiGRU model achieves an effective balance between performance and resource usage, containing approximately 343,297 trainable parameters and requiring only 1.31 MB of memory. This relatively small model size reflects a lightweight architecture that is computationally efficient and well-suited for real-world applications, including environments with limited hardware resources.

Nevertheless, certain components of the architecture, such as multiple convolutional layers and bidirectional GRU units, do introduce additional processing overhead and longer training times, particularly when dealing with large-scale datasets. While the model performs well under current settings, future optimization strategies such as model pruning, quantization, or knowledge distillation could further reduce latency and memory usage without compromising accuracy.

Furthermore, alternative transformer-based architectures such as DistilBERT, ALBERT, TinyBERT, or MobileBERT may offer superior phishing URL classification while improving inference speed.

5.5 Future research directions

To further improve phishing URL detection, several directions for future research are proposed:

• Dynamic learning models: Implementing continuous learning approaches that adapt to new phishing attack trends over time.
• Hybrid feature extraction: Combining deep learning-based models with rule-based heuristics or graph-based URL analysis.
• Real-time phishing prevention systems: Deploying lightweight models in web browsers, email filters, and cybersecurity platforms for real-time URL analysis.
• Dataset expansion and generalization: Utilizing larger and more diverse datasets from multiple sources to ensure robustness against adversarial phishing techniques.