Milosz Misiek

Phishing attacks increasingly rely on visual deception to steal user data. Because attackers copy the exact appearance of legitimate websites, text-based and URL-based detectors often fail to identify the threat.

This paper presents a visual phishing detection approach that exploits the semantic knowledge of large pretrained vision models without the computational cost of fine-tuning. We extract embeddings from frozen SigLIP 2 and DINOv2 encoders and concatenate them into a single multimodal representation. We then train a lightweight Multi-Layer Perceptron (MLP) classifier on these fused features and compare its performance against XGBoost.

Evaluated on a dataset of 70,785 web-page screenshots, our fused MLP model achieves an F1 score of 0.9474 and an AUC of 0.9839. The results demonstrate that multimodal fusion of image-text and purely visual embeddings consistently outperforms single-encoder representations. Furthermore, a simple MLP is highly competitive with gradient boosting when trained on rich pretrained embeddings.

This article analyses the performance characteristics of XGBoost models across multiple datasets for phishing URL detection, extending our previous conference paper with comprehensive cross-dataset validation and comparative analysis.

Using a validation framework with three distinct datasets — a custom phishing dataset (75,738 samples), the large-scale GramBeddings dataset (639,723 samples), and the PhiUSIIL dataset (47,103 samples)—we demonstrate that XGBoost delivers robust performance across diverse data sources. Our approach addresses the issue of feature instability, showing how balanced feature engineering is crucial for reliable detection.

The model achieves 90.7% accuracy and 91.2% F1 score on the custom dataset, with a solid 77.8% average accuracy across three independent test sets. In comparative benchmarks against Neural Networks, XGBoost proved superior in training efficiency and detection quality, achieving 2.1% higher accuracy and training 12.6 times faster (0.95s vs 12.01s) with 3.6 times less memory. Although Neural Networks offered faster inference (7.51ms vs 20.6ms) and smaller model sizes, XGBoost’s balance of high accuracy and rapid training makes it highly effective for practical, real-world phishing detection systems.

One way to protect users from clicking on a malicious URL is to continuously check all URLs displayed on the website and notify them when a suspicious URL is detected.

This paper presents a browser plug-in to detect malicious web addresses facilitating phishing attacks. The plug-in leverages a machine-learning model, specifically the Extreme Gradient Boosting decision tree model. The results indicate high performance in accurately identifying malicious URLs.

Although the XGBoost model does not achieve the highest possible accuracy, it offers an exceptional balance between various performance metrics. It provides practical benefits in terms of computational efficiency and interpretability. These features make it a solid foundation for further development and potential implementation in phishing detection systems on social networking sites. The plug-in identifies and flags all external URLs on a given page, providing users with information regarding the potential maliciousness of a URL.