A Lightweight Neural Network Approach for Phishing URL Detection

Technical Summary: A Lightweight Neural Network Approach for Phishing URL Detection

Problem Statement
Phishing attacks represent a pervasive cyber threat where malicious actors deceive users into revealing sensitive information via fraudulent websites. As attack strategies evolve—utilizing domain spoofing, obfuscation, and shortened URLs—traditional detection mechanisms like blacklisting and rule-based systems struggle with scalability and adaptability. Furthermore, existing deep learning solutions (e.g., CNNs, LSTMs, hybrid models) often demand significant computational resources, making them unsuitable for real-time deployment in resource-constrained environments such as IoT devices, mobile systems, and edge computing. There is a critical need for a detection framework that balances high classification accuracy with low computational complexity and minimal processing overhead.

Methodology
This research proposes a lightweight neural network architecture designed to classify URLs as either phishing or legitimate. The study utilizes the PhiUSIIL Phishing URL dataset, which contains approximately 235,795 instances (134,850 phishing and 100,945 legitimate URLs) with 64 distinct features, including domain length, special character counts, and protocol information.

The experimental workflow involves the following key components:

1. Data Preprocessing: The dataset is cleaned to remove null values and split into 70% training and 30% testing sets using stratified sampling. A critical step in the methodology is the application of Min-Max scaling to normalize feature values into a 0–1 range, comparing performance against unscaled data.
2. Model Architecture: The proposed model is a shallow, lightweight neural network consisting of:
   • An input layer accepting the scaled feature vector.
   • Two fully connected hidden layers utilizing the ReLU activation function to mitigate vanishing gradient issues.
   • Regularization techniques: Dropout (rate of 0.5) is inserted between layers to prevent overfitting, and Batch Normalization is applied after each hidden layer to stabilize and accelerate training.
   • An output layer with a single neuron and sigmoid activation for binary classification.
3. Training Configuration: The model is trained using Binary Cross-Entropy loss. The study evaluates two optimizers: Stochastic Gradient Descent (SGD) and Adam. Hyperparameters, including learning rates, momentum, batch sizes (32, 64, 128), and epoch counts (50, 100, 150), are tuned.
4. Evaluation: The study employs 5-fold cross-validation and analyzes performance using Accuracy, Precision, Recall, and F1-Score.

Key Contributions
The paper outlines five primary contributions to the field of cybersecurity and machine learning:

• Lightweight Architecture: The proposal of a neural network with few layers specifically designed for resource-constrained environments (IoT, mobile) without sacrificing detection capability.
• Optimizer Comparison: A comparative analysis of SGD and Adam optimizers, demonstrating that SGD combined with Batch Normalization yields superior stability and accuracy for this specific task.
• Impact of Data Scaling: Empirical evidence showing that Min-Max scaling significantly improves model convergence, stability, and classification accuracy compared to training on raw, unscaled data.
• Regularization Ablation Study: Quantitative experiments confirming the necessity of both Dropout and L2 regularization to prevent overfitting and ensure generalization.
• High-Performance Benchmarking: The achievement of near-perfect performance metrics on the PhiUSIIL dataset, validating the model's practicality.

Results
The experimental results indicate that the proposed lightweight approach is highly effective:

• Effect of Scaling: Models trained on scaled data achieved 99.47% accuracy, compared to 96.57% on unscaled data, highlighting the critical role of preprocessing.
• Optimizer Performance: The Adam optimizer achieved the highest overall performance with 99.98% accuracy, 99.97% precision, 99.99% recall, and a 99.98% F1-Score.
• Regularization Impact: The inclusion of Batch Normalization improved accuracy from 99.47% to 99.73%. Similarly, models with Dropout and L2 regularization achieved a 99.54% F1-Score.
• Final Configuration: The optimal configuration (Scaled data + Adam optimizer + Batch Normalization + Dropout) resulted in a model capable of distinguishing phishing URLs with near-zero false positives and false negatives.

Significance and Claims
The authors claim that this research provides a viable framework for real-time cybersecurity applications, such as browser filters and mobile security tools, by addressing the trade-off between detection precision and computational efficiency. The study asserts that optimizing simple neural networks with the correct hyperparameters and preprocessing steps can effectively detect phishing URLs even within large, diverse datasets.

The significance of the work lies in its demonstration that complex, resource-heavy deep learning models are not strictly necessary for high-accuracy phishing detection. Instead, a carefully tuned, lightweight architecture can offer robust protection against online scams. The authors conclude that their approach contributes to the development of effective, scalable machine learning models for cybersecurity, offering a defense mechanism that is both computationally efficient and highly accurate, suitable for deployment in environments with constrained hardware resources.