Leveraging Graph Neural Networks and Conventional Machine Learning for Phishing URL Detection

Technical Summary: Leveraging Graph Neural Networks and Conventional Machine Learning for Phishing URL Detection

Problem Statement
Phishing attacks represent a persistent and escalating cybersecurity threat, where adversaries impersonate legitimate entities to steal confidential information such as login credentials and financial data. As internet usage expands, these attacks have become increasingly sophisticated, utilizing tactics like email spoofing and deceptive URLs. While conventional detection methods, such as blacklists and rule-based pattern matching, struggle to identify emerging threats, machine learning (ML) and deep learning (DL) approaches offer improved detection by recognizing complex patterns. However, existing ML models often rely heavily on static, individual URL features and require extensive, continuously updated datasets. Furthermore, many traditional models fail to capture the structural relationships and interdependencies between URLs, which are critical for detecting coordinated or complex phishing campaigns.

Methodology
The authors propose a hybrid detection framework that integrates the topological learning capabilities of Graph Neural Networks (GNNs) with the classification strength of Random Forest (RF). The methodology proceeds through the following stages:

1. Data Integration and Feature Engineering:
   The study aggregates data from four distinct sources: the "Web Page Phishing Detection Dataset" (Kaggle) and three supplementary repositories (Mendeley Data and UCI ML Repository). This results in an initial pool of 124 features, including URL structural attributes (e.g., length, number of dots), content characteristics, and external service indicators.

   • Preprocessing: The dataset undergoes Z-score normalization for consistent scaling.
   • Feature Selection: To address redundancy and multicollinearity, features with a correlation coefficient ≥ 0.5 are analyzed, and Recursive Feature Elimination (RFE) is employed to distill the set down to the 40 most discriminative features.

2. Graph Construction and GNN Embedding:
   URLs are represented as nodes within a web graph to capture structural and behavioral relationships. The authors experiment with three edge-construction strategies to define connections between nodes:

   • K-Nearest Neighbors (KNN): Connecting nodes based on feature space proximity.
   • Threshold-based: Creating edges if similarity (e.g., cosine similarity) exceeds a specific threshold.
   • Feature-specific: Connecting nodes based on shared categorical features.
     The GNN iteratively updates node representations by aggregating information from neighboring nodes, generating embeddings that encapsulate both contextual and structural insights.

3. Hybrid Classification:
   The embeddings generated by the GNN are fed into a classifier. The primary proposed model is GNN-RF, which combines GNN embeddings with a Random Forest classifier. A secondary comparative model, GNN-LR, utilizes Logistic Regression as the classifier. Both are benchmarked against traditional standalone models: Logistic Regression (LR), Decision Tree (DT), K-Nearest Neighbors (KNN), and Random Forest (RF).

4. Deployment:
   The best-performing model is deployed via a Gradio-based web interface, allowing users to input a URL and receive real-time classification results.

Key Contributions

• Hybrid Architecture: The paper introduces a novel GNN-RF model that leverages graph-based learning to capture relational dependencies between URLs, addressing the limitations of static feature-only models.
• Comprehensive Feature Analysis: The study compiles and analyzes features from four diverse datasets, utilizing RFE to identify the most impactful attributes for phishing classification.
• Comparative Evaluation: The research provides a detailed evaluation comparing traditional ML models, a GNN-LR alternative, and the proposed GNN-RF model across multiple metrics.
• Practical Implementation: The work bridges the gap between theoretical advancement and practical application by deploying the model through an accessible user interface.

Experimental Results
Experiments were conducted on a balanced dataset of over 11,000 labeled URLs (50% phishing, 50% legitimate) using 5-fold cross-validation.

• Performance: The GNN-RF model with threshold-based edges achieved the highest performance, recording 97% accuracy, 97% precision, 97% recall, and a 97% F1-score, with a ROC-AUC of 0.99. This outperformed all traditional models (which ranged from 94% to 96% accuracy) and the GNN-LR alternative.
• Error Reduction: The hybrid model significantly reduced false positives compared to baseline models, enhancing its reliability for real-world deployment.
• Computational Trade-offs: While the GNN-RF model demonstrated superior accuracy, it incurred higher computational costs. Processing 1,000 samples took approximately 0.7255 seconds for the GNN-RF (threshold) model, compared to 0.0025 seconds for the standalone Random Forest. However, memory usage remained minimal across all models (0.00005 MB).
• Alternative Models: The GNN-LR model offered faster processing speeds (0.0100 seconds per 1,000 samples) but slightly lower accuracy (93–94%), highlighting a trade-off between speed and predictive power.

Significance and Claims
The paper posits that the integration of Graph Neural Networks with ensemble methods like Random Forest provides a robust and intelligent solution to modern phishing threats. The authors claim that their approach effectively addresses critical limitations in existing literature, specifically the lack of relational context and the reliance on static features. By capturing structural dependencies between URLs, the GNN-RF model is better equipped to detect coordinated phishing behaviors that traditional models may miss.

The study concludes that while advanced hybrid models introduce computational overhead, the significant gains in detection accuracy and the reduction of false positives justify their use in scenarios where high precision is paramount. The successful deployment via a Gradio interface demonstrates the practical viability of the system for cybersecurity practitioners and end-users. Future work suggested by the authors includes real-time graph construction, online learning for adaptive threat detection, and broader integration into cybersecurity infrastructures.