A Four-Signal Learned Fusion for Near-Real-Time Phishing URL Detection
In Plain Terms
Security analysts need to decide in a fraction of a second whether a link is a phishing attempt. This paper combines four fast signals — a deep language model reading the URL’s characters, a lexical model, a threat-intelligence lookup, and a measure of how popular the domain is — and lets a small learned model weigh them together. The combination catches phishing links far more reliably than any single method, labels a URL in about a tenth of a second, and reveals that domain popularity is the single most informative signal.
Artifacts
Related Papers
Cite this
APA Darko, A. M., & Ampel, B. M. (2026). A Four-Signal Learned Fusion for Near-Real-Time Phishing URL Detection. In Proceedings of the 2026 IEEE Cyber Awareness and Research Symposium (CARS).
BibTeX
@inproceedings{darko2026a,
title={A Four-Signal Learned Fusion for Near-Real-Time Phishing URL Detection},
author={Abena M. Darko and Benjamin M. Ampel},
booktitle={Proceedings of the 2026 IEEE Cyber Awareness and Research Symposium (CARS)},
year={2026}
}
Benjamin M. Ampel
Assistant Professor in Computer Information Systems and Director, Center for CyberAI Research (CCAIR)
My research focuses on AI-enabled Cybersecurity, including Cyber Threat Intelligence, Large Language Models, and Phishing Detection.