RakshNet-PhishGuard: A Multi-Layer Heuristic and Machine-Learning Framework for Real-Time Phishing URL Detection

Abstract

Phishing remains one of the most prevalent and financially damaging cyberattack vectors, with attackers routinely disguising malicious links through typosquatting, homograph substitution, brand impersonation, and abuse of free top-level domains. Existing defenses are largely reactive — blocklist services cannot flag a newly registered phishing domain until it has already been reported, while enterprise secure-web gateways are priced for organizations rather than individual users. In this paper, we propose RakshNet–PhishGuard, a client-first, multi-layer URL threat detection system that classifies a submitted URL as Safe, Suspicious, or Phishing without depending on a live threat-intelligence database. Twenty-five lexical and structural features are extracted from each URL and evaluated by two cooperating layers: a deterministic heuristic engine that checks twelve categorical red-flag rules, and a machine-learning ensemble of six classifiers — Logistic Regression, Naive Bayes, Decision Tree, Random Forest, Support Vector Machine, and Gradient Boosted Trees (XGBoost) — trained on a stratified 168-URL sample drawn from the Hannousse and Yahiouche phishing-URL benchmark. A large-language-model layer (Google Gemini, invoked through a serverless cloud function) converts the combined verdict into a plain-language explanation for non-technical users, and a community-reporting module lets users flag suspicious URLs for analyst review. Under 5-fold stratified cross-validation, Logistic Regression achieved the best overall performance (79.17% accuracy, 0.861 AUC), followed closely by the Support Vector Machine (76.19% accuracy, 0.859 AUC); a Random Forest feature-importance analysis further shows that the categorical indicators the heuristic layer specifically targets carry essentially zero learned weight in the trained models, confirming the two layers cover complementary failure modes. The project\'s documented test plan, covering single and bulk scanning, role-based access, and the AI-service fallback path, produced its expected result in all eight scenarios, with heuristic analysis completing in under 50 ms per URL. This paper additionally positions the system against nine related works spanning feature-engineered ML, deep representation learning, and large-language-model-assisted detection, and reports the system\'s functional, non-functional, and hardware/software requirements in full. The complete system is implemented as a React 18 and TypeScript single-page application in which every trained model runs entirely client-side, requiring no backend inference server.

Introduction

RakshNet–PhishGuard is a client-side phishing URL detection system designed to provide instant, explainable, and affordable protection against phishing attacks. Unlike traditional blocklist-based solutions that depend on constantly updated threat databases and may miss zero-day phishing websites, the system combines heuristic rules and machine learning to detect phishing URLs without requiring network access for basic analysis.

The system addresses key limitations of existing tools by offering:

• Real-time client-side detection without relying on online threat databases.
• Explainable results that help users understand why a URL is considered risky.
• Continuous improvement through a community URL-reporting mechanism.

Objectives

The project aims to:

• Detect phishing URLs using a heuristic rule engine.
• Train and evaluate a multi-model machine learning ensemble based on lexical URL features.
• Generate a 0–100 risk score classified as Safe, Suspicious, or Phishing.
• Provide AI-generated, easy-to-understand explanations with a local fallback.
• Support both single and bulk URL scanning.
• Enable community reporting and analyst review.
• Run entirely in the browser without a dedicated inference server.

Literature Review

Previous research has explored:

• Feature-engineered machine learning using URL characteristics.
• Deep learning models such as URLNet for automatic feature learning.
• Benchmark phishing datasets for classifier evaluation.
• LLM-assisted phishing detection, which improves explanations but still faces consistency challenges.

Most existing systems either lack explainability, depend on network connectivity, or require costly enterprise solutions. RakshNet–PhishGuard combines these strengths into a lightweight, user-friendly application.

System Architecture

The system consists of four main stages:

1. Feature Extraction
   • Extracts 25 lexical and structural URL features, including URL length, special characters, suspicious domains, subdomains, typosquatting, homographs, and phishing-related keywords.
2. Heuristic Rule Engine
   • Uses 12 predefined phishing rules, such as detecting:
     • IP-based URLs
     • Missing HTTPS
     • Suspicious TLDs
     • URL shorteners
     • '@' symbol misuse
     • Homograph attacks
     • Brand impersonation
     • Suspicious keywords
   • Each rule contributes to a cumulative risk score.
3. Machine Learning Ensemble
   • Combines six classifiers:
     • Logistic Regression
     • Gaussian Naive Bayes
     • Decision Tree
     • Random Forest
     • Support Vector Machine
     • Gradient Boosting
   • Models are weighted according to their cross-validated performance and executed entirely in the browser.
4. Risk Assessment
   • Final risk score is calculated by combining:
     • 60% Machine Learning confidence
     • 40% Heuristic score
   • URLs are classified as:
     • Safe (0–24)
     • Suspicious (25–54)
     • Phishing (55–100)

Key Features

• Instant phishing detection without backend processing.
• Explainable AI-generated verdicts for users.
• Support for scanning up to 20 URLs simultaneously.
• Community reporting with analyst verification.
• Responsive web interface compatible with desktop and mobile devices.
• Low-cost deployment using React, TypeScript, Firebase, and optional Google Gemini AI.

Conclusion

This paper presented RakshNet–PhishGuard, a client-first phishing URL detection system that pairs a transparent heuristic rule engine with a six-model machine-learning ensemble trained on lexical URL features, and augments the resulting verdict with a plain-language explanation aimed at non-technical users. Cross-validated experiments on a 168-URL benchmark sample show that Logistic Regression and a linear-kernel SVM deliver the strongest and most balanced performance (79.17% and 76.19% accuracy respectively, with AUCs above 0.85), confirming that lexical URL structure alone is a meaningful predictor of phishing intent, while a Random Forest feature-importance analysis confirms that the rare categorical indicators the heuristic layer exists to catch are provably invisible to the trained models at this sample size. Positioned against nine related works spanning feature-engineered ML, deep representation learning, and LLM-assisted detection, the system\'s combination of zero-network detection, an auditable rule layer, a genuinely cross-validated ensemble, and natural-language explanation is not matched by any single existing category of tool. Because both the feature extraction and every trained model run entirely in the browser, the system can classify a URL instantly and offline, without depending on a threat-intelligence database that is, by nature, always at least one step behind newly registered phishing infrastructure. Scaling the training dataset and closing the loop between the community-reporting layer and model retraining are identified as the most immediate paths to improving accuracy further.

References

[1] A. Hannousse and S. Yahiouche, \"Towards benchmark datasets for machine learning based website phishing detection: An experimental study,\" arXiv:2010.12847, 2021. [2] R. M. Mohammad, F. Thabtah, and L. McCluskey, \"Predicting phishing websites based on self-structuring neural network,\" Neural Computing and Applications, vol. 25, no. 2, pp. 443–458, 2014, doi:10.1007/s00521-013-1490-z. [3] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, \"Machine learning based phishing detection from URLs,\" Expert Systems with Applications, vol. 117, pp. 345–357, 2019. [4] E. Zhu, Y. Chen, C. Ye, X. Li, and F. Liu, \"OFS-NN: An effective phishing websites detection model based on optimal feature selection and neural network,\" IEEE Access, vol. 7, pp. 73271–73284, 2019, doi:10.1109/ACCESS.2019.2920655. [5] H. Le, Q. Pham, D. Sahoo, and S. C. H. Hoi, \"URLNet: Learning a URL representation with deep learning for malicious URL detection,\" arXiv:1802.03162, 2018. [6] F. Türk and M. K?l?çaslan, \"Malicious URL detection with advanced machine learning and optimization-supported deep learning models,\" Applied Sciences (MDPI), vol. 15, no. 18, art. 10090, 2025. [7] H. Kibriya, R. Amin, S. S. Alshamrani, S. Rehman, M. Hassan, and F. S. Alsubaei, \"Lightweight malicious URL detection using deep learning and large language models,\" Scientific Reports, vol. 15, art. 43044, 2025, doi:10.1038/s41598-025-26653-2. [8] F. Ji and D. Kim, \"How can we effectively use LLMs for phishing detection?: Evaluating the effectiveness of large language model-based phishing detection models,\" arXiv:2511.09606, 2025. [9] J. Lee, P. Lim, B. Hooi, and D. M. Divakaran, \"Multi-modal large language models for phishing webpage detection and identification,\" arXiv:2408.05941, 2024. [10] Anti-Phishing Working Group (APWG), \"Phishing Activity Trends Report,\" [Online]. Available: https://apwg.org. [11] Google, \"Google Safe Browsing,\" [Online]. Available: https://safebrowsing.google.com. [12] F. Pedregosa et al., \"Scikit-learn: Machine learning in Python,\" Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011. [13] T. Chen and C. Guestrin, \"XGBoost: A scalable tree boosting system,\" in Proc. 22nd ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining, 2016, pp. 785–794. [14] Google Cloud, \"Vertex AI — Gemini models,\" [Online]. Available: https://cloud.google.com/vertex-ai/generative-ai/docs. [15] React documentation, Meta Platforms Inc., [Online]. Available: https://react.dev. [16] Firebase documentation, Google LLC, [Online]. Available: https://firebase.google.com/docs. [17] Ministry of Electronics and Information Technology, Government of India, \"Digital Personal Data Protection Act, 2023,\" Gazette of India, 2023.

Copyright

Copyright © 2026 Palla Srinivas, Pravitha R Prasad. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.