AI-Powered Phishing and Quishing Detection Using Multi-Model Machine Learning

AI-Powered Phishing and Quishing Detection Using Multi-Model Machine Learning

IEEE BASE PAPER TITLE:
DistilBERT-Based Hybrid Architecture for Phishing URL Detection

IEEE BASE PAPER ABSTRACT:

Phishing continues to be a major and rapidly evolving challenge in cybersecurity. By disguising malicious links as legitimate ones, attackers trick users into revealing sensitive information such as login credentials and financial details. Detecting phishing URLs is difficult because modern attacks rely on heavy obfuscation and are often lexically very similar to benign domains. In this paper, we propose a hybrid late-fusion approach that combines deep semantic (word) representations with handcrafted statistical features for phishing URL detection. We select the fusion weight using AUCPR-driven optimization on a validation set and obtain an optimal value of α = 0.47, which balances the contribution of semantic and lexical signals. Experiments on a large-scale benchmark dataset show that the proposed fusion model is highly effective. It reaches an accuracy of 98.79% and a ROC–AUC of 0.9983, and it performs better than either feature stream on its own. Under a strict security setting (FPR ≤ 1%), the system still achieves a phishing detection rate of 97.58%. To evaluate real-world robustness, we additionally perform external validation on 150 verified phishing URLs from PhishTank collected between December 2025 and February 2026, well after the benchmark dataset was compiled. Without any retraining, the model achieves a Recall/TPR of 99.33%, correctly flagging 149 out of 150 previously unseen phishing URLs. Overall, these results indicate strong temporal generalization and highlight the practical promise of the proposed method for real-world cybersecurity deployments.

PROJECT OUTPUT VIDEO:

ALGORITHM / MODEL USED:

LightGBM, Random Forest, XGBoost, CatBoost, Stacking Meta-Ensemble and Multi-Layer Perceptron (MLP).

OUR PROPOSED PROJECT ABSTRACT:

The rapid growth of online services and digital communication has led to an increasing number of phishing attacks, including QR-code-based phishing attacks known as Quishing. Traditional security mechanisms often struggle to identify newly emerging malicious URLs, obfuscated links, typosquatting domains, and sophisticated social engineering patterns. This project presents an AI-Powered Phishing and Quishing Detection System Using Multi-Model Machine Learning, designed to identify malicious URLs and QR-code-based threats through automated security analysis and machine learning.

The proposed system employs a comprehensive feature engineering framework that extracts 34 security-related features from URLs, including lexical and structural characteristics, information entropy, protocol and network indicators, domain characteristics, suspicious keywords, brand impersonation, typosquatting, homoglyph attacks, URL encoding, and other threat-related patterns. The system is trained and evaluated using an own curated composite benchmark dataset containing 25,000 URL samples, with an equal distribution of benign and malicious samples. The dataset is divided into 80% for training with 5-fold stratified cross-validation and 20% for holdout testing.

To improve detection reliability, the system implements multiple machine learning approaches, including Random Forest, XGBoost, LightGBM, CatBoost, Stacking Meta-Ensemble and Multi-Layer Perceptron (MLP). Their prediction probabilities are further combined using a Stacking Meta-Ensemble with Logistic Regression to produce the final threat classification and phishing probability score. Among the individual models, LightGBM achieved the highest holdout test accuracy of 97.74%, with a precision of 98.50%, F1-score of 97.72%, and ROC-AUC of 0.9974.

The trained models are integrated into an interactive Flask-based cybersecurity web application that supports real-time URL scanning, QR-code/Quishing analysis, batch processing, user authentication, and administrative model-training functionality. In addition, live network inspection performs DNS resolution, IP classification, SSL certificate verification, and response latency analysis, providing supplementary information for threat assessment.

The proposed system demonstrates how multi-model machine learning combined with URL feature engineering and real-time network intelligence can provide an effective and practical approach for detecting phishing and Quishing threats. The resulting solution can assist users and organizations in identifying suspicious links before they interact with potentially malicious online resources.

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS: 

• System : Pentium i3 Processor.
• Hard Disk : 20 GB.
• Monitor : 15’’ LED.
• Input Devices : Keyboard, Mouse.
• Ram : 8 GB.

SOFTWARE REQUIREMENTS: 

• Operating System : Windows 10 / 11.
• Coding Language : Python 3.13.15.
• Web Framework : Flask.
• Frontend : HTML, CSS, JavaScript.
• Database : SQLite.

REFERENCE:

ÜLKÜ ÖZMEN AND ESRA ODABAS YILDIRIM, “DistilBERT-Based Hybrid Architecture for Phishing URL Detection”, IEEE ACCESS, VOLUME 14, 2026.

👉CLICK HERE TO BUY THIS PROJECT “AI-Powered Phishing and Quishing Detection Using Multi-Model Machine Learning” SOURCE CODE👈

What is the main purpose of this project?

The main purpose of the AI-Powered Phishing and Quishing Detection Using Multi-Model Machine Learning project is to automatically identify suspicious and malicious URLs and detect phishing attacks delivered through QR codes, commonly known as Quishing.

What is phishing?

Phishing is a cyberattack in which attackers create deceptive links or websites to trick users into providing sensitive information such as login credentials, financial information, or personal data.

What is Quishing?

Quishing, or QR-code phishing, is a phishing technique in which attackers distribute malicious URLs through QR codes. The proposed system extracts the URL from a QR code and analyzes it using the phishing detection pipeline.

What technologies are used in the project?

The system is primarily developed using Python and Flask. It incorporates machine learning algorithms, URL feature engineering, network inspection, QR-code analysis, and database functionality.

Which machine learning algorithms are used?

The system uses five base machine learning models: Random Forest XGBoost LightGBM CatBoost Multi-Layer Perceptron (MLP) Their outputs are combined using a Stacking Meta-Ensemble with Logistic Regression as the meta-learner.

How many features are extracted from each URL?

The feature extraction engine extracts 34 security-related features from each URL. These features cover structural, lexical, statistical, host, protocol, network, and threat-related characteristics.

What dataset is used for training?

The project uses an own curated composite benchmark dataset named Real World phishing dataset. It contains 25,000 URL samples and was constructed using raw URL data from multiple cybersecurity datasets and threat intelligence sources referred from kaggle.

How are the extracted features processed?

The extracted features are standardized using StandardScaler before being supplied to the machine learning models.

How does the system detect a phishing URL?

The system accepts a URL, extracts its security-related features, standardizes the feature vector, and sends it to the trained machine learning models. The outputs of the models are combined by the Stacking Meta-Ensemble to generate the final threat prediction and phishing probability score.

Does the system support QR-code analysis?

Yes. The system supports Quishing detection by analyzing URLs obtained from QR codes. QR-code analysis is integrated into the Flask web application along with conventional URL scanning

What network information does the system inspect?

The network inspection component performs DNS resolution, IP classification, SSL certificate handshake verification, and response latency tracking.

What output does the system provide?

The system provides a final threat decision along with a phishing probability percentage score. The prediction is generated after processing the URL through the machine learning detection pipeline.

How is the performance of the system evaluated?

The machine learning models are evaluated using metrics such as accuracy, precision, recall, F1-score, and ROC-AUC. The models are trained using 5-fold stratified cross-validation and evaluated on a separate 5,000-sample holdout test set.

What makes this project different from a basic phishing URL classifier?

The project combines multi-model machine learning, 34-feature URL analysis, stacking-based prediction, QR-code/Quishing analysis, live network inspection, batch processing, and a web-based interface into a single cybersecurity application.

Can we publish a research journal based on this project?

Yes. This project can be developed into a research paper for publication in a research journal or conference. JP Infotech provides complete assistance in publishing it in an International Journal or International Conference or IEEE Conference or Scopus Journal.