DAFPD: The Dynamic and Adaptive Framework for Enhanced Phishing Detection Techniques

Abstract

This study introduces the Dynamic and Adaptive Framework for Enhanced Phishing Detection (DAFPD) that uses multi-stage machine learning and deep learning for real-time, explainable phishing detection. DAFPD captures dynamic features (lexical, host-based, content-based, graph-based) and uses transformer models (BERT, RoBERTa) and Graph Neural Networks (GNNs) to accurately contextualize information. Python and Anaconda with PhishTank live dataset were used to perform these experiments. The detection pipeline consists of a light-weight heuristic filter, a deep learning phase with the combination of CNN-LSTM and transformers, and an ensemble learning aided with autoencoder-based zero-day attack anomaly detectors. For on-chain transactions, reinforcement learning (Deep Q-Networks) automatically determines thresholds and features. Explainable AI techniques, such as SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME), provide justifications of the model predictions. Enabling cloud services with an "as a service" implementation, DAFPD communicates with Security Information and Event Management (SIEM) to block threats as they occur. The experimental results demonstrate that the DAFPD achieves significantly better performance.