Volume 17 , Issue 2 , PP: 210-226, 2026 | Cite this article as | XML | Html | PDF | Full Length Article
Sharvari Patil 1 * , Narendra M. Shekokar 2 , Aditya Surve 3 , Priyanka Ramchandran 4
Doi: https://doi.org/10.54216/JCIM.170215
Phishing is one of the most dominant forms of cybercrime, with over half a billion incidents occurring annually. It remains one of the most insidious forms of fraud due to its effectiveness. Phishing attacks are on the rise with increasingly deceptive tactics, often leading unwitting victims to divulge personal information. Phishing frauds also involve website phishing, which mimics legitimate sites. Despite the best user training and practices, people still fall for these frauds. The methodology of detecting phishing attacks using the blacklisting approach was not very effective since these URLs are active for a limited period. Hence, Machine Learning methods were used for detecting the phishing attempt. Machine learning solutions are not adaptive to changes in the approach and are biased towards the developed solution. In addition, there is a need to develop a solution to this constantly evolving phishing attack. The proposed system is an attempt to use reinforcement-learning methodology as the solution to detect phishing. It has trained an adaptive intelligent learning system based on previous experiences using the Q-learning algorithm. The system focuses on dynamically selecting the relevant features and the classification model. The agent is trained to select optimal features and classification models dynamically based on Q-learning algorithm. In contrast to static methods, the proposed system continuously adapts its strategy of combinations feature subsets and classification models as defense against the rapidly evolving attacks. The system aims to supplement existing cybersecurity measures with an adaptable tool capable of countering sophisticated phishing schemes. The experimental analysis shows that the proposed methodology attained an accuracy of 99.25%, demonstrating its high performance in phishing detection.
Reinforcement Learning , Phishing Detection , Internet Security , Feature Engineering , Website Classification , Q-Learning , Adaptive Learning
[1] D. Desai and R. Hegde, "Phishing Attacks Rise 58% in the Year of AI: ThreatLabz 2024 Phishing Report," 2024. [Online]. Available: https://www.zscaler.com/blogs/security-research/phishing-attacks-rise-58-year-aithreatlabz-2024-phishing-report
[2] APWG, "APWG Q4 Report Finds 2023 Was Record Year for Phishing," 2023. [Online]. Available: https://apwg.org/apwg-q4-report-finds-2023-was-record-year-for-phishing/. [Accessed: Jul. 08, 2024].
[3] Google, "Safe Browsing," Google Developers, 2024. [Online]. Available: https://developers.google.com/safe-browsing. [Accessed: Jul. 08, 2024].
[4] S. Ariyadasa, S. Fernando, and S. Fernando, "SmartiPhish: a reinforcement learning-based intelligent anti-phishing solution to detect spoofed website attacks," Int. J. Inf. Security, vol. 23, pp. 1055–1076, 2024, doi: 10.1007/s10207-023-00778-9.
[5] M. Chatterjee and A. S. Namin, "Deep Reinforcement Learning for Detecting Malicious Websites," arXiv preprint, arXiv: 1905.09207, 2019.
[6] M. Bahaghighat, M. Ghasemi, and F. Ozen, "A high-accuracy phishing website detection method based on machine learning," J. Inf. Security Appl., vol. 77, p. 103553, 2023, doi: 10.1016/j.jisa.2023.103553.
[7] Q. Abu Al-Haija and A. Al Badawi, "URL-based Phishing Websites Detection via Machine Learning," in Proc. Int. Conf. Data Analytics Bus. Ind. (ICDABI), 2021, pp. 644–649, doi: 10.1109/ICDABI53623.2021.9655851.
[8] I. Khan and B. Unhelkar, "An Enhanced Anti-Phishing Technique for Social Media Users: A Multilayer Q-Learning Approach," Int. J. Adv. Comput. Sci. Appl., vol. 15, no. 1, 2024, doi: 10.14569/IJACSA.2024.0150103.
[9] P. P. Kumar, T. Jaya, and V. Rajendran, "SI-BBA – A novel phishing website detection based on Swarm intelligence with deep learning," Mater. Today, Proc., vol. 80, Part 3, pp. 3129–3139, 2023, doi: 10.1016/j.matpr.2021.07.178.
[10] Lakshmanarao, P. S. P. Rao, and M. M. B. Krishna, "Phishing website detection using novel machine learning fusion approach," in Proc. Int. Conf. Artif. Intell. Smart Syst. (ICAIS), 2021, pp. 1164–1169, doi: 10.1109/ICAIS50930.2021.9395810.
[11] Saha et al., "Phishing Attacks Detection using Deep Learning Approach," in Proc. Third Int. Conf. Smart Syst. Invent. Technol. (ICSSIT), 2020, pp. 1180–1185, doi: 10.1109/ICSSIT48917.2020.9214132.
[12] G. Vrbančič, "Phishing Websites Dataset," 2020. [Online]. Available: https://doi.org/10.17632/72ptz43s9v.1
[13] Subasi et al., "Intelligent phishing website detection using random forest classifier," in Proc. Int. Conf. Electr. Comput. Technol. Appl. (ICECTA), 2017, pp. 1–5, doi: 10.1109/ICECTA.2017.8252051.
[14] G. Barto, "Reinforcement learning," in Neural Systems for Control. Academic Press, 1997, pp. 7-30.
[15] Google for Developers, "Foundational Courses," Machine Learning Crash Course. [Online]. Available: https://developers.google.com/machine-learning/crash-course/classification
[16] J. Doshi et al., "A comprehensive dual-layer architecture for phishing and spam email detection," Comput. Secur., vol. 133, p. 103378, 2023.
[17] S. Smadi, N. Aslam, and L. Zhang, "Detection of online phishing email using dynamic evolving neural network based on reinforcement learning," Decis. Support Syst., vol. 107, pp. 88-102, 2018.
[18] L. P. Kaelbling, M. L. Littman, and A. W. Moore, "Reinforcement learning: A survey," J. Artif. Intell. Res., vol. 4, pp. 237-285, 1996.
[19] E. Cengiz and M. Gök, "Reinforcement learning applications in cyber security: A review," Sakarya Univ. J. Sci., vol. 27, no. 2, pp. 481-503, 2023.
[20] A. Hammad et al., "Deep Reinforcement Learning for Adaptive Cyber Defense in Network Security," in Proc. Cognit. Models Artif. Intell. Conf., 2024.
[21] H. Kamal et al., "Reinforcement learning model for detecting phishing websites," in Cybersecurity and Artificial Intelligence: Transformational Strategies and Disruptive Innovation. Cham: Springer Nature, 2024, pp. 309-326.
[22] Alzahrani, M. S. Alhassan, and M. A. Alzahrani, "A survey on phishing detection techniques: Challenges and future directions," J. Inf. Security Appl., vol. 66, no. 1, p. 102756, 2023, doi: 10.1016/j.jisa.2023.102756.
[23] K. Liu, Y. Fu, L. Wu, X. Li, C. Aggarwal, and H. Xiong, "Automated feature selection: A reinforcement learning perspective," IEEE Trans. Knowl. Data Eng., vol. 35, no. 3, pp. 2272-2284, 2021.
[24] Maci, A. Santorsola, A. Coscia, and A. Iannacone, "Unbalanced web phishing classification through deep reinforcement learning," Computers, vol. 12, no. 6, p. 118, 2023.
