Threat Guard: AI Threat Detector for Emails, Links, QR Code & Text Messages: Safe or Malicious. Using Machine Learning

Author

K M Keerthi Kumar, Suresh H J, Ananth Kumar K, Pavan Kumar M; Ms. Pooja M V

Abstract

 Phishing attacks have evolved from monolithic email lures to omni-channel campaigns delivered through obfuscated URLs, SMS (smishing), and QR codes (quishing). Static blocklists react too slowly to short-lived domains, deep neural detectors are opaque and costly, and automated scanners that fetch suspect links can be abused through server-side request forgery (SSRF). To address these gaps, this paper proposes ThreatGuard, an explainable machine learning framework combining an 18-dimensional lexical, structural, and Shannon-entropy feature pipeline with a Random Forest classifier, an OpenCV QR decoder, an NLP urgency parser, and a calibrated hybrid risk engine (ML 45%, heuristics 25%, NLP 20%, reputation 10%), all protected by a pre-socket SSRF guardrail. Applied to 240,000 labeled real-world records, the pipeline achieves 98.41% accuracy, 98.07% precision, 98.77% recall, 98.42% F1-score, and 0.992 ROC-AUC on a 48,000-instance holdout set at 1.16 ms per URL scan (over 860 scans/s/core). All SSRF test vectors were blocked, and every verdict is accompanied by explainable indicator cards mapped to SOC playbooks and MITRE ATT&CK techniques.

Keywords

Phishing Detection; Machine Learning; Random Forest; Explainable AI; QR Code Phishing; Smishing; SSRF; URL Classification; Shannon Entropy; Cybersecurity; Feature Engineering

Full Text:

Download Paper PDF

References

[1] Verizon, “2024 Data Breach Investigations Report (DBIR),” Verizon Enterprise Solutions, 2024.

[2] Anti-Phishing Working Group (APWG), “Phishing Activity Trends Report, Q4 2023 / Q1 2024,” 2024.

[3] Federal Bureau of Investigation, “Internet Crime Report 2023,” IC3, 2024.

[4] I. Fette, N. Sadeh, and A. Tomasic, “Learning to detect phishing emails,” in Proc. 16th WWW, 2007, pp. 649-656.

[5] S. Marchal, K. Saari, N. Singh, and N. Asokan, “Off-the-Hook: An efficient and usable client-side phishing prevention application,” IEEE Trans. Comput., vol. 66, no. 11, pp. 2006-2019, 2017.

[6] X. Cui, D. He, and M. Guizani, “Tracking and analyzing URL redirection abuse in modern social engineering campaigns,” IEEE Network, vol. 37, no. 1, pp. 188-195, 2023.

[7] G. Sonowal and K. S. Kuppusamy, “SmiDCA: An anti-smishing model with machine learning approach,” The Computer Journal, vol. 63, no. 4, pp. 600-615, 2020.

[8] S. Chaturvedi, R. Mishra, and P. Kumar, “Quishing: Understanding and mitigating phishing attacks using QR codes,” in Proc. IEEE CSR, 2023, pp. 112-117.

[9] A. Singh, P. K. Sharma, and A. K. Jha, “Machine learning based quishing detection using optical barcode segmentation,” in Proc. IEEE GUCON, 2020, pp. 812-817.

[10] S. Sheng et al., “An empirical analysis of phishing blacklists,” in Proc. 6th CEAS, 2009.

[11] R. M. Mohammad, F. Thabtah, and L. McCluskey, “Predicting phishing websites based on self-structuring neural network,” Neural Comput. Appl., vol. 25, no. 2, pp. 443-458, 2015.

[12] J. Saxe and K. Berlin, “eURLPR: High performance URL classification with convolutional networks,” in Proc. IEEE SPW, 2017.

[13] H. Le, Q. Pham, D. Sahoo, and S. C. Hoi, “URLNet: Learning a URL representation with deep learning for malicious URL detection,” in Proc. IEEE/ACM ASONAM, 2018, pp. 87-94.

[14] P. Maneriker, J. W. Stokes, E. G. Luan, R. Caruana, and Srikumar, “URLTran: Improving phishing URL detection using transformers,” in Proc. IEEE MILCOM, 2021, pp. 497-504.

[15] OWASP Foundation, “OWASP Top 10:2021 - A10: Server-Side Request Forgery (SSRF),” 2023.

[16] Z. Alshingiti, R. Rehman, and H. Tahir, “A hybrid phishing detection framework using URL lexical and visual similarity,” IEEE Access, vol. 11, pp. 42110-42125, 2023.

[17] J. Ma, L. K. Saul, S. Savage, and G. M. Voelker, “Beyond blacklists: Identifying malicious web sites,” in Proc. 15th ACM KDD, 2009, pp. 1245-1254.

[18] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning based phishing detection from URLs,” Expert Syst. Appl., vol. 117, pp. 345-357, 2019.

[19] J. Ma et al., “Identifying suspicious URLs: An application of large-scale online learning,” in Proc. 26th ICML, 2009.

[20] B. B. Gupta, N. A. Arachchilage, and K. E. Psannis, “Defending against phishing attacks: Taxonomy of methods,” Telecommun. Syst., vol. 67, no. 2, pp. 247-267, 2018.

[21] R. Basnet, S. Mukkamala, and A. H. Sung, “Detection of phishing webpages using feature selection,” J. Information Security, vol. 5, no. 4, pp. 116-125, 2014.

[22] PhishTank, “PhishTank: An anti-phishing community,” OpenDNS / Cisco Talos, 2024.

[23] V. Le Pochat, T. Van Goethem, S. Tajik, and W. Joosen, “Tranco: A research-oriented top sites ranking hardened against manipulation,” in Proc. 26th NDSS, 2019.

[24] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5-32, 2001.

[25] C. E. Shannon, “A mathematical theory of communication,” Bell Syst. Tech. J., vol. 27, no. 3, pp. 379-423, 1948.

[26] T. Berners-Lee, R. Fielding, and L. Masinter, “Uniform Resource Identifier (URI): Generic syntax,” RFC 3986, IETF, 2005.

[27] R. Aljofey, Q. Jiang, Q. Qu, M. Huang, and J. Niyigena, “An effective convolutional-BiLSTM approach for malicious URL detection,” IEEE Access, vol. 10, pp. 45532-45546, 2022.

[28] M. Khonji, Y. Iraqi, and A. Jones, “Phishing detection: A literature survey,” IEEE Commun. Surveys Tuts., vol. 15, no. 4, pp. 2091-2121, 2013.

[29] R. M. Mohammad, F. Thabtah, and L. McCluskey, “Intelligent rule-based phishing websites classification,” IET Information Security, vol. 8, no. 3, pp. 153-160, 2014.

[30] K. Thomas et al., “Trends, challenges, and best practices in phishing: A Google perspective,” in Proc. eCrime Research Summit, 2016.

 

 

Share your valuable work from Social Media Buttons