Enhancing Cybersecurity Against Phishing Attacks Using VGA-Hyphishnet: A Hybrid Generative–Discriminative Model

I. Introduction

Phishing is a form of social engineering attack that targets users’ personal and financial information by deceiving them into revealing sensitive data such as login credentials, banking details, and identity information [1]. One of the most common techniques used in phishing attacks is email spoofing, where attackers generate emails with falsified sender addresses to impersonate legitimate organizations or trusted entities. These phishing emails often appear to originate from reputable sources and are designed to lure users into visiting malicious websites or submitting confidential information through fraudulent forms. In many cases, cybercriminals also deploy malware on compromised systems to steal user credentials and gain unauthorized access to online accounts [2].

Phishers exploit multiple communication channels to collect user data, including email, online forums, URLs, instant messaging (IM), SMS, and phone calls [3]. The structure and appearance of phishing content are deliberately crafted to resemble authentic communications, thereby encouraging users to trust the message and unknowingly disclose sensitive information [4]. The primary objective of phishing attacks is to gain unauthorized access to confidential information for financial fraud or identity theft. As a result, phishing attacks have caused significant damage to individuals, organizations, and financial institutions worldwide [5].

The anti-phishing working group (APWG), a non-profit organization, maintains a global repository of verified phishing URLs and regularly publishes reports on phishing activities across the world [6]. According to recent reports, phishing incidents have increased dramatically in recent years, with the number of attacks nearly doubling between 2021 and 2022. In July 2022 alone, more than 280,000 phishing attempts were reported globally [7]. Webmail services remain one of the most frequently targeted sectors, and phishing attempts against well-known organizations increased from approximately 500 incidents in July 2022 to nearly 900 incidents by November 2022. Such attacks not only cause financial losses but also lead to severe cybersecurity risks for organizations and individuals.

A typical example of a phishing cyberattack involves sending an email that appears to originate from a trusted organization, such as a bank or corporate service provider, with the intention of persuading the recipient to open a malicious attachment or click on a fraudulent link. Once the victim interacts with the malicious content, attackers may gain access to confidential user information. Furthermore, phishing emails and websites are often carefully designed to closely mimic legitimate business platforms, making them difficult for users to distinguish from genuine services [8].

To address these challenges, artificial intelligence (AI) technologies have rapidly evolved and introduced intelligent techniques such as machine learning (ML) and deep learning (DL) for cybersecurity applications. AI-based methods have demonstrated strong capabilities in pattern recognition, anomaly detection, and adaptive learning, making them highly suitable for detecting sophisticated cyber threats [9]. Traditional ML approaches typically require manual feature extraction and feature selection processes, which depend heavily on human expertise. In such systems, feature engineering and classification are often performed as separate stages.

DL models overcome this limitation by automatically learning hierarchical representations of data and performing feature extraction and classification simultaneously, thereby improving detection accuracy and efficiency [10]. Unlike conventional ML models that rely on manually engineered features or third-party feature extraction tools, DL architectures automatically learn discriminative representations directly from raw data [11]. Furthermore, DL models are particularly effective when dealing with large-scale datasets, such as voice recognition, image classification, and phishing detection tasks, as they provide high performance and end-to-end learning capabilities. However, selecting the most appropriate algorithm for a given application remains challenging, and using an unsuitable model may significantly reduce detection accuracy and system efficiency [12].

Phishers continuously evolve their attack strategies by exploiting system vulnerabilities and users’ lack of awareness. As a result, early detection of phishing threats has become a critical requirement in modern cybersecurity systems. To address this issue, numerous anti-phishing detection techniques have been developed, and DL-based security solutions are increasingly being adopted across various sectors to combat emerging phishing threats [13]. Researchers have proposed several approaches for detecting phishing websites by leveraging the ability of DL models to extract meaningful features for URL classification. Many detection systems rely on a combination of lexical, structural, and statistical features derived from URLs, such as URL length, keyword frequency, character distribution, and domain-based characteristics.

II. Related Works

The Internet has gradually entered all spheres of life in modernity. The current situation of internet-based information and communication technology (ICT) is prone to a myriad of attacks and infiltrations and the loss of a lot of money. In [14], the dual-branch CNN-based multi-modal framework, when trained to extract representations on raw URLs and HTML features and achieves a high classification accuracy of 99.53%, is based on the convolutional feature extraction, which inhibits the model to capture dynamic lexical patterns and long-range sequential dependencies that are common in dynamically generated phishing URLs. In order to overcome this weakness [15], proposes a joint gradient boosting/recurrent neural network ensemble architecture, with gradient boosting and RNNs respectively approximating the static, interpretable attributes of URLs and character-level sequential dependencies, respectively. Nevertheless, even with better sequential learning, the ensemble quality of the model contributes to complexity in computations and does not have an explicit process of comparison of similarities between benign and phishing URLs at a representational level. In order to address the lack of direct similarity learning [16], suggests a Siamese network to share the weight between two long short-term memory (LSTM) subnetworks to allow robust feature representation learning through direct modeling of the relational distance between classes of URLs. Although this method enhances phishing and legitimate URL separation, it works more with sequence similarity and is not as essential in uncertainty management and rule-based reasoning, which are essential in the real-world noisy phishing dataset. To fill this gap [17], combines Neyman similarity with an Autoencoder with fuzzy neural network stacking and a deep belief network that is more robust due to the use of fuzzy reasoning and uncertainty modeling. However, the use of handcrafted similarity metrics and the use of many stacked operations makes the model more complex and prevents the scaling to large-scale and real-time implementation. In an effort to minimize the complexity of architectural design and increase the robustness of feature learning [18], proposes hybrid spatial-sequential attention CharGRU model which has a logically constrained neural network. Hybrid spatial-sequential attention module is suitable in capturing multi-scale URL invariance and logical constraints enhance the generalization through prior knowledge. Although these have the benefits, the model mostly works at the character-sequence level and does not explicitly utilize contextual bidirectional dependencies, which are important in making sense of phishing URLs containing obfuscated token structures. This is limited in [19], where a BiLSTM-gated highway attention CNN model captures contextual associations on either side, but at the cost of allowing fast convergence and low response time of 12.46 ms. Nonetheless, the deep hybrid architecture adds overhead in terms of memory and might fail to deploy in resource-limited environments. To strike a golden mean between detection efficiency and computation efficiency [20], suggests a hybrid A decision-tree model based on logistic regression, support vector classifier, as well as soft and hard voting. Despite good performance and performance, this assemblage is limited in its ability to automatically learn high-level representations out of the unstructured URL data due to the fact that it uses traditional ML classifiers. In order to enhance the learning of representations [21], proposes models that integrate both the LSTM and deep neural networks to perform a better task in terms of temporal modeling and non-linear feature extraction. However, such models remain based upon fixed sets of features and are not a complete character-level learning system. In order to remove the need to rely on handcrafted features altogether [22], introduces a new neural architecture where the process of discriminative multi-level character discovery can be performed through the end-to-end concatenation of four-channel information flow through cascading CNN, LSTM, and attention layers. In any case, the design achieves a competitive accuracy of 98.27, it does not explicitly involve adaptive feedback learning and generative pattern generalization which are necessary in detecting zero-day phishing attacks and quickly changing patterns of threats.

III. Proposed Methodology

In the current paper, we present URL-Phish, a phishing URL-detection algorithm based on generative AI and learns distribution-aware latent representations of raw URLs directly. It is an end-to-end pipeline, which consists of: (i) acquisition and annotation of the data, (ii) pre-process the URLs and standard forms, (iii) learning features of a variational latent model, and (iv) phishing classification with hybrid generative-discrimination decision module, which is complemented by a self-evolving threat engine. The aim is to improve generalization to both the zero-day phishing URLs and adversarial phishing URLs, by training a continuous latent manifold, which has been learned to capture structural variation. The proposed VGM framework is conceptually inspired by variational autoencoders (VAEs) but differs in both formulation and objective. Unlike standard VAEs, which assume a fixed isotropic Gaussian prior p(z) = N(0,I) and focus on reconstructing input data, VGM employs class-conditional latent distributions p (z | y = c) = N(μ_c,∑ c) to explicitly model the probabilistic structure of benign and phishing URL representations. Furthermore, VGM is not designed for data reconstruction; instead, it learns discriminative latent embeddings that facilitate probabilistic threat scoring and synthetic threat generation. This enables seamless integration with the SE-GTE, allowing the model to dynamically adapt to evolving phishing patterns. Therefore, VGM can be interpreted as a task-specific extension of VAE principles tailored for classification and adversarial threat modeling rather than a direct implementation of a conventional VAE.

d. Generative AI classification

Following the extraction of distribution-aware latent features using the generative encoder and variational modeling, the proposed system executes phishing detection through a classification module driven by generative AI. This module is engineered to maintain efficacy against advancing phishing tactics through the integration of a SE-GTE and a hybrid generative–discriminative classifier, as depicted in Figure 1.

Figure 1:

d.i. SE-GTE design

The SE-GTE continuously learns phishing behavior and generates synthetic threat patterns in the latent space. This helps the system anticipate new phishing strategies and enhances adaptability by expanding the learning boundary with simulated attack patterns.

$$T=Z+\delta$$

where Z is the latent representation and δ represents controlled perturbation used to generate new threats.

Algorithm 3:

Self-Evolving Generative Threat Engine (SE-GTE)

Input: URL sample u_i, latent dimension d, evolution noise scale τ, confidence threshold δ

Output: High-confidence synthetic threats {zj′} and threat scores S (·)

1. Receive input URL u_i from the pipeline.

2. Map the URL to latent embedding using Eq. (13):

   $$z_i=E_{\varnothing }(u_i),z_i\in R^d$$

3. Model benign and phishing latent behavior using Eq. (14):

   $$p(z|y=c)=N\left({\mu }_c,\Sigma \hspace{0.17em}c\right),\hspace{0.17em}where\hspace{0.17em}c\in \{0,1\}$$

4. Sample synthetic phishing candidates from the phishing distribution

   $$z_j^{\prime }\sim N\left({\mu }_1,\Sigma \hspace{0.17em}1\right),$$

5. Apply controlled perturbation to diversify synthetic threats (Eq. (15)):

   $$z_j^{\prime }=z_j^{\prime }+\in ,\in \sim N\left(0,\tau l\right)$$

6. Compute the probabilistic threat confidence score using Eq. (16):

   $$S(z)=logp(z|y=1)-logp(z|y=0)$$

7. Select only high-confidence synthetic threats using Eq. (17):

   $$S(z_j^{\prime })\ge \partial$$

8. Add selected $z_j^{\prime }$ into the evolving threat pool to enrich the classifier decision boundary.

9. Output the high-confidence threat embeddings and corresponding S (·) scores.

d.ii. Hybrid generative-discriminative classifier

This classifier combines the knowledge of patterns from the generative learning paradigm and the ability to predict from the discriminative learning paradigm. It makes a stable and accurate classification decision despite the changing patterns of phishing.

$$P(y|Z)=\alpha Pd+(1-\alpha )Pg$$

where Pd is discriminative probability an d Pg is generative likelihood.

Algorithm 4:

Hybrid Generative–Discriminative Classifier (EF-CS + Fusion)

Input: Latent feature y = z, fusion weight α

Output: Predicted class label $\widehat{c}\in \{0,1\}$

1. Receive latent representation y ≡ z from the VGM output.

2. Compute discriminative class probability using the EF-CS softmax formulation in Eq. (23):

   $$p(c|y,\Delta )=\frac{exp\left(w_c^{T}y+b_c\right)}{{\displaystyle {\sum }_{c\prime =1}^{C}exp\left(w_{c\prime }^{T}y+b_{c\prime }\right)}}$$

3. Compute generative modeling signal through exponential-family likelihood in Eq. (24):

   $$p\left(y,c|{\Delta }_c\right)={\pi }_{c}h(y)exp\left({\eta }_c^{T}T(y)-A({\eta }_c)\right)$$

4. Use both discriminative and generative signals for decision making.

5. Fuse both signals using the weighted decision criterion given in Eq. (25):

   $$\widehat{c}=arg\underset{c}{max}[\alpha \hspace{0.17em}logp(c|y)+(1-\alpha )logp(y|c)$$

6. Evaluate the fused score for c = 0 (benign) and c = 1 (phishing).

7. Select the class $\widehat{c}$ that maximizes the fused criterion.

8. Output the predicted label $\widehat{c}$ along with confidence.

9. Return $\widehat{c}$ .

IV. Results and Discussion

A thorough assessment and examination of the canonical proposed VGA-HyPhishNet in relation to the existing methods in the detection of URL-based phishing attacks. The results are analyzed in terms of various performance metrics, confusion matrices, ROC curves, computational costs, etc., in terms of the accuracy, robustness against class imbalance, and efficiency of the detection mechanism. The discussion also sheds light on the implications of the proposed framework in terms of the advantages, trade-offs, and consequences of the proposed hybrid mechanism in detecting phishing attacks. To ensure statistical robustness and reduce bias due to data partitioning, k-fold cross-validation was employed. Specifically, the dataset was partitioned into k equal subsets, and the model was trained and evaluated k times, with each subset used once as the test set while the remaining k − 1 subsets were used for training. The reported performance metrics correspond to the average across all folds, providing a reliable and generalized estimate of model performance.

For fair evaluation, all baseline models (URL-Transformer, BiLSTM-URL, and CharCNN-URL) were re-implemented under identical experimental conditions as in Table 1, including the same preprocessing pipeline, dataset splits, and evaluation metrics.

Table 2 presents the comparative performance of the proposed VGA-HyPhishNet against widely used URL-based phishing detection models. The proposed model achieves superior performance across all evaluation metrics, with an accuracy of 0.9873, precision of 0.9300, recall of 0.9497, and an F1-score of 0.9397. These results indicate its strong capability in accurately detecting phishing URLs while minimizing both FP and FN.

In comparison, the URL-Transformer attains an F1-score of 0.7899, reflecting limited robustness in handling class imbalance and evolving phishing patterns despite its ability to capture global token dependencies through self-attention. The BiLSTM-URL model demonstrates moderate recall but suffers from lower precision, resulting in an overall F1-score of 0.7477, indicating challenges in discriminating subtle phishing characteristics. Similarly, the CharCNN-URL model records the lowest F1-score of 0.7267, primarily due to its limited capacity to capture long-range dependencies in URL sequences.

The confusion matrices as in Figure 2 exhibit the classification behavior of the proposed VGA-HyPhishNet and the baseline models on benign and phishing URLs. With 14,875 benign and 1,661 phishing URLs accurately identified and the fewest FP (125) and FN (88), VGA-HyPhishNet exhibits the most balanced and dependable performance, demonstrating strong robustness against both forms of misclassification. The URL-Transformer, on the other hand, shows a greater number of FP (394) and FN (350), indicating decreased stability under changing phishing trends. The BiLSTM-URL and CharCNN-URL models exhibit significant degradation, with substantially larger false-negative counts (368 and 385, respectively), indicating their inadequate capacity to consistently detect phishing URLs. Overall, the confusion matrix analysis shows that, as compared to traditional discriminative methods, the generative representation learning, adaptive threat synthesis, and hybrid decision fusion used in VGA-HyPhishNet greatly minimize misclassification errors.

Figure 2:

The ROC curves presented in Figure 3 illustrate the trade-off between the TPR and false positive rate (FPR) for the proposed VGA-HyPhishNet model and the baseline approaches across different decision thresholds. From the figure, it is evident that the proposed VGA-HyPhishNet model outperforms all other models, achieving the highest AUC value of 0.939. This indicates strong discriminative capability and robustness in distinguishing phishing URLs from legitimate ones, even at relatively low FPRs.

Figure 3:

In comparison, the URL-Transformer model demonstrates moderate performance, with an AUC of 0.786, reflecting its limited ability to capture subtle variations in phishing URL patterns. Furthermore, the BiLSTM-URL and CharCNN-URL models exhibit comparatively lower performance, with AUC values of 0.734 and 0.690, respectively. These lower values suggest reduced generalization capability and weaker sensitivity to evolving and obfuscated phishing attacks.

Figure 4 shows the relative suitability of each model for real-time deployment based on the average inference time per URL. From the results, the CharCNN-URL model has the lowest inference time of approximately 15 ms. The reason for this is the simple convolutional processing, where the computational cost is linearly increasing with the size of the URL. The second lowest inference time is obtained by the VGA-HyPhishNet model with an average inference time of approximately 18 ms. This indicates that the costs of using the generative encoding, variational sampling, and hybrid fusing are marginal. The highest inference time is obtained by the BiLSTM-URL model with an average inference time of approximately 35 ms. The reason for this is the sequential processing of the characters in the forward and backward directions. The URL-Transformer model has the highest inference time of approximately 55 ms, showing the cost of using self-attention mechanisms, which have quadratic computational costs in the size of the input sequence.

Figure 4:

Using a dataset of roughly 100,000 URLs, this Figure 5 shows the training time per epoch for various phishing detection algorithms, illustrating their respective computational cost during learning. CharCNN-URL shows the lowest training cost at roughly 380 s per epoch, owing to its shallow convolutional architecture and excellent parallelization. VGA-HyPhishNet requires a slightly greater training time of roughly 400 s per epoch, which is ascribed to the added overhead of variational latent modeling and hybrid generative–discriminative learning, yet it remains computationally viable. BiLSTM-URL has a much higher training cost of around 1,300 s per epoch due to sequential processing and bidirectional recurrence over URL characters. Due to its high parameter counts and self-attention actions, URL-Transformer has the highest training cost at almost 2,500 s each epoch. These results reveal that VGA-HyPhishNet delivers good detection performance with a training cost close to lightweight CNN models, while being substantially more efficient than recurrent and transformer-based alternatives.

Figure 5:

The ablation research that was done to assess each component’s contribution to the suggested VGA-HyPhishNet system is shown in Table 3. The results show that overall, the model is the most effective overall, highlighting the significance of integrating all parts. The model performs worse when variational modeling is eliminated because it is less able to generalize to hidden phishing patterns. In a similar vein, the system’s capacity to learn from artificial phishing patterns is diminished when the SE-GTE is removed. Generative-only modeling captures structural behavior but lacks a strong decision-making capacity, whereas discriminative classification alone reduces accuracy by increasing FP. Although it works quicker, the discriminative-only variation is less stable when phishing patterns change. Overall, the research demonstrates that detection accuracy and robustness are greatly increased by the hybrid combination of generative learning, adaptive threat modeling, and categorization.

V. Conclusion

In this study, a novel hybrid generative-discriminative system was introduced under the name of VGA-HyPhishNet which aims at enhancing the phishing URLs in dynamic and real time settings. The proposed model uses generative representation learning compared to the traditional detection models which simply use the fixed classification boundaries; it tries to learn the aspects of phishing as a probabilistic activity. The system includes A SE-GTE, a generative encoder, VGM, and a hybrid decision classifier, which in the framework of experimental performance outperform current baseline models, in terms of F1-score, recall, accuracy, and precision and maintains an efficient inference time, suitable to be deployed in real-time. The model can anticipate concealed phishing habits by developing the synthetic threats with the help of SE-GTE, which increases its vulnerability to zero-day attacks significantly. Also, the discriminative confidence combined with generative likelihood hybrid combination ensures balanced decision making by reducing FN and FP, as well as enhance classification stability, threat evolution, and variational modeling that boosts the generalization of the system. The ablation study ensured that all architectural components play a crucial role in the work of the system through hybrid fusion, which enhances stability in classification, threat evolution, and variational modeling. When all is said and done, the proposed architecture demonstrates that discriminative learning combined with generative intelligence is a powerful technique toward preventing rapidly evolving phishing attacks.