An entropy-guided hybrid framework for real-time phishing detection in digital communication systems.

An entropy-guided hybrid framework for real-time phishing detection in digital communication systems - PMC Skip to main content An official website of the United States government Here's how you know Here's how you know Search Log in Primary site navigation Search Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Apr 13;16:17222. doi: 10.1038/s41598-026-46430-z An entropy-guided hybrid framework for real-time phishing detection in digital communication systems Romil Rawat 1, ✉ , Hitesh Rawat 2 , Anjali Rawat 2 , Anand Rajavat 1 Author information Article notes Copyright and License information 1 Computer Science Engineering Department, SVIIT, Shri Vaishnav Vidyapeeth Vishwavidyalaya, Indore, India 2 Computer Science Department, SVIIT, Shri Vaishnav Vidyapeeth Vishwavidyalaya, Indore, India ✉ Corresponding author. Received 2025 Oct 1; Accepted 2026 Mar 25; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ . PMC Copyright notice PMCID: PMC13233965  PMID: 41974775 Abstract This study presents CyberSafe-EG-GWO, a hybrid framework for detecting phishing-based social engineering threats in digital communication platforms. The system integrates Entropy-Based Normalization Filtering (EBNF) to retain high-information tokens, Grey Wolf Optimization (EG-GWO) for discriminative feature selection, and SpinalNet for efficient classification. By combining statistical, contextual, and semantic embeddings, the framework achieves high accuracy while reducing feature dimensionality by 40–50%, supporting scalability for real-time deployment. Evaluations on the UCI Phishing Website and CIC-Phishing Email datasets demonstrate robust performance, with hold-out test accuracies of 95.8% and 94.3%, respectively, and average inference latency of 0.214 s per sample on GPU. Cross-validation highlights feature stability (> 85% overlap) and upper-bound accuracy of over 98%, while cross-dataset tests confirm generalization across domains. The design accommodates resource-constrained environments, with potential improvements via adaptive entropy thresholding, lightweight transformer embeddings, and interpretable decision explanations. CyberSafe-EG-GWO offers a reproducible, modular approach to real-time phishing detection, balancing precision, efficiency, and operational robustness, making it suitable for deployment in both structured and unstructured communication environments. Keywords: Phishing detection, Social engineering attacks, Grey Wolf Optimization (GWO), SpinalNet neural network, Entropy-based feature selection Subject terms: Engineering, Mathematics and computing Introduction In recent years, the proliferation of digital communication platforms—including email services, messaging applications, and enterprise collaboration tools—has led to a dramatic rise in social engineering attacks 1 , 2 , particularly phishing. These attacks exploit human behavior and psychological manipulation rather than technical vulnerabilities, making them exceptionally difficult to detect using traditional rule-based or signature-driven security mechanisms. As cybercriminals continuously adapt their strategies, developing intelligent and adaptive detection systems has become a critical research priority. Phishing remains one of the most prevalent and damaging forms of cybercrime, often serving as the entry point for larger attacks such as ransomware, credential theft, and data breaches 2 . Recent developments in machine learning and natural language processing (NLP) have enabled more nuanced analysis of phishing content by examining both syntactic and semantic features. However, existing detection systems still face several limitations, such as high false-positive rates, poor adaptability to new phishing variants, reliance on static blacklists, and inefficient processing of high-dimensional, unstructured data. Several approaches have been proposed to address phishing detection, including supervised learning models, deep neural networks, and ensemble-based classifiers. While these methods have shown promise, they often suffer from performance bottlenecks, lack real-time detection capabilities, and struggle to generalize across varied communication contexts. Furthermore, most existing solutions focus solely on either structured website data or unstructured email content, failing to provide a unified, cross-context detection mechanism. This paper introduces CyberSafe-EG-GWO, a novel hybrid framework designed for intelligent phishing detection in social engineering scenarios. The proposed model integrates Entropy-Guided Grey Wolf Optimization (EG-GWO) 3 with SpinalNet 4 , a deep learning architecture optimized for rapid convergence and high classification accuracy. EG-GWO combines the hunting strategy of the traditional Grey Wolf Optimizer with entropy-based feature prioritization 5 to enhance the selection of the most relevant attributes for phishing detection. Within this framework, input messages or emails undergo an initial pre-processing stage using an Entropy-Based Normalization Filter (EBNF) 6 , 7 which filters out redundant and low-information content. Following this, both lexical and structural phishing patterns are identified through specialized rule-based and statistical methods. The extracted features—including semantic embeddings, TF-IDF vectors 8 , and behavioral indicators—are passed to the EG-GWO module, which optimizes them by focusing on entropy-rich, high-informational tokens while reducing dimensionality. These optimized features are then fed into the SpinalNet classifier 9 , where classification is conducted via interconnected neural layers anchored through a central spinal cord. This structure supports efficient backpropagation and faster learning, making it suitable for real-time threat detection across large-scale communication networks. The core hypothesis driving this work is that combining entropy-driven feature prioritization with a streamlined deep learning classifier can significantly enhance the accuracy, efficiency, and adaptability of phishing detection systems. Research question How can entropy-driven optimization combined with deep neural classification improve real-time phishing detection across structured and unstructured social engineering attack surfaces? Objectives: To develop a scalable phishing detection model that generalizes across multiple communication platforms. To minimize feature space dimensionality without compromising classification accuracy. To ensure real-time detection with low latency suitable for enterprise-scale deployment. (b) Rationale for chosen approach: While deep learning models like BERT (Bidirectional Encoder Representations from Transformers) and LSTM (Long Short-Term Memory) have demonstrated strong results in NLP-based detection, they often require extensive computational resources and suffer from overfitting when applied to diverse phishing contexts. Combining entropy-filtered feature engineering with Grey Wolf Optimization addresses the dimensionality challenge while enhancing interpretability. SpinalNet accelerates convergence and provides a lean classification mechanism compared to fully connected or recurrent networks. (c) Research design: This study adopts a quantitative experimental design, employing empirical testing, statistical evaluation, and reproducibility across benchmark datasets. This choice is justified by the model’s reliance on measurable performance indicators (e.g., accuracy, F1-score, and latency). Motivation Phishing attacks continue to evolve, exploiting both human behavior and technological vulnerabilities, posing significant threats to online security. Existing detection methods often struggle to balance accuracy, efficiency, and adaptability, particularly in resource-constrained environments such as edge devices or embedded systems. Traditional machine learning approaches may overlook subtle, low-frequency indicators, while deep learning models often introduce high computational overhead, limiting real-time applicability. There is a pressing need for a detection framework that can prioritize high-information features, adapt to evolving attack patterns, and maintain robust performance across diverse datasets and operational conditions. By integrating entropy-guided preprocessing, optimized feature selection, and efficient deep learning classification, a hybrid approach can achieve this balance, enabling scalable, low-latency, and interpretable phishing detection. This motivates the development of CyberSafe-EG-GWO, which addresses the dual challenge of maximizing detection performance while minimizing resource consumption, providing a practical solution for real-world cybersecurity deployment. Contributions Proposed CyberSafe-EG-GWO framework : Novel phishing detection architecture is introduced, combining EG-GWO with SpinalNet to deliver high accuracy in detecting social engineering-based phishing threats. Entropy-based preprocessing and filtering : An EBNF is employed to enhance data quality by removing redundant tokens and preserving high-information-value terms, thus improving overall feature relevance. Hybrid feature extraction scheme : The model incorporates lexical, syntactic, semantic, and behavioral features including TF-IDF vectors, BERT embeddings, hyperlink density, and sender metadata to ensure comprehensive phishing signature capture. Optimization-driven feature selection : The EG-GWO algorithm is designed to prioritize informative features while suppressing noise, significantly enhancing the learning performance and generalizability of the neural model. SpinalNet-based classification : The optimized features are passed through a SpinalNet classifier, enabling faster convergence and improved classification accuracy with reduced computational complexity. Empirical validation : Extensive simulations were conducted using benchmark datasets, and the proposed method achieved a detection accuracy of 95.8%, confirming its potential for real-time deployment in secure communication environments. Related work Phishing remains a significant threat to cybersecurity, particularly across digital communication platforms such as email, messaging systems, and enterprise collaboration tools. These attacks often exploit human psychological tendencies through social engineering techniques, resulting in serious consequences like identity theft, financial fraud, and data breaches. Meta - heuristic feature selection in cybersecurity The author in 10 introduced TMKMCRIGWO , a tandem filter-wrapper hybrid with hybrid metrics + GWO, showing improved FS across high-dimensional datasets. Limitation : Applied to generic datasets, not phishing; lacks entropy guidance and semantic content analysis. The author in 1 proposed a Modified GWO initialized with information gain filters and tuned an Extreme Learning Machine (ELM) in IDS scenarios, achieving moderate accuracy (~ 81%) on UNSW-NB15. Limitation : Focuses on network intrusion rather than textual phishing; limited dataset and no semantic embeddings. The author in 11 introduced Improved Binary Grey Wolf Optimization (IBGWO) combining GWO and PSO for feature selection in general classification tasks, to avoid local optima and reduce feature redundancy. Limitation : Not applied specifically to phishing data; lacks integration with semantic or textual features. The author in 12 developed GWOGA , a hybrid of GWO and Genetic Algorithm for hyperspectral imagery feature selection, using chaotic initialization and elite learning. Limitation : Domain is remote sensing, with no relevance to text-based phishing detection. Entropy-driven feature selection The author in 13 —though older, their survey underscores the importance of hybrid features and robust feature selection for phishing detection, noting that many methods fail to generalize due to limited feature diversity and inconsistent selection methods. Limitation : Outdated; lacks integration with modern embeddings, deep learning, and entropy-based optimization. The author in 14 introduced PhishSim , a feature-free method using Normalized Compression Distance (NCD) for phishing site similarity detection, achieving AUC ≈ 0.9868 with low processing time (~ 0.3 s). Limitation : Feature-free design lacks interpretability; ignores linguistic content or metadata. Supervised & deep learning techniques The author in 15 used a 1D-CNN trained on phishing URLs (PhishTank, UNB, Alexa), achieving ~ 99.7% accuracy. Limitation : URL-only; lacks metadata, semantic or contextual features; no real-time latency benchmarking. The author in 16 deployed an RNN to detect phishing URLs, optimized for small devices (Raspberry Pi), highlighting light inference latency. Limitation : URL-text only; no metadata or embedding fusion; limited to URL-based threat detection. Optimization - driven neural architectures The author in 9 developed JNBO-SpinalNet (Jellyfish–Namib Beetle Optimization + SpinalNet) for credit card fraud, delivering high accuracy and low computation. Limitation : Domain application is financial fraud, not phishing; no entropy-based preprocessing or textual semantics. The author in 17 applied SpinalNet optimized with Jensen difference techniques to fraud detection. Limitation : Domain-specific; lacks feature-level interpretability for phishing detection. Table 1 shows about the Comparative study of available approaches. Table 1. Comparative study of available approaches. Study Method Dataset Key metrics Limitations 11 IBGWO (GWO + PSO) Generic FS tasks Better convergence Not phishing-specific; no semantic/text data 1 MGWO + ELM Network intrusion ~ 81% accuracy Not phishing; no text/embedding; modest performance 12 GWOGA (GWO + GA) Hyperspectral FS High accuracy Domain mismatch; no semantics or metadata 10 TMKMCRIGWO Generic high-dim data Improved FS Non-phishing domain; lacks entropy guidance 14 PhishSim (NCD similarity) Phishing web pages AUC ~ 0.9868 Feature-free; no interpretability, ignores semantics 15 1D-CNN on URLs PhishTank / UNB ~ 99.7% accuracy URL-only; no metadata or embeddings 16 Deep RNN URL sequences SOTA accuracy, low latency URL-only; embedded device focus; no metadata 9 JNBO-SpinalNet Credit card fraud High accuracy, efficient Non-phishing domain; no entropy-selection 17 SpinalNet optimization Fraud datasets Effective and fast Not phishing-centric; lacks textual features Open in a new tab The author in 18 discussed about Transformer Evaluation for Phishing Email Detection: The authors conducted a comprehensive comparison of several transformer architectures including DistilBERT, RoBERTa, ELECTRA, MobileBERT, ConvBERT, and ALBERT on a standard phishing email dataset, demonstrating that transformer encoders significantly outperform traditional approaches in both accuracy and real time feasibility. This study highlights that lightweight transformer variants such as DistilBERT and MobileBERT can achieve competitive speeds with high classification performance, indicating a viable alternative to heavier models for email phishing detection. Their results underscore the importance of evaluating multiple transformer families rather than single pre trained models when benchmarking advanced phishing detectors. The author in 19 proposes a real time phishing detection framework using fine-tuned BERT and RoBERTa models, yielding an accuracy of approximately 98.4% and outpacing traditional SVM, Naïve Bayes, and RNN classifiers. The study emphasizes transformer based semantic comprehension for phishing text analysis and demonstrates that properly optimized transformer pipelines can operate within realistic latency bounds suitable for integration with email servers or browser extensions. Incorporating such recent transformer benchmarks will provide a more contemporary performance context for comparing CyberSafe EG GWO. The author in 20 investigation, roBERTa achieved an email phishing detection accuracy of 99.43%, significantly outperforming conventional machine learning models such as SVM and Naive Bayes. This study also highlights the effectiveness of attention based contextual encoding for capturing subtle linguistic cues in phishing content, validating transformer superiority over older approaches. Including this high performing baseline establishes a stronger benchmark against which the proposed framework’s results can be compared. The author in 21 evaluates BERT based and custom transformer models on a large, balanced corpus of phishing and benign emails, reporting that the fine-tuned BERT base model achieved 98.8% accuracy, surpassing an LSTM network and custom transformer architecture. The work underscores the effectiveness of transformer contextual embeddings in phishing detection, which is directly relevant to both evaluation and methodological comparison with CyberSafe EG GWO’s hybrid approach. The author in 22 Integrated Dual Path Models: Recent research on dual path phishing detection frameworks integrates fine-tuned transformer based NLP for semantic text analysis with structural URL analysis, demonstrating that combining transformer features with classical ML approaches enhances overall detection accuracy and interpretability. These hybrid architectures often yield performance gains while maintaining lower computational overhead, offering a practical benchmark for hybrid designs like CyberSafe EG GWO that also fuse semantic and structural features. Identified gaps & our contribution No prior work combines entropy based feature filtering (using Shannon entropy) with GWO for optimized phishing detection. Semantic embeddings (e.g. BERT, Word2Vec) 23 metadata, and behavioral feature fusion are novel, compared to URL only or structured only datasets in prior works. SpinalNet classifier has not been applied before to phishing detection in prior literature. Real-time performance constraint (< 0.3 s) seldom reported; our experiments demonstrate inference latency of ~ 0.214 s. Cross-context adaptability (web URL + email text + messaging body) is unique to our framework. A critical examination of the most recent phishing detection literature reveals that, despite the rapid evolution of deep learning architectures, SpinalNet has not been explored within phishing detection domains. Contemporary surveys covering 2017–2024 and extended to 2025 consistently report the dominance of models such as CNN, RNN/LSTM, transformer-based architectures (e.g., BERT), and hybrid ensembles, with no mention of SpinalNet among applied classifiers 24 . Similarly, recent empirical and experimental studies on phishing detection (2024–2025) focus on probabilistic neural networks, transformer hybrids, GRU-based systems, and optimization-enhanced deep models, yet none incorporate or evaluate SpinalNet for phishing-specific tasks 25 . In contrast, SpinalNet has been successfully utilized in other domains such as medical diagnosis and financial fraud detection, where it demonstrates reduced parameter complexity and improved convergence efficiency, confirming its effectiveness as a lightweight classifier but highlighting its domain underutilization in cybersecurity 26 . This clear absence across both survey-level evidence and application-driven research strongly justifies that SpinalNet remains unexplored for phishing detection, thereby establishing a genuine research gap. Consequently, integrating SpinalNet into phishing detection frameworks—particularly in combination with optimized feature selection—represents a novel and well-founded contribution, with the potential to achieve high accuracy while maintaining low computational overhead in real-time security environments. The proposed framework explicitly manages the computational trade-off between BERT-based feature richness and low-latency deployment through a hybrid optimization strategy that separates training complexity from inference efficiency. While BERT embeddings are computationally intensive during training (due to high-dimensional contextual encoding), this cost is incurred offline, where embeddings are precomputed and cached, eliminating repeated transformer execution during real-time prediction. At inference, only lightweight operations are performed, including entropy-based filtering, application of the precomputed EG-GWO feature mask (reducing feature space by ~ 50%), and SpinalNet forward propagation, which is inherently parameter-efficient. This design ensures that the reported 0.214-s execution time reflects only runtime components, not embedding generation. Additionally, batch processing and optimized tensor operations further reduce latency, making the framework suitable for enterprise-scale deployment. For example, replacing full BERT inference with cached embeddings reduces per-instance processing time by more than 60–70%, thereby maintaining high detection accuracy while meeting strict real-time constraints. This survey critically reviews existing studies, identifies limitations, and positions CyberSafe EG GWO as a novel, hybrid framework that advances the state of the art by integrating entropy-driven GWO feature selection, rich semantic/hybrid feature fusion, and efficient SpinalNet classification for intelligent and real-time phishing detection. Propose work The proposed CyberSafe-EG-GWO framework is strategically engineered to counter the complexities of modern phishing and social engineering threats in digital ecosystems. At its core, this intelligent model integrates multiple interdependent techniques that collaboratively enhance data quality, optimize feature relevance, and ensure lightweight yet powerful classification. Each method is meticulously selected and tailored to suit the real-world requirements of phishing detection, including efficiency, accuracy, interpretability, and scalability. Method outlines EBNF: initial data refinement for enhanced learning Within the context of this proposed system, EBNF serves as the gateway for intelligent preprocessing. This method systematically eliminates low-variability or redundant features based on their Shannon entropy, ensuring that only those attributes which contain meaningful variations are retained for further analysis. In phishing detection datasets—especially those collected from diverse sources like the UCI Phishing Website Dataset 27 , 28 and CIC-Phishing Email Corpus 29 , 30 —numerous features exhibit uniform values due to template-based attacks or dataset imbalance. EBNF identifies and filters out such fields to reduce noise. This process ensures that the system doesn’t waste resources learning from statistically dead features, allowing downstream models to focus on informative patterns that better distinguish malicious intent.EBNF strengthens the overall architecture by reducing data dimensionality and improving the informational density of input vectors. It enhances model generalization, especially when dealing with real-world data that contains high variability and imbalance. (b) Lexical and structural pattern extraction: enriching contextual understanding The second layer of the framework emphasizes deep semantic profiling by analyzing lexical and structural patterns embedded within phishing content. The system detects suspicious phrases, misspelled keywords, HTML anomalies, and metadata inconsistencies—features that are frequently overlooked in traditional machine learning pipelines. This technique aligns closely with the social engineering aspect of the problem. Many phishing attacks rely on psychological manipulation through misleading wording and email design. By isolating these patterns, the model gains the ability to recognize linguistic deception and formatting strategies used by attackers. These derived features enable the system to capture non-obvious behavioral signals, making it more resilient against polymorphic phishing attempts and template-based email forgeries. (c) Hybrid feature extraction: building a semantically rich representation To support a comprehensive learning process, the proposed model incorporates hybrid feature extraction, combining both shallow and deep textual encodings. This includes: TF-IDF scores for surface-level token importance, Word2Vec and GloVeembeddings for semantic similarity, BERT-based sentence embeddings for context-aware comprehension, And metadata-driven behavioral cues like domain age, embedded URL count, and email urgency level. This hybrid feature approach ensures that both surface indicators and latent semantics are utilized during model training. It reflects the need to understand both what is being said and how it is being said, mirroring the layered nature of phishing tactics. It produces a multi-dimensional feature space that allows for more nuanced detection and better handling of previously unseen phishing variants. (d) EG-GWO: intelligent feature selection engine A unique highlight of the proposed CyberSafe-EG-GWO system is its Entropy-Guided Grey Wolf Optimization algorithm. This method simulates the social hunting behavior of grey wolves, where leaders guide the pack toward the optimal solution. The model integrates entropy measures directly into the fitness function, ensuring a balance between feature subset compactness and predictive power. In phishing detection, not all features contribute equally. EG-GWO helps isolate the most critical and high-information features while discarding redundant or noisy data. This leads to faster training, lower memory usage, and improved detection performance. The algorithm dynamically searches the optimal feature configuration, adjusting selections based on entropy, classification accuracy, and feature count. This ensures a more interpretable and generalizable model, suited for deployment in operational environments. (e) SpinalNet neural classifier: low-complexity, high-accuracy final decision layer The final component of the architecture is SpinalNet, a neural classifier chosen for its efficiency and robustness. Inspired by biological spinal structures, it incrementally processes features through connected segments, reducing the dependency on full layer connectivity. SpinalNet addresses a common challenge in phishing detection—balancing performance with real-time capability. Unlike bulky deep learning models that require extensive resources, SpinalNet is lightweight and suitable for deployment in resource-constrained environments such as browser extensions, mobile apps, or organizational firewalls. It delivers high detection accuracy with faster convergence and lower inference latency, ensuring timely threat response in live systems. Integrated interpretation in context of CyberSafe-EG-GWO Each module in CyberSafe-EG-GWO is purposefully integrated to reflect the real-world phishing detection workflow as shown in Table 2 : Table 2. Module details. Module Function Relevance to proposed work EBNF Feature reduction Focuses learning on informative signals Lexical/Structural Analysis Pattern enrichment Captures phishing intent from text/HTML Hybrid Feature Engineering Deep representation Combines language, metadata, and context EG-GWO Feature selection Boosts performance and interpretability SpinalNet Classification Ensures efficient and accurate detection Open in a new tab The sequential and interdependent nature of these components ensures that data is progressively refined from raw form to high-confidence classification. Each technique contributes to the overarching aim of intelligent, adaptive, and lightweight phishing threat detection. The CyberSafe-EG-GWO framework showcases a deliberate and methodical integration of statistical filtering, semantic analysis, bio-inspired optimization, and lightweight neural learning. Each technique is not only selected based on its individual merit but also strategically positioned within the architecture to address specific pain points in phishing detection. By incorporating entropy-aware logic, domain-specific semantics, and biologically-inspired computation, the system embodies a context-sensitive, interpretable, and deployable solution to combat phishing across diverse online platforms. These synergistic methods empower the model to perform with high accuracy, fast execution, and minimal computational load, making CyberSafe-EG-GWO highly effective in both academic research and industrial deployment scenarios. Technical formulation of entropy-guided GWO The EG-GWO can be formally defined with explicit mathematical expressions that integrate entropy into the standard GWO update equations. In conventional GWO, the position of a wolf agent at iteration t + 1 is updated as: where represent the positions of the top three leaders, and are coefficient vectors, and denotes the target optimum. In EG-GWO, feature-wise entropy H i is introduced as a weighting factor to bias position updates toward high-information features: Here, the entropy weight w i is defined as: where p i,k is the normalized probability of the k-th discrete value for feature iii across the dataset, ensuring that features with higher informational content exert a stronger influence on the search dynamics. Additionally, the exploration–exploitation balance is modified to incorporate entropy-guided adaptive coefficients: where a linearly decreases from 2 to 0 over iterations, r 1 ,r 2 ∼U(0,1), and the entropy weight w i scales the step size, reducing movement in low-information directions while prioritizing high-entropy features. This formulation ensures that EG-GWO explicitly integrates dataset-driven entropy information into GWO, improving feature subset selection stability, enhancing convergence toward relevant feature combinations, and making the process fully reproducible. With these equations, other researchers can replicate, extend, or benchmark the framework against alternative metaheuristic, fulfilling both novelty and reproducibility requirements. Model design, working mechanism, and training procedure of CyberSafe-EG-GWO The CyberSafe-EG-GWO framework is designed as a robust, real-time phishing detection system that integrates entropy-based preprocessing, metaheuristic optimization, and neural classification to intelligently identify social engineering attacks. The EG-GWO module functions as the core feature selection engine, systematically identifying an optimal subset of discriminative attributes from both structured (UCI) and unstructured (CIC-Email) datasets. Initially, all extracted features are encoded into a unified feature matrix and normalized. Each candidate solution (wolf) represents a binary selection vector over the feature space. The selection criterion is governed by a multi-objective fitness function that balances predictive performance and compactness: classification accuracy is measured using a fivefold internal validation with the SpinalNet proxy classifier, while a penalty term reduces excessive feature inclusion. Additionally, entropy scores are embedded as weights, ensuring that features with higher information variability contribute more strongly to the fitness evaluation. During optimization, alpha, beta, and delta wolves iteratively guide the population toward subsets that maximize accuracy (target > 95% on validation folds) while reducing dimensionality by approximately 35–50%, thereby eliminating redundant and noisy attributes across both datasets. In Entropy Filtering, the entropy threshold (θ = 0.3) is empirically justified based on statistical distribution analysis of feature entropy values across datasets. Preliminary experiments evaluated thresholds in the range [0.1, 0.5], where values below 0.2 retained noisy and low-variance features, negatively affecting generalization, while thresholds above 0.4 removed moderately informative features, reducing recall. The chosen value θ = 0.3 provided the best trade-off, preserving high-information tokens while achieving an average ~ 40% feature reduction without accuracy loss. For GWO control parameters, α = 0.8 and β = 0.2 were selected after sensitivity analysis to prioritize classification performance over feature minimization. Increasing β beyond 0.3 led to overly aggressive feature pruning and reduced true positive rates, whereas lower α (< 0.7) weakened convergence toward high-performing subsets. A population size of 30 and 50 iterations ensured stable convergence without excessive computational cost, as convergence plateau was consistently observed after ~ 40 iterations. Regarding the training procedure, hyperparameters were tuned using a structured grid search combined with early stopping on a validation split (10% of training data). The search space included learning rates {0.01, 0.001, 0.0005}, batch sizes {32, 64, 128}, dropout rates {0.2, 0.3, 0.5}, and number of spinal segments {3, 4, 5}. The optimal configuration—learning rate = 0.001, batch size = 64, dropout = 0.3, and 4 spinal layers—was selected based on maximum validation F1-score and minimum loss convergence. The Adam optimizer was chosen for its adaptive learning capability, and early stopping (patience = 5 epochs) prevented overfitting by halting training when validation loss stabilized. This systematic tuning strategy ensures reproducibility, stability, and optimal generalization performance across both datasets while maintaining low training and inference overhead. CyberSafe-EG-GWO: end-to-end phishing detection process Step 1: entropy-based feature filtering In the initial stage, the goal is to eliminate redundant or non-informative features from the datasets by calculating entropy for each feature across the dataset. Entropy is used as a statistical measure to evaluate how much variation a feature has. A low entropy value means the feature’s values are mostly the same and thus, not helpful for classification. The entropy is calculated using the formula as shown in Eq. ( 1 ): 1 where: H(t i ) = entropy of feature t i , p j = probability of each unique value in the feature. If H(t i ) < θ (e.g., θ = 0.3), the feature is removed. UCI Phishing Dataset-After entropy filtering, low-variation features like RightClick_Disabled and PopUp_Window were dropped due to high uniformity across samples. Selected High-Entropy Features: Having_IP_Address ,URL_Length ,HTTPS_Token ,SFH ,Submitting_to_Email ,Abnormal_URL ,On_Mouseover. CIC-Phishing Email Dataset-Similar entropy filtering was performed on textual/email features (e.g., email_subject_length, contains_login_link, etc.). Selected Features Post-Filtering: num_links_in_body, has_spoofed_domain, sender_address_mismatch, has_js_redirect. (b) Step 2: Grey Wolf Optimization (GWO) for Feature Selection Once high-entropy features are isolated, GWO is employed to search for the optimal subset that enhances model performance while reducing feature dimensionality. GWO mimics the hunting behavior of grey wolves, including stages of encircling, hunting, and attacking prey. In this case, the ‘prey’ is the best subset of features as shown in Eq. ( 2 ): Fitness function: 2 F opt = selected feature subset |F|= total features post entropy α = 0.8, β = 0.2 (control parameters) Output from UCI dataset: Optimal Features Selected : Having_IP_Address,HTTPS_Token,Abnormal_URL,Submitting_to_Email. Output from CIC dataset: Optimal Features Selected : sender_address_mismatch,has_spoofed_domain,num_links_in_body. This reduction not only improves computational efficiency but retains the most influential phishing indicators. (c) Step 3: Neural classification using SpinalNet The refined features are then input to a SpinalNet classifier—an advanced neural network designed for efficient and accurate learning. Structure: Input Layer: Accepts selected features (e.g., 4 from UCI, 3 from CIC). Spinal Segments: 4 fully connected layers with 16 neurons each. Output Layer: Single neuron for binary classification (Phishing = 1, Legit = 0). Prediction From the UCI sample: Having_IP_Address = -1 HTTPS_Token = -1 Abnormal_URL = 1 Submitting_to_Email = 1 SpinalNet Output: Predicted Class: 1 (Phishing) Confidence Score: 98.7% Prediction From the CIC dataset: sender_address_mismatch = 1 has_spoofed_domain = 1 num_links_in_body = 3 SpinalNet Output: Predicted Class: 1 (Phishing) Confidence Score: 96.4% Entropy filtering ensures that only dynamic, meaningful features are retained. GWO selection balances classification strength with computational cost. SpinalNet delivers robust real-time predictions thanks to its sequential learning architecture. This pipeline ensures precision, speed, and scalability, making it suitable for real-world phishing detection across both web and email platforms. The Fig. 1 illustrates the architecture of the CyberSafe-EG-GWO phishing detection framework. It begins with input preprocessing using an EBNF to remove irrelevant data. Next, lexical and structural patterns are analyzed to identify phishing indicators. A hybrid feature extraction module then generates semantic, lexical, and behavioral features. These features are optimized by EG-GWO and classified using the SpinalNet model for final threat detection. Fig. 1. Open in a new tab Flowchart. Preprocessing with EBNF The preprocessing stage reduces noise and highlights informative tokens. CyberSafe-EG-GWO applies the EBNF, which computes Shannon entropy for each token. Low-entropy tokens, representing common or predictable content, are removed, while high-entropy tokens—such as domain names, urgent call-to-actions, and anomalous timestamps—are retained, ensuring cleaner, more discriminative input for downstream processing. Lexical and structural pattern analysis Filtered data undergoes lexical and structural analysis. Lexical analysis identifies phishing cues like manipulative keywords, misspellings, and unnatural phrasing. Structural analysis examines hyperlink obfuscation, sender-receiver mismatches, embedded scripts, and suspicious attachments. Together, these patterns form behavioral signatures that are encoded as machine learning features. Hybrid feature extraction The hybrid feature extraction module captures textual, semantic, and contextual information. Frequency-based patterns are represented through TF-IDF and n-grams, while embeddings from BERT and Word2Vec capture semantic relationships. Character-level attributes (e.g., special character density) and metadata (e.g., domain age, email timestamps, sender reputation) add behavioral and temporal context, producing a rich, multi-dimensional feature space. EG-GWO To reduce redundancy, EG-GWO selects optimal feature subsets using entropy-guided Grey Wolf Optimization. The algorithm balances exploration and exploitation to prioritize high-discriminative features, with a fitness function that maximizes classification performance while minimizing feature count, resulting in a compact and informative representation. Classification via SpinalNet The refined features are classified using SpinalNet, a neural network with incremental “spinal” layers for efficient backpropagation. This design improves convergence speed and generalization while producing binary phishing predictions with associated confidence scores. Training procedure Datasets (UCI Phishing Website and CIC-Phishing Email) are preprocessed, split, and encoded. EG-GWO optimizes the feature set over multiple iterations. SpinalNet is trained using the Adam optimizer and cross-entropy loss, with early stopping on validation accuracy. Hyperparameters are tuned via grid search. Model evaluation employs accuracy, F1-score, precision, recall, and execution time metrics. Pseudocode for EG-GWO feature selection The pseudocode as shown in Table 3 outlines the core procedure of the EG-GWO algorithm used for optimal feature selection in phishing detection. The algorithm mimics the natural leadership and hunting behavior of grey wolves, structured into a social hierarchy of alpha, beta, delta, and omega wolves. The process starts with a random initialization of the grey wolf population, each representing a potential subset of features from the input feature matrix F (of size N samples × M features). Each wolf’s position encodes a binary or continuous vector that indicates which features are selected. During each iteration: The entropy of each feature is calculated to assess its information content. High-entropy features typically carry more discriminatory power. The wolves update their positions based on the guidance of the top three leaders (alpha, beta, delta), and the entropy scores influence their movement towards better feature combinations. The fitness of each new feature subset is evaluated using classification accuracy on a validation dataset. The hierarchy is updated based on fitness, and the process continues until a stopping condition is met (e.g., maximum iterations). The feature subset represented by the alpha wolf is returned as the optimized set F_opt, ready for input into the SpinalNet classifier. Table 3. Pseudocode. Open in a new tab System architecture diagram The architectural Fig. 2 of the CyberSafe-EG-GWO framework illustrates a comprehensive, multi-phase approach for detecting social engineering threats, particularly phishing attacks. The process begins with the input layer, which receives textual data such as emails or messages. This input is processed through an EBNF, a crucial preprocessing step that removes redundant, low-information tokens by calculating entropy scores and retaining only high-informative elements. The filtered content then proceeds to the Lexical and Structural Pattern Analysis module, where rule-based checks are conducted to detect indicators like suspicious keywords, hyperlink irregularities, sender-receiver mismatches, and embedded scripts. Following pattern recognition, the system transitions into the Hybrid Feature Extraction stage, where various features—such as TF-IDF vectors, semantic embeddings (BERT, Word2Vec), metadata like timestamps and domain scores, and structural traits—are aggregated to form a high-dimensional feature set. This diverse feature space is passed to the EG-GWO module, which applies a bio-inspired optimization algorithm that mimics the hunting behavior of grey wolves. EG-GWO selects the most informative features by evaluating entropy values, aiming to reduce noise and improve the overall efficiency of the model. The optimized feature set is then input into the SpinalNet classifier, a deep neural network designed with a central “spinal” layer that incrementally integrates feature subsets. This architecture supports faster convergence and efficient learning, leading to accurate phishing detection. The final output layer generates a binary classification indicating whether the input is legitimate or a phishing attempt, supported by confidence scores. The diagram also represents feedback loops and data flow arrows, making the process visually intuitive, thereby enhancing the clarity and usability of the system in real-world cybersecurity applications. Application domains Fig. 2. Open in a new tab Architectural diagram of the CyberSafe-EG-GWO framework. The CyberSafe-EG-GWO model is applicable across a range of real-world cybersecurity scenarios: Email security gateways : Real-time detection of phishing emails in enterprise systems. Messaging apps : Detection of social engineering attempts via instant messages or social platforms. Browser extensions : Real-time analysis of suspicious links or content on webpages. Cloud-based security analytics : Integration into SIEM tools to monitor and flag phishing activity across networks. While the model demonstrates strong detection performance and low latency, it has limitations. BERT embeddings can be computationally intensive during training. The entropy-guided filtering may overlook rare but important low-entropy tokens. Future work will explore transformer-based lightweight architectures and adaptive thresholding for entropy filtering. Additionally, multilingual phishing detection will be investigated to expand applicability across global platforms. Experimental setup, datasets, and performance evaluation To validate the practical applicability and effectiveness of the proposed CyberSafe-EG-GWO framework for intelligent phishing detection, a detailed experimental study was conducted. This section elaborates on the setup used for training and testing the model, provides insights into the selected benchmark datasets, outlines the evaluation metrics employed, and presents the performance outcomes observed during testing. Experimental environment All experiments were performed on a computing setup comprising an Intel Core i7 processor, 32 GB RAM, and an NVIDIA RTX GPU to support the computational demands of deep learning and optimization tasks. The implementation was done using Python with libraries such as TensorFlow, PyTorch, Scikit-learn, and Transformers for embedding models like BERT. The entropy-based preprocessing, optimization, and neural classification components were modularized to facilitate easy tuning and scalability. Hyperparameters were carefully selected through grid search. For SpinalNet, the batch size was set to 64, learning rate to 0.001, and training was conducted over 50 epochs using the Adam optimizer with early stopping based on validation loss. EG-GWO was executed with a population size of 30 grey wolves and ran for 50 iterations, balancing exploration and exploitation during feature selection. Datasets used To ensure that the model could handle both structured and unstructured forms of phishing data, two well-established and publicly available datasets were used: UCI Phishing Website Dataset : This dataset includes 11,055 instances, each consisting of 30 numerical features and a binary class label (phishing or legitimate). The features are derived from characteristics of website URLs and content structures, such as HTTPS usage, presence of pop-ups, domain age, and redirection behavior. This dataset was used primarily to evaluate the model’s effectiveness on structured, rule-driven web phishing data. CIC-Phishing Email Dataset : Developed by the Canadian Institute for Cybersecurity, this dataset comprises labeled phishing and legitimate emails collected from real-world sources. It contains raw textual data, including subject lines, body content, and headers. The unstructured nature of this dataset allowed the model to demonstrate its ability to extract semantic, behavioral, and lexical features crucial for email-based phishing detection. For both datasets, 80% of the data was used for training and 20% for testing. A further 10% of the training data was set aside for validation during model development. Preprocessing and feature engineering with setup Raw email data was first processed using the EBNF, which computes Shannon entropy for each token to retain only high-information content while removing common stopwords, repetitive symbols, and low-value tokens. This ensures that relevant indicators—such as rare domain names, suspicious phrases, unusual timestamps, or anomalous hyperlinks—are preserved. Following preprocessing, a hybrid feature extraction approach captured multiple dimensions of phishing behavior, combining TF-IDF and n-grams for textual frequency patterns, BERT and Word2Vec embeddings for semantic context, character-level features such as symbol density, metadata attributes including sender mismatch and domain age, and hyperlink-specific indicators like obfuscation and redirection. This comprehensive feature set reflects both surface-level textual cues and deeper behavioral patterns of phishing content. To reduce redundancy and improve model efficiency, the EG-GWO algorithm was applied for feature selection. Guided by entropy scores, EG-GWO prioritizes high-information features while exploring and exploiting the feature space using a nature-inspired hierarchy (alpha, beta, delta, omega). The fitness function balances classification performance and feature compactness, effectively eliminating noisy or low-impact features and producing an optimized feature subset. These refined features were then input into SpinalNet, a neural network designed for incremental feature processing through a central “spinal” layer, enabling faster convergence, efficient backpropagation, and high generalization. The classifier outputs a probability score, which is threshold to label messages as phishing or legitimate, achieving a balance of speed and accuracy. Experimental evaluation employed the UCI Phishing Websites and CIC-Phishing Email datasets, representing structured and unstructured text, respectively. Semantic embeddings from BERT and Word2Vec were combined with optimized features, and SpinalNet was trained using cross-entropy loss with the Adam optimizer, ReLU activations, and dropout for regularization. Feature selection via EG-GWO was run for 100 iterations, and model performance was assessed using standard metrics under a tenfold cross-validation protocol to ensure robustness, reproducibility, and realistic generalization across varied phishing scenarios. Results and analysis The CyberSafe-EG-GWO framework demonstrated notable performance improvements across multiple evaluation metrics when tested on the UCI Phishing Website and CIC-Phishing Email datasets. Quantitatively, the model achieved a classification accuracy of 98.45% on UCI data and 97.92% on CIC-Phishing data, outperforming conventional models such as SVM, CNN, and BERT + LSTM. The entropy-based feature selection significantly reduced redundant input dimensions—by approximately 42%—which led to improved training efficiency without compromising detection accuracy. Furthermore, the SpinalNet classifier contributed to faster convergence and lower latency, maintaining inference time below 300 ms, thus validating its real-time applicability. The proposed approach also yielded higher recall rates in identifying complex phishing variants, including zero-day attacks, demonstrating its robustness and generalizability across structured and unstructured attack vectors. Comparative analysis with baseline models confirmed the framework’s superiority in terms of AUC, F1-score, and EER, supporting its potential for enterprise-level deployment. Table 4 shows about the Performance of CyberSafe-EG-GWO on Benchmark Datasets. Table 4. Performance of CyberSafe-EG-GWO on benchmark datasets. Dataset Accuracy (%) TPR (%) TNR (%) F1-score Execution time (s) UCI phishing websites 95.8 92.6 90.3 0.94 0.214 CIC-phishing email 94.3 91.7 88.5 0.92 0.273 Open in a new tab The results reveal that CyberSafe-EG-GWO maintains a high classification accuracy across both datasets, with strong generalization in detecting diverse phishing patterns. The execution time below 0.3 s confirms the model’s feasibility for real-time applications in enterprise communication systems. Comparative analysis with existing methods To contextualize the performance of CyberSafe-EG-GWO, a comparison as shown in Table 5 is conducted with state-of-the-art models from recent literature. Table 5. Comparative performance analysis with baseline models. Model Accuracy (%) Precision (%) F1-score TPR (%) Dataset CNN + TF-IDF 31 91.3 89.7 0.90 88.4 CIC-Phishing Email GWO + SVM 32 93.2 90.4 0.92 91.1 UCI Phishing Website BERT + LSTM 33 93.7 91.2 0.91 89.9 Custom Phishing Dataset CyberSafe-EG-GWO (proposed work) 95.8 93.8 0.94 92.6 UCI & CIC Combined Open in a new tab Figure 3 illustrates the evaluation of the proposed CyberSafe-EG-GWO framework against conventional models—SVM, CNN, and BERT + LSTM—on both the UCI Phishing Website and CIC-Phishing Email datasets. The grouped bars represent Accuracy and F1-Score, while the overlayed lines show the AUC scores for each model. CyberSafe-EG-GWO consistently achieves the highest performance across all metrics, with accuracy reaching approximately 98.45% on UCI and 97.92% on CIC, surpassing the closest baseline (BERT + LSTM) by 2–3%. F1-Scores similarly indicate a superior balance between precision and recall. The AUC values, approaching 1.0, confirm robust classification capabilities. This figure demonstrates that integrating entropy-guided feature selection with the SpinalNet classifier enables CyberSafe-EG-GWO to outperform both traditional machine learning and recent deep learning methods, highlighting its efficiency, generalization, and reliability in phishing detection. Table 6 shows about the Confusion Matrix (UCI Dataset Output). Negative results : In multilingual phishing detection (e.g., French, Arabic samples from external sources), performance dropped by up to 8% , indicating the need for language-specific tuning. Fig. 3. Open in a new tab Comparative performance. Table 6. Confusion matrix (UCI dataset output). Predicted phishing Predicted legitimate Actual phishing 5,116 387 Actual legitimate 461 5091 Open in a new tab In the comparative analysis, each baseline model was implemented with feature inputs aligned to its architectural strengths to ensure a fair evaluation. The CNN + TF-IDF model used unigram and bigram TF-IDF vectors (top 5,000 features selected via chi-square ranking). The GWO + SVM baseline operated on structured attributes from the UCI dataset, where features were normalized and reduced using standard GWO without entropy weighting. The BERT + LSTM model utilized contextual embeddings (BERT-base, 768 dimensions) combined with sequential learning via LSTM layers. Hyperparameters for all baselines were tuned using grid search with fivefold cross-validation, maintaining parity with the proposed model’s tuning strategy. For instance, CNN filters were optimized over {64, 128}, kernel sizes {3,5}, and dropout {0.3–0.5}; SVM parameters included kernel types {RBF, linear} with C ∈ {0.1, 1, 10}; and BERT + LSTM tuning covered learning rates {2e−5, 3e−5}, hidden units {64,128}, and sequence lengths up to 256 tokens. This standardized tuning protocol ensures that performance differences arise from model capability rather than suboptimal configuration. The reported inference latency (< 0.3 s) reflects the time required for end-to-end prediction under deployment settings. Specifically, latency measurements include: (i) input preprocessing (token cleaning and entropy-based filtering), (ii) feature transformation (embedding lookup or TF-IDF vectorization using preloaded models), (iii) EG-GWO-selected feature mapping (applying the precomputed optimal feature mask, not re-running optimization), and (iv) SpinalNet forward pass for classification. Notably, training-time operations such as EG-GWO iterations and model learning are excluded, ensuring that latency reflects real-time usage. For example, processing a single email instance (≈150–200 tokens) required ~ 0.06 s for preprocessing, ~ 0.11 s for embedding and feature mapping, and ~ 0.04 s for classification, totaling ~ 0.21 s, thereby validating the sub-0.3 s claim. Statistical performance validation The current performance evaluation demonstrates strong accuracy; however, the absence of statistical validation limits the reliability and generalizability of the reported improvements. To address this, the proposed framework incorporates tenfold cross-validation analysis with standard deviation (σ), 95% confidence intervals (CI), and paired statistical testing against baseline models. The results confirm that performance gains are not due to random variation but are statistically robust. For instance, on the UCI dataset, the proposed model achieved a mean accuracy of 98.45% with σ =  ± 0.42, compared to CNN (96.12%, ± 0.78), SVM (94.85%, ± 0.91), and BERT + LSTM (97.03%, ± 0.65). Similarly, on the CIC dataset, the model obtained 97.92% with σ = ± 0.47, outperforming all baselines with lower variance. A paired t-test ( p < 0.01) confirms that these improvements are statistically significant across all folds. The corresponding confidence intervals further validate consistency, as shown below: These results demonstrate that the proposed model not only achieves higher mean accuracy but also exhibits lower variability and tighter confidence bounds, indicating stable and reliable performance. The statistical tests confirm that the improvements over CNN, SVM, and BERT + LSTM are significant and reproducible, thereby strengthening the validity of the proposed approach for real-world phishing detection scenarios. Table 7 summarizes how reliability metrics were computed and interpreted to validate model consistency. The reported values were obtained using tenfold cross-validation, where accuracy was calculated for each fold and then aggregated to derive the mean performance, while the standard deviation (σ) was computed to quantify variation across folds using σ = √(Σ(xᵢ − μ) 2 /n). The 95% confidence interval (CI) for each model was then estimated using the standard formulation μ ± 1.96 × (σ/√n), ensuring that the reported range captures the expected variation of true model performance with high confidence. The significance of these values lies in their ability to jointly reflect accuracy (effectiveness), variability (stability), and reliability (confidence bounds). Lower σ values indicate consistent behavior across different data splits, while narrower CI ranges confirm reduced uncertainty in predictions. Additionally, statistical comparison using paired t-tests across folds ensures that observed improvements are not random but statistically meaningful. Collectively, this table provides a rigorous validation framework, demonstrating that the proposed model achieves not only higher predictive performance but also greater stability and statistical confidence, which are critical for dependable deployment in cybersecurity systems. Table 7. Statistical performance validation across models. Model UCI accuracy (%) Std Dev ( ±) 95% CI range CIC accuracy (%) Std Dev ( ±) 95% CI range CNN 96.12 0.78 95.63–96.61 95.44 0.83 94.92–95.96 SVM 94.85 0.91 94.28–95.42 93.76 0.95 93.17–94.35 BERT + LSTM 97.03 0.65 96.62–97.44 96.18 0.71 95.73–96.63 CyberSafe-EG-GWO 98.45 0.42 98.19–98.71 97.92 0.47 97.63–98.21 Open in a new tab Statistical significance analysis To rigorously validate the reported performance gains of the CyberSafe‑EG‑GWO framework, a statistical significance analysis was conducted using both confidence intervals (95% CI) and paired hypothesis testing across multiple cross-validation folds. For each dataset, tenfold cross-validation was repeated five times, generating mean accuracy, standard deviation, and 95% confidence intervals. For instance, on the UCI phishing dataset, the framework achieved 98.45% ± 0.42% (95% CI 98.19–98.71), while SVM and BERT + LSTM baselines yielded 94.85% ± 0.91% (CI 94.28–95.42) and 97.03% ± 0.65% (CI 96.62–97.44), respectively. Paired t-tests confirmed that the improvements of CyberSafe‑EG‑GWO over CNN, SVM, and BERT + LSTM were statistically significant ( p < 0.01), demonstrating that the observed gains are unlikely due to random variation. This analysis ensures that the reported performance differences are robust, reproducible, and meaningful, providing strong empirical support for the framework’s superiority. Ablation study and analysis Entropy threshold analysis The entropy threshold (θ) was validated through a controlled ablation study designed to quantify its contribution to feature quality and overall detection performance. Four configurations were evaluated: (i) No entropy filtering, where all extracted features are retained; (ii) Entropy-only filtering, where low-information features are removed without optimization; (iii) EG-GWO without entropy guidance, where optimization operates on the full feature set; and (iv) the full CyberSafe-EG-GWO pipeline, integrating both entropy filtering and optimized selection. Table 8 show that removing entropy filtering increases noise and reduces precision due to redundant features, while entropy-only filtering improves feature relevance but lacks optimal subset selection. EG-GWO alone enhances selection but is less stable due to unfiltered input space. The combined pipeline achieves the best balance, demonstrating improved accuracy and reduced feature dimensionality. The table was constructed by averaging results over consistent folds, ensuring that each configuration was evaluated under identical data splits and training conditions, thereby isolating the effect of entropy filtering. This is generated by executing each feature selection configuration under identical cross-validation folds and aggregating performance metrics to isolate the effect of entropy filtering and optimization. The processing ensures controlled conditions where only the feature selection strategy varies, enabling a fair comparison of noise reduction, dimensionality control, and predictive stability. The values indicate that combining entropy filtering with EG-GWO yields the most balanced outcome, as it minimizes redundant features while preserving discriminative information, leading to improved consistency (lower variance) and enhanced precision in classification. Table 8. Ablation study on feature selection strategies. Configuration Accuracy (%) Feature count Precision (%) Stability (σ) No entropy filtering 95.12 High (~ 100%) 94.30 0.88 Entropy-only filtering 96.47 Reduced (~ 65%) 95.92 0.71 EG-GWO (No Entropy) 97.18 Reduced (~ 58%) 96.54 0.63 CyberSafe-EG-GWO (Full) 98.45 Optimized (~ 52%) 97.96 0.42 Open in a new tab Sensitivity to hyperparameters and threshold validation The entropy threshold (θ = 0.3) and EG-GWO parameters were selected through systematic sensitivity analysis across both datasets, rather than arbitrary assignment. Multiple threshold values (θ ∈ {0.1, 0.2, 0.3, 0.4, 0.5}) were evaluated, revealing that lower values (≤ 0.2) retained excessive low-information features, increasing noise, while higher values (≥ 0.4) removed informative but moderately distributed features, reducing recall. The optimal point (θ = 0.3) provided the best trade-off between feature relevance and retention of rare indicators, yielding peak validation accuracy and minimal variance. Similarly, EG-GWO parameters such as population size (10–30) and iteration count (30–70) were tuned, where values beyond 20 agents and 50 iterations showed negligible improvement (< 0.2%) but increased computational cost. Table 9 summarizes these findings, with values computed by averaging cross-validation results under controlled parameter variations, confirming that the selected configuration ensures both performance stability and computational efficiency. This is derived from systematic parameter sweeps, where each hyperparameter is varied independently while keeping others fixed, and results are averaged across validation folds. The processing captures the relationship between parameter settings and model behavior, highlighting convergence trends and performance sensitivity. The values demonstrate that moderate parameter settings avoid overfitting and excessive computation, confirming that the selected configuration achieves optimal trade-offs between accuracy, stability, and computational efficiency without unnecessary resource overhead. Table 9. Hyperparameter sensitivity analysis for EG-GWO and entropy threshold. Parameter Tested range Optimal value Impact on accuracy Observation Entropy threshold θ 0.1–0.5 0.3 Peak at θ = 0.3 Best balance of noise removal and feature retention Population Size 10–30 20 Stable beyond 20 Larger sizes increase cost without gain Iterations 30–70 50 Plateau after 50 Convergence achieved efficiently Open in a new tab Component-wise ablation study (model contribution analysis) To quantify the individual contributions of each component, a second ablation study was conducted by incrementally integrating language-model features, EG-GWO optimization, and SpinalNet classification. Table 10 demonstrates that each module contributes cumulatively to performance improvement. The baseline model using only traditional features shows limited accuracy, while adding language-model embeddings improves contextual understanding. The inclusion of EG-GWO enhances feature quality and reduces redundancy, and finally, replacing conventional classifiers with SpinalNet improves convergence efficiency and classification precision. The table values were derived by maintaining identical training conditions while selectively enabling components, ensuring that improvements are attributable to specific modules rather than external factors. This is constructed through incremental model integration, where components are added sequentially under the same training and evaluation setup to measure their individual impact. The processing ensures that improvements are directly attributable to each added module rather than external variations. The values reflect a clear performance progression, showing that each component contributes distinct benefits—contextual understanding, optimized feature selection, and efficient classification—ultimately validating that the full framework operates as a cohesive and complementary system for high-performance phishing detection. Table 10. Component-wise contribution analysis of CyberSafe-EG-GWO framework. Configuration Accuracy (%) Recall (%) F1-score (%) Baseline (Traditional Features + SVM) 94.85 93.92 94.31 + Language Model Features 96.72 95.88 96.21 + EG-GWO Optimization 97.63 96.94 97.28 + SpinalNet (Full Model) 98.45 97.88 98.16 Open in a new tab These ablation studies collectively confirm that the proposed design choices—entropy thresholding, EG-GWO optimization, and SpinalNet integration—are experimentally justified, complementary, and essential for achieving high performance, stability, and efficiency in phishing detection. Discussions The variation in reported accuracy values arises from distinct evaluation protocols and experimental settings, each designed to assess a different aspect of model performance. The values 95.8% (UCI) and 94.3% (CIC) presented correspond to the final hold-out test evaluation, where the model is trained on 80% of the data and tested on a strictly unseen 20% subset. This setting reflects real-world deployment conditions, where the model encounters previously unseen phishing patterns. In contrast, the higher values—98.45% (UCI) and 97.92% (CIC)—reported in the Results discussion are derived from tenfold cross-validation, where the dataset is partitioned into multiple folds and the model is iteratively trained and validated across all splits. This approach reduces variance and provides a more optimistic estimate of generalization, as each sample contributes to both training and validation phases. For example, in the UCI dataset, fold-wise accuracies ranged between 97.9 and 99.1%, yielding an average of 98.45%, whereas the independent test set—containing unseen distributions—resulted in a more conservative 95.8%, confirming expected performance degradation under strict evaluation. To ensure clarity and result reliability, the final reported benchmark values per dataset are defined as the hold-out test results (95.8% for UCI and 94.3% for CIC), as these best represent practical deployment performance. The 98% + results are not from combined datasets or ablation studies, but specifically from cross-validation on individually tuned models, where hyperparameters (e.g., learning rate = 0.001, batch size = 64, dropout = 0.3) were optimized prior to evaluation. These higher values demonstrate the upper-bound capability of the proposed framework under controlled validation conditions. For instance, when EG-GWO optimization and SpinalNet tuning are applied within cross-validation loops, feature consistency across folds leads to improved learning stability and higher accuracy. However, when evaluated on a fixed unseen test split, slight distributional shifts reduce performance to 95–96%, which is both expected and methodologically sound. This dual reporting—cross-validation for robustness and hold-out testing for realism—ensures transparency, eliminates ambiguity, and strengthens the credibility of the results for both academic evaluation and real-world applicability. An additional factor supporting this distinction is the impact of data distribution consistency and feature stability across evaluation settings. In cross-validation, each fold preserves a similar statistical distribution of phishing and legitimate samples, allowing the EG-GWO feature selection process to repeatedly identify highly stable feature subsets with minimal variance (feature overlap consistency observed above 85% across folds). This consistency enhances the learning behavior of SpinalNet, leading to smoother convergence and reduced generalization error during validation cycles. In contrast, the hold-out test set introduces distributional shifts, such as unseen token patterns, rare domain structures, or previously unobserved metadata combinations, which are not fully captured during training. For example, certain phishing samples in the test split may include low-frequency but high-impact indicators (e.g., newly registered spoofed domains or obfuscated URLs) that were absent or underrepresented in training folds, slightly affecting prediction confidence. Furthermore, cross-validation benefits from implicit model exposure to a wider range of data variations, whereas the hold-out evaluation strictly limits learning to a fixed subset, making it more sensitive to edge cases. This difference explains why cross-validation reflects model robustness under controlled variability, while the hold-out test better captures true generalization under operational uncertainty, thereby reinforcing the necessity of reporting both perspectives for a complete and credible performance assessment. Scalability The scalability of the CyberSafe-EG-GWO framework is inherently supported by its modular pipeline, yet further validation on larger and more heterogeneous datasets is essential for real-world deployment. The current evaluation on ~ 11 K structured samples (UCI) and large-scale email corpora demonstrates stable performance; however, enterprise environments typically process millions of messages daily with high variability in language, format, and attack strategies. The use of EG-GWO already reduces feature dimensionality by approximately 40–50%, which directly lowers computational overhead and supports scalability. To extend this capability, the framework can be adapted using distributed processing (e.g., mini-batch parallel EG-GWO or GPU-based feature evaluation), enabling efficient handling of streaming data. For example, in a large-scale email gateway scenario, batch-wise feature selection combined with incremental SpinalNet updates can maintain detection latency below operational thresholds while adapting to evolving phishing patterns. Adaptive entropy thresholding The fixed entropy threshold (θ = 0.3) provides a balanced trade-off between noise reduction and information retention; however, real-world phishing data often exhibits dynamic entropy distributions due to evolving attack patterns. An adaptive thresholding mechanism can enhance the model by adjusting θ based on dataset characteristics such as variance, token frequency distribution, or temporal drift. For instance, a percentile-based adaptive scheme (e.g., retaining top 60–70% high-entropy features per batch) can ensure that rare but critical indicators—such as newly emerging phishing domains or zero-day keywords—are not discarded. Additionally, integrating context-aware entropy weighting, where tokens associated with suspicious metadata (e.g., domain mismatch) are preserved regardless of entropy, can further improve detection robustness. This dynamic adjustment would allow the framework to maintain high recall while preserving efficiency in continuously changing threat environments. Lightweight architectures Although the current framework leverages SpinalNet for efficient classification, the inclusion of semantic embeddings (e.g., BERT) introduces computational overhead during feature extraction. To address this, future enhancements can incorporate lightweight transformer architectures such as DistilBERT or MobileBERT, which reduce parameter size by 40–60% while retaining most semantic capabilities. For example, replacing standard BERT embeddings with DistilBERT can significantly reduce inference time during feature generation without degrading contextual understanding. When combined with the already compact SpinalNet classifier, this hybrid design can enable end-to-end deployment on resource-constrained environments such as browser extensions or edge security devices. This optimization ensures that the framework remains both accurate and computationally feasible across diverse operational settings. Interpretability enhancements Improving interpretability is critical for practical adoption, especially in cybersecurity environments where analysts require transparent and explainable decisions. The proposed framework can be extended by integrating feature attribution techniques such as SHAP or LIME, which quantify the contribution of each selected feature toward the final classification. For instance, highlighting features like “sender mismatch” or “high hyperlink density” with corresponding impact scores can help analysts understand why a message was flagged as phishing. Additionally, the entropy-guided feature selection inherently supports interpretability by prioritizing high-information features, which can be directly mapped to phishing indicators. Providing decision-level explanations alongside confidence scores would significantly enhance trust and usability in enterprise security systems, enabling faster and more informed incident response. Reproducibility and open source implementation To ensure reproducibility and enable practical adoption, the CyberSafe‑EG‑GWO framework is structured into modular stages that can be independently replicated by researchers and practitioners. The workflow includes: (i) data preprocessing, with token normalization and entropy-based filtering using a defined threshold (θ = 0.3); (ii) feature engineering, where statistical and contextual embeddings are extracted and standardized; (iii) EG-GWO-based feature selection, implemented with fixed parameters (population size = 20, iterations = 50, convergence tolerance = 10⁻ 4 ) and controlled random seeds to guarantee deterministic outputs; and (iv) SpinalNet training, configured with input segment width of 16, three hidden layers of 64, 32, and 16 neurons, ReLU activations, dropout = 0.3, learning rate = 0.001, batch size = 64, and 30 epochs. Feature vectors from BERT‑Base, Multilingual Cased embeddings are concatenated with EG-GWO–optimized features, yielding a final dimensionality of 312, normalized using min–max scaling. A grid search was performed for hyperparameter tuning, covering learning rates (0.0005–0.005), batch sizes (32–128), and EG-GWO parameters, with tenfold cross-validation determining the optimal configuration. Runtime evaluation was performed on an NVIDIA RTX 3080 GPU (10 GB VRAM) and Intel i9 CPU with 32 GB RAM, showing an average inference latency of 0.214 s per sample on GPU and 0.672 s on CPU. Detailed configuration files, anonymized sample datasets, feature schema definitions, and evaluation scripts are provided to support reproducibility. While the full source code is currently available upon request due to ongoing extensions of the research, step-by-step execution instructions and environment specifications (Python ≥ 3.8, PyTorch/TensorFlow compatibility) allow seamless deployment. The framework demonstrates robust performance by combining entropy-guided filtering, optimized feature selection, and efficient classification. Feature reduction lowers dimensionality by approximately 40–50%, improving computational efficiency; however, contextual embeddings still introduce latency in large-scale deployment. Current evaluations focus on English-centric datasets, suggesting that multilingual support—through variants like multilingual BERT—would enhance applicability across diverse phishing scenarios. Future enhancements should target lightweight architectures, parallel processing, and interpretable decision-making via feature attribution and confidence-based explanations, ensuring scalability, transparency, and adaptability to evolving cyber threats. Risk of information loss in EBNF The EBNF improves feature quality by eliminating low-information tokens; however, it introduces a measurable risk of excluding rare but semantically critical indicators, which can impact detection sensitivity. Empirical analysis shows that such cases contribute to a false negative rate increase of approximately 1.2–1.8% in edge scenarios where phishing cues are sparse but decisive (e.g., short obfuscated URLs or minimal-text attacks). To quantify this, a controlled evaluation was conducted by reintroducing filtered low-entropy tokens in flagged misclassified samples, where recovery of correct predictions improved by ~ 0.9%. This indicates that while EBNF enhances overall precision, it may marginally affect recall in rare cases. To mitigate this, a conditional retention strategy—where tokens associated with suspicious metadata (e.g., domain mismatch) are preserved regardless of entropy—can reduce such losses without significantly increasing noise. Multilingual generalizability limitation The observed performance degradation of up to 6–8% on multilingual samples highlights a limitation in handling non-English phishing content, primarily due to the dominance of English-trained embeddings and feature distributions. This gap is particularly evident in languages with different syntactic structures or encoding patterns, where token-level entropy and contextual embeddings become less reliable. A practical solution is the integration of multilingual transformer models (e.g., mBERT or XLM-R), which are trained on diverse linguistic corpora and can better capture cross-language semantics. Preliminary validation using multilingual embeddings shows a recovery of 3–5% accuracy on non-English subsets, indicating that such adaptation can significantly improve generalizability while maintaining consistency in feature representation across languages. Algorithmic convergence in EG-GWO Although EG-GWO enhances feature selection through guided optimization, there remains a risk of premature convergence to local optima, particularly in high-dimensional search spaces. Experimental convergence analysis indicates that fitness improvement plateaus after ~ 40 to 45 iterations in certain runs, suggesting reduced exploration in later stages. To address this, advanced mechanisms such as chaotic initialization (e.g., logistic map-based diversity) and elite learning strategies (retaining top-performing agents across iterations) can be incorporated. Simulated integration of elite retention improved solution diversity and yielded a ~ 0.6% gain in selection stability, demonstrating its effectiveness in avoiding suboptimal convergence. These enhancements ensure a better balance between exploration and exploitation, improving robustness in feature optimization. Inference environment constraints The current evaluation on an NVIDIA RTX-class GPU demonstrates efficient execution; however, validating performance on CPU-only and low-resource devices is essential for practical deployment claims. Additional benchmarking on a standard CPU environment (e.g., Intel i5, 8 GB RAM) shows inference times in the range of 0.45–0.62 s per instance, while lightweight optimizations (feature caching and reduced precision computation) can further reduce this to ~ 0.38 s. On mobile-grade processors, preliminary estimates indicate feasible deployment with slight latency trade-offs. These findings confirm that, despite increased execution time compared to GPU settings, the framework remains operational within acceptable limits for browser extensions and edge-based security tools, supporting its applicability in resource-constrained environments. BERT latency trade-off analysis The framework addresses the inherent latency of BERT by strategically decoupling embedding generation from real-time inference, ensuring that computationally intensive operations do not affect deployment efficiency. While full BERT inference can exceed 0.5 s per sample, the use of precomputed embeddings and dimensionality reduction via EG-GWO reduces runtime overhead significantly, contributing to the observed low-latency performance. Further optimization using distilled transformer variants and embedding compression techniques can reduce memory usage by up to 40% while maintaining comparable semantic quality. This balance between representational strength and execution efficiency ensures that the model leverages deep contextual understanding without compromising real-time responsiveness, thereby strengthening its suitability for high-throughput cybersecurity applications. Cross-dataset and cross-domain validation To verify the generalization capability of the CyberSafe‑EG‑GWO framework, cross-dataset validation was performed by training the model on the UCI phishing dataset and testing it directly on the CIC-Phishing dataset, and vice versa. This approach evaluates the robustness of feature selection and classification under distributional shifts and varying phishing patterns. Results indicate that when trained on UCI and tested on CIC, the model achieved 94.12% accuracy, while training on CIC and testing on UCI yielded 93.87% accuracy, demonstrating only a modest performance drop compared to within-dataset evaluation. These results confirm that the entropy-guided feature selection and SpinalNet classifier retain strong discriminative capability even under unseen domain conditions. Additionally, analysis of fold-wise feature stability showed that > 85% of top-ranked features remained consistent across datasets, indicating that the selected features capture intrinsic phishing patterns rather than dataset-specific artifacts. Such cross-domain validation highlights the framework’s practical applicability in real-world scenarios where new phishing campaigns differ from historical training data. Conclusion and future directions This study presents CyberSafe-EG-GWO, a hybrid framework for detecting phishing threats across digital communication platforms. The system combines entropy-guided preprocessing, EG-GWO feature selection, and the SpinalNet deep learning classifier to improve detection efficiency in both structured and unstructured data. A key contribution is the EBNF, which emphasizes high-information tokens while reducing noise. Semantic and behavioral features are extracted and optimized via EG-GWO, enhancing discriminative capability and stabilizing learning in SpinalNet. Evaluation on the UCI Phishing Website and CIC-Phishing Email datasets demonstrated consistent performance, with hold-out test accuracies around 95–96%, true positive rates near 92.6%, and true negative rates approximately 90.3%. Inference latency averaged 0.214 s per sample, supporting near real-time deployment. Cross-validation results indicate robustness, though slightly higher accuracy under controlled conditions highlights the impact of distributional shifts in unseen data. Limitations include computational overhead from BERT embeddings, potential loss of low-frequency but critical tokens, and limited multilingual support. Future improvements will target lightweight transformers, adaptive entropy thresholds, and expanded multilingual and real-time network analysis capabilities to enhance applicability across diverse operational environments. Limitations and future work While CyberSafe-EG-GWO demonstrates strong phishing detection performance, several limitations remain. The use of BERT embeddings increases computational requirements, potentially limiting deployment on low-resource or embedded systems. The EBNF, while effective at reducing noise, may omit rare but contextually important low-entropy tokens, slightly affecting recall. Additionally, the framework currently focuses on English datasets, restricting its effectiveness for multilingual phishing campaigns. Future work will address these constraints by exploring lightweight transformer models (e.g., DistilBERT, MobileBERT) to reduce inference time and memory usage, adaptive entropy thresholding to retain rare but critical features, and multilingual embeddings to extend coverage across diverse languages. Integration of real-time network behavior analysis and parallelized feature selection will further enhance scalability, responsiveness, and operational adaptability in high-throughput, multi-channel cybersecurity environments. Table 11 shows about the Abbreviations Used. Table 11. Abbreviations used. Abbreviation Full Form Context BERT Bidirectional Encoder Representations from Transformers Transformer-based model for capturing contextual relationships in text LSTM Long Short-Term Memory Recurrent neural network for modeling sequential data and long-term dependencies EG-GWO Entropy-Guided Grey Wolf Optimization Nature-inspired metaheuristic used for feature selection guided by entropy scores EBNF Entropy-Based Normalization Filter Preprocessing module that removes low-information tokens based on Shannon entropy TF-IDF Term Frequency–Inverse Document Frequency Statistical measure to evaluate the importance of a word in a document relative to a corpus UCI University of California, Irvine Reference to the UCI Phishing Website Dataset used for structured phishing evaluation CIC Canadian Institute for Cybersecurity Reference to the CIC-Phishing Email Dataset used for unstructured phishing evaluation SpinalNet Spinal Neural Network Deep learning architecture designed for faster convergence and efficient backpropagation using incremental feature feeding AUC Area Under the Curve Metric used to evaluate the discriminative ability of binary classifiers CPU Central Processing Unit Standard processor for executing model inference GPU Graphics Processing Unit High-performance processor used for parallel computation, accelerating model training and inference Open in a new tab Author contributions Author contributions Romil Rawat: Conceived the core research idea and led the development of the CyberSafe-EG-GWO framework. He designed the algorithmic architecture, supervised model implementation, and managed overall project coordination. He also contributed significantly to manuscript writing, result analysis, and revisions. Hitesh Rawat: Focused on data preprocessing, entropy-based filtering techniques, and the optimization component using Grey Wolf Optimization. He was responsible for conducting experiments, tuning model parameters, and preparing the performance evaluation and comparative result sections. Anjali Rawat: feature extraction analysis, and SpinalNet integration. She also contributed to dataset handling, generating visualizations, formatting, and assisting in technical proofreading of the manuscript. Anand Rajavat: Handled literature review,he also contributed to dataset handling, generating visualizations, formatting, Supervision. Data availability The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Declarations Competing interests The authors declare no competing interests. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. References 1. Alzaqebah, A., Aljarah, I., Al-Kadi, O. & Damaševičius, R. A modified Grey Wolf Optimization algorithm for an intrusion detection system. Mathematics (Basel) 10 (6), 999. 10.3390/math10060999 (2022). [ Google Scholar ] 2. Syafitri, W., Shukur, Z., Asma’Mokhtar, U., Sulaiman, R. & Ibrahim, M. A. Social engineering attacks prevention: A systematic literature review. IEEE Access 10 , 39325–39343. 10.1109/ACCESS.2022.3162594 (2022). [ Google Scholar ] 3. Hamdan, A. et al. Phishing detection using grey wolf and particle swarm optimizer. Int. J. Electr. Comput. Eng. (IJECE) 14 (5), 5961–5969. 10.11591/ijece.v14i5.pp5961-5969 (2024). [ Google Scholar ] 4. Almseidin, M. et al. Hybrid deep neural network optimization with particle swarm and grey wolf algorithms for sunburst attack detection. Computers (Basel) 14 (3), 107. 10.3390/computers14030107 (2025). [ Google Scholar ] 5. Emary, E., Zawbaa, H. M. & Hassanien, A. E. Binary Grey Wolf Optimization approaches for feature selection. Neurocomputing 172 , 371–381. 10.1016/j.neucom.2015.06.083 (2016). [ Google Scholar ] 6. Alturki, B. & Alsulami, A. A. Semi-supervised learning with entropy filtering for intrusion detection in asymmetrical IoT systems. Symmetry 17 (6), 973. 10.3390/sym17060973 (2025). [ Google Scholar ] 7. Jaddoa, I. A. Integration of convolutional neural networks and Grey Wolf Optimization for advanced cybersecurity in IoT systems. J. Robot. Control (JRC) 5 (4), 1189–1202. 10.18196/jrc.v5i4.22178 (2024). [ Google Scholar ] 8. Al Tawil, A. et al. Comparative analysis of machine learning algorithms for email phishing detection using TF-IDF, Word2Vec, and BERT. Comput. Mater. Continua 81 , 3395. 10.32604/cmc.2024.057279 (2024). [ Google Scholar ] 9. Reddy, V. V. K. et al. Deep learning-based credit card fraud detection in federated learning. Expert Syst. Appl. 255 , 124493. 10.1016/j.eswa.2024.124493 (2024). [ Google Scholar ] 10. Bai, X., Zheng, Y., Lu, Y. & Shi, Y. Chain hybrid feature selection algorithm based on improved Grey Wolf Optimization algorithm. PLoS ONE 19 (10), e0311602. 10.1371/journal.pone.0311602 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 11. Khaseeb, J. Y., Keshk, A. & Youssef, A. Improved binary Grey Wolf Optimization approaches for feature selection optimization. Appl. Sci. (Basel) 15 (2), 489. 10.3390/app15020489 (2025). [ Google Scholar ] 12. Shang, Y., Zheng, M., Li, J. & Zheng, X. An effective feature selection approach based on hybrid Grey Wolf Optimizer and Genetic Algorithm for hyperspectral image. Sci. Rep. 15 (1), 1968. 10.1038/s41598-024-84934-8 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 13. Zuhair, H., Selamat, A. & Salleh, M. Feature selection for phishing detection: A review of research. Int. J. Intell. Syst. Technol. Appl. 15 (2), 147–162. 10.1504/IJISTA.2016.076495 (2016). [ Google Scholar ] 14. Purwanto, R. W., Pal, A., Blair, A. & Jha, S. PhishSim: aiding phishing website detection with a feature-free tool. IEEE Trans. Inf. Forensics Secur. 17 , 1497–1512 (2022). [ Google Scholar ] 15. Haq, Q. E. U., Faheem, M. H. & Ahmad, I. Detecting phishing URLs based on a deep learning approach to prevent cyber-attacks. Appl. Sci. (Basel) 14 (22), 10086. 10.3390/app142210086 (2024). [ Google Scholar ] 16. Rangapur, A., &Kanakam, T. Phish-Defence: phishing detection using deep recurrent neural networks. arXiv preprint arXiv:2110.13424 . 10.48550/arXiv.2110.13424 (2021). 17. Shabad, M. A. R. & Kavitha, M. Credit card fraud detection using hybrid Chord-SpinalNet. Int. J. Adv. Mechatron. Syst. 12 (3), 161–169. 10.1504/IJAMECHS.2025.147101 (2025). [ Google Scholar ] 18. Madake, J., Kadam, S., Kadam, S., & Khandelwal, A. An experimental analysis of transformer-based models for phishing detection. In Proceedings of the International Conference on Smart Systems and Social Management (ICSSSM 2025) _Smart Systems Tracks 92. (Springer Nature, 2025). 10.2991/978-94-6463-950-6_8. 19. Chaudhari, T. et al. AI-driven transformer frameworks for real-time anomaly detection in network systems. Int. J. Adv. Comput. Sci. Appl. 10.14569/ijacsa.2025.01602111 (2025). [ Google Scholar ] 20. Meléndez, R., Ptaszynski, M. & Masui, F. Comparative investigation of traditional machine-learning models and transformer models for phishing email detection. Electronics 13 (24), 4877. 10.3390/electronics13244877 (2024). [ Google Scholar ] 21. Uddin, M. A., Mahiuddin, M. & Sarker, I. H. An explainable transformer-based model for phishing email detection: A large language model approach. Comput. Netw. 10.1016/j.comnet.2026.112061 (2026). [ Google Scholar ] 22. Altan, I., Bachir, A., Parbhulkar, Y., Rizvi, A. M., & Farazi, M. Dual-Path phishing detection: Integrating transformer-based NLP with structural URL analysis. In 2025 IEEE/ACS 22nd International Conference on Computer Systems and Applications (AICCSA) 1–6. (IEEE, 2025). 10.1109/AICCSA66935.2025.11315219. 23. Songailaitė, M., Kankevičiūtė, E., Zhyhun, B., &Mandravickaitė, J. (2023, May). BERT-based models for phishing detection. In 28th Conference on Information Society and University Studies (IVUS’2023), CEUR Workshop Proceedings, Kaunas, Lithuania . https://ceur-ws.org/Vol-3575/Paper4.pdf (2023). 24. Wilk-Jakubowski, J. L., Pawlik, L., Wilk-Jakubowski, G. & Sikora, A. Machine learning and neural networks for phishing detection: A systematic review (2017–2024). Electronics 14 (18), 3744. 10.3390/electronics14183744 (2025). [ Google Scholar ] 25. Ghalechyan, H., Israyelyan, E., Arakelyan, A., Hovhannisyan, G. & Davtyan, A. Phishing URL detection with neural networks: An empirical study. Sci. Rep. 14 (1), 25134. 10.1038/s41598-024-74725-6 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 26. Murugadoss, R., Vetriselvi, T. & Rajanarayanan, S. Thyroid cancer detection using Py-SpinalNet: A pyramid and SpinalNet approach. Cancer Investig. 43 (7), 569–593. 10.1080/07357907.2025.2543853 (2025). [ DOI ] [ PubMed ] [ Google Scholar ] 27. Rawla, A., Singh, S., Daniyal, M. & Dubey, P. Detection of phishing attacks in PhiUSIIL Dataset using deep learning. Procedia Comput. Sci. 259 , 543–552. 10.1016/j.procs.2025.04.003 (2025). [ Google Scholar ] 28. Sarasjati, W., Rustad, S., Santoso, H. A., Syukur, A., Rafrastara, F. A., & Setiadi, D. R. I. M. Comparative study of classification algorithms for website phishing detection on multiple datasets. In 2022 International Seminar on Application for Technology of Information and Communication (iSemantic) 448–452. (IEEE, 2022). https://ieeexplore.ieee.org/abstract/document/9920475/ . 29. Dunđer, I., Seljan, S., &Odak, M. Data acquisition and Corpus Creation for phishing detection. In Proceedings of the 46th MIPRO ICT and Electronics Convention (MIPRO) 533–538. https://ieeexplore.ieee.org/abstract/document/10159904/ (2023). 30. Salloum, S., Gaber, T., Vadera, S. & Shaalan, K. A new English/Arabic parallel corpus for phishing emails. ACM Trans. Asian Low Resour. Lang. Inf. Process. 22 (7), 1–17. 10.1145/3606031 (2023). [ Google Scholar ] 31. Yerima, S. Y., &Alzaylaee, M. K. High accuracy phishing detection based on convolutional neural networks. In 2020 3rd International Conference on Computer Applications & Information Security (ICCAIS) 1–6. (IEEE, 2020). https://ieeexplore.ieee.org/abstract/document/9096869/ . 32. Birthriya, S. K., Ahlawat, P. & Jain, A. K. Intelligent phishing website detection: A CNN-SVM approach with nature-inspired hyperparameter tuning. Cyber Secur. Appl. 10.1016/j.csa.2025.100100 (2025). [ Google Scholar ] 33. Zabihimayvan, M., & Doran, D. Fuzzy rough set feature selection to enhance phishing attack detection. In 2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE) 1–6. (IEEE, 2019). 10.48550/arXiv.1903.05675. Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Availability Statement The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (2.1 MB) Cite Collections Permalink RESOURCES Similar articles Cited by other articles Links to NCBI Databases Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top

Related documents

• A pseudo one-time-pad based security system#1020565
• WebView-Based Hybrid Analysis of Link and Event for On-Device QR Phishing Detection Framework.#427929
• Privacy enhancement for Internet electronic mail: Part I - message encipherment and authentication procedures#131697
• AI Powered Image Analysis for Phishing Detection#13987
• A Cognitive Deception Model for Generating Fake Documents to Curb Data Exfiltration in Networks During Cyber-Attacks#200931