Real Time Phishing Detection Browser Extension Source Code — Complete Documentation & Simulation

Overview & System Context

Real Time Phishing Detection Browser Extension Source Code: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9629 Words · Real Software Screenshots: 1 1. Executive Overview & Technical Background Thank you for visiting nature.com. You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.

Phishing attack continues to rank among the deadliest online threats. They create phony websites in an attempt to obtain personal data. This study offers a framework for a browser extension that uses machine learning to examine URLs and visual components in Google Chrome in order to identify phishing websites in real-time. Using support vector machine (SVM), decision tree (DT), and random forest (RF) algorithms, the suggested system gathers and examines data from websites, extracts hybrid elements including lexical, structural, and visual layout parameters, and arranges them. The best traits that can distinguish between items are found using the grey wolf optimizer (GWO). This reduces computer power consumption and facilitates finding items. GWO enhanced the random forest model, which performed well on benchmark datasets such as the Berkeley ML Archives and PhishTank. On the MCC test, it received a score of 0.96 and had an accuracy rate of 98.7%.This method is used by the Chrome extension to assess URLs for visual similarity in real time and display warnings to users that change according to their actions.The proposed system is better than current anti-phishing solutions because it works better in real time, has a lower false-positive rate, and can handle obfuscated URLs. This project makes a useful, user-centered defense system that can protect against phishing attacks that change over time by using smart security at the browser level.

PhishDetect: A ranking-based classifier integration approach for improving phishing website detection Explainable phishing website detection for secure and sustainable cyber infrastructure Figure 1: Video Demonstration & Practical Interface Overview Phishing assaults continue to rank among the most prevalent online dangers. They steal users’ personal information by using phony websites that mimic authentic ones. Phishing was the most prevalent kind of cybercrime, accounting for about 30% of all complaints and causing significant financial losses, according to the Internet Crime Complaint Center’s (IC3) 2022 report 1 . Traditional blacklists are no longer sufficient as phishing websites get increasingly sophisticated. Therefore, in order to spot minute similarities in URL structure, graphic design, and website behavior, contemporary detection systems are depending more and more on machine learning and hybrid feature extraction techniques. People between the ages of 30 and 39 were the most likely to report phishing scams 2 . The Telephone-operated Crime Survey of England Wales estimates that in 2023, there were 5 million distinct phishing websites. Additionally, 90% of IT workers are still extremely concerned about email phishing, according to the IRONSCALES poll 3 . The past few years have also seen a discernible increase in phishing schemes.

IBM’s comprehensive analysis in 2023 unveiled that 16% of company data breaches were directly due to phishing attacks. As highlighted in several reports, phishing attacks target diverse demographics and exploit various platforms. For example, the IC3 2022 report revealed that individuals aged 30–39 were most commonly affected, while the Anti-Phishing Working Group (AWPG) reported an alarming 5 million distinct phishing sites in 2023. It is first mentioned in the body text, discussing its content (e.g., the findings from various phishing reports), before being presented directly beneath the text.These and other findings are summarized in Table 1 below. As shown in Table 1 , phishing attacks have increased significantly over the years, with a notable rise in online scams targeting individuals aged 30–39.(TCSEW) found that those aged 25 to 44 were frequently targeted in these regions.

Anti-phishing working group (AWPG) data The deceptive practices involve the distribution of email spam with the intent to mislead individuals into revealing confidential information or credentials 8 . The entities most frequently impersonated in these scams are those with which users regularly interact, such as financial institutions, email services, cloud-based platforms, and entertainment services 9 . These kinds of events have big effects that go beyond just losing a loved one. They can include stealing money, breaking into systems without permission, and spreading targeted attacks within companies 10 .

These personalized emails 11 make it much more likely that someone will successfully breach a system and steal personal data. Picture this: someone gets an email from their bank that looks official and tells them about a serious problem with their account 12 . The email tells the person to act quickly and sends them to a fake website that looks like the bank’s real gateway. The attackers have full access to the victim’s money because they accidentally gave them their login information on this fake website 13 .

The multi-stage attack chain shown in Fig. 1 starts with phishing, exploiting weaknesses, or using weak passwords to get into a system. This leads to the installation of malware and the theft of credentials. Google Chrome extensions are very useful extras that make the Chrome browser work better when you’re online 14 . Figure 2 shows how Google Chrome works and why it’s so important for improving our web browsing. With these Chrome extensions, developers can use the browser’s powerful design to make new solutions that work for a lot of different people.

People like Google Chrome as a web browser because it has a lot of useful tools, like the ability to manage passwords, filter, and translate. AdBlock and uBlock are two examples of add-ons that stop ads from showing up, and LastPass and Dashlane are two examples of password managers. Google Translator is a tool that Google gives you that helps you read things in other languages 16 .Chrome puts your safety and privacy first with features like HTTPS, which keeps your activity private and safe from prying eyes, and Grammarly.In short, Google Chrome is a better tool that lets people work safely and in a way that meets their needs. It will keep being useful over time 17 . Our research makes a big step forward in the field by suggesting a Chrome extension that stops phishing using machine learning, URL analysis, and visual resemblance recognition. It gives people a way to protect themselves from changing cyberthreats in real time by connecting academic research with real-world use.

All of the components of the Chrome extension that are meant to identify phishing attempts are shown in Fig. 3 . This illustrates how well the entire program functions. The Phishing Detection interface is displayed in Subfigure (a). It displays the current model version, the number of URLs checked, phishing alerts, and the system’s current status. A real-time message that warns users when a website looks suspicious or might be a scam is shown in subfigure (b). One of the options is to “Go Back” or “Continue Anyway.” Subfigure (c) shows the detection history record. This record shows the URLs that were looked at, their classification labels (phishing or legitimate), and how accurate the prediction was. In Subfigure (d), users can use the model configuration options to turn on or off things like automatic model updates, feature selection, and analyzing HTML and URLs. These APIs tell you how the whole system for finding phishing works. They show how to quickly scan and sort URLs, set off alarms, and manage the model in a smart and easy way. This stops phishing attacks from getting to the web browser.

We talk about the machine learning methods we used and how we put together information from pictures and URLs in a new way in the methodology section. In the results and discussion sections, we show how our results are better than those of other methods and how they make the results more accurate, precise, and easy to remember. The conclusion emphasizes the study’s extensive implications for cybersecurity and proposes novel research avenues. This study is essential to address the increasing complexity and prevalence of phishing attacks, which pose substantial risks to individuals and businesses worldwide. Even though old ways to find phishing are based on good ideas, they might not work as well in a world where phishing strategies are always changing. This project is great because it makes a Chrome extension that is easy to use by using machine learning optimization and visual similarity. It is better at finding and stopping phishing attacks in real time because it uses more advanced methods like URL analysis and clustering algorithms to sort things. Adding this method as an extension to your browser makes it easy to use.This makes it easy to go from education to the real world. This proposal is a significant step forward for the safety of the internet. It gives individuals the piece of mind and safety they need to utilize it.

People often give criminals private information through phishing, which is when they pretend to be real relationships. People don’t know that these links are fake, so when they click on them, they end up on the attacker’s page instead of the one they wanted to go to. It can be very dangerous for both people and businesses to share important information that you think is true by mistake. People who fall for these scams put their own and the company’s information in danger 18 . Most of us used to keep a list of fake URLs and domains that were on a blacklist and compare them to links that people clicked on or typed in to find phishing. But this plan had a lot of problems, especially when there weren’t any fake links on the list. This made it easy for people to trick other people. Researchers used machine learning to figure out if URLs were real by looking at their features 19 . Researchers used a number of different ways to show that the Random Forest algorithm worked very well.Researchers made browser add-ons, like Chrome plug-ins, that use machine learning algorithms to improve cybersecurity in response to the need for better phishing detection 20 . These add-ons check the validity of URLs right away and let users know if someone is trying to steal their information.These new features have shown promise in lowering the risks of phishing attacks through validation and physical testing. As a result, users are better protected from the growing number of cyberthreats that exist online.There has been a rise in cyberattacks, notably phishing attempts, during the COVID-19 pandemic. While there are plenty of complicated phishing detection solutions easily available, many struggle to recognize fake codes and phishing pages. This could be due to problems like reduced detection precision and a limited ability to adapt to new phishing techniques. Furthermore, wrong conclusions in detection efforts may be due to depending on randomly designated URL-based sorting qualities 21 .

This paper presents a sophisticated detection system and avoidance tool to address the concerns. Via machine learning, particularly unsupervised learning algorithms, this model merges an explosive detection algorithm 14 . The requirements embedded within the algorithm prioritize URL-based online characteristics frequently abused by attackers to deceive users into accessing counterfeit websites 22 . Experiments were undertaken in a controlled lab setting using a diverse dataset acquired from platforms such as Phishing Tank and the University of California’s Berkeley Machine Learning archive. A Chrome add-on for phishing detection based on the suggested model is the study’s output. In order to stop phishing attempts before they start, this add-on gives users relevant warnings and doable safety tips to follow while visiting questionable websites. This ingenious malware detection and mitigation method aims to potentially reduce cybercrimes and associated issues by decreasing spam and fake websites 23 . Phishing attacks are a common non-engineering tactic used by malicious actors to get private user data, such as passwords and usernames, without authorization. Because attackers continuously create new unlisted websites, traditional defense strategies against these attacks, such as maintaining an updated blacklist of well-known phishing websites, have proven unsuccessful 24 . By assessing URL attributes and segregating them as legitimate or fraudulent, machine learning techniques offer a hopeful avenue to enhance phishing detection through insights drawn from broad-ranging datasets.

Recent studies revisit pure-DL pipelines on URLs and page code. Haq et al. show that compact 1D-CNNs over tokenized URLs can outperform classic ML baselines on several benchmarks, highlighting DL’s ability to learn n-gram–like patterns without manual features. Nature’s 2024 empirical study compares deterministic vs. probabilistic neural networks for URL classification and reports gains from uncertainty-aware models, indicating calibration matters for deployment 25 .

Hybrid “super-learner” ensembles that blend heterogeneous models continue to report state-of-the-art results. Rao et al. (2025) combine diverse ML learners via a super-learner for mobile phishing detection, showing ensembles beat single models on stability and accuracy across datasets. Multiple 2024–2025 works echo this: stacking/voting mixtures of classic ML, DL, and hybrid DL reduce variance and improve robustness on imbalanced data 26 . A 2025 broad survey further documents that ensembles + modern representation learning dominate malicious-URL detection, recommending careful metric choice beyond accuracy (e.g., PR-AUC, MCC).

Beyond URL strings, several systems integrate source-code/DOM/visual signals. PhiUSIIL (Computers & Security) provides a large, diverse URL dataset with engineered features (e.g., URLTitleMatchScore, TLDLegitimateProb) and similarity-based detection ideas, enabling evaluation of multi-feature approaches. Browser-integrated detectors continue to appear: “NoPhish” (arXiv, 2024) details a Chrome-extension pipeline using ML models; other extension-centric efforts emphasize real-time alerts but often lack rigorous fusion or imbalance-aware optimization 27 .

Table 2 provides a comparative analysis of recent phishing URL detection studies conducted between 2024 and 2025, highlighting differences in feature utilization, model architectures, fusion strategies, and evaluation metrics. Because it can accurately sort through complex data with multiple dimensions, the Random Jungle approach is a preferred choice for this task. Adding technologies that can detect phishing to people’s online activity through Chrome browser extensions or add-ons is one approach to accomplish this. By instantly alerting users when they come across links that appear dubious, these solutions assist users in staying safe online. They become more vigilant as a result, and their defenses against phishing attacks are strengthened. A number of machine learning-based methods for phishing detection have been proposed in recent research. Table 3 illustrates the differences between several methods of identifying phishing, including what they add, what they don’t, and what they might do in the future.

Table 3 presents a comparative analysis of recent phishing detection studies from 2023 to 2025, covering classical machine learning, deep learning, and hybrid optimization-based approaches. Each study varies in its feature scope, algorithmic design, and practical applicability across different phishing scenarios (URL-only, hybrid, or email-integrated). Recent research confirms that the classical grey wolf optimizer (GWO) is an established method for feature selection, with numerous advanced variants created in the last three years. Li et al. 38 introduced an adaptive-mechanism GWO that improves the balance between exploration and exploitation in high-dimensional feature spaces, showing better convergence behavior than the standard GWO. Thakur 39 proposed an Adaptive-Weight GWO (AWGWO) that dynamically alters the weights of the coefficients to enhance the detection of Android malware. Barik et al. 40 also used an optimizer based on deep learning (EGSO-CNN) to find phishing URLs. Pentapalli et al. 41 demonstrated that hybrid optimization strategies can significantly enhance decision-making systems pertaining to phishing. Ovabor 42 examined hybrid Firefly GWO mechanisms specifically for the classification of phishing.These advancements indicate that optimization research in cybersecurity is evolving toward adaptive, hybrid, and deep-learning-compatible techniques. Accordingly, our work positions the standard Binary GWO not as the newest optimizer but as a lightweight, stable, and computationally efficient method that is uniquely suitable for real-time, browser-embedded phishing detection. To contextualize our design choice, we compare our GWO-based approach against these contemporary optimizers (2023–2025) and demonstrate that while recent variants may offer marginal performance gains in offline or GPU-supported environments, the classical GWO achieves competitive accuracy and MCC with significantly lower computational cost making it more practical for on-device browser extensions.

The existing system has more difficult to distinguish phishing websites from normal websites because phishing websites appear similar to the websites they imitate. Existing systems having more false alarm rates due to the feature values will be the same for both legitimate and phishing websites and do suffer low detection accuracy.

The current system is unable to detect whether the visited website’s domain name is similar to a well-known domain name. If this occurs, Spoof Guard will alert visitors to the phishing website if they are not utilizing the usual port. Most of the existing phishing detection system is concentrate the classification based on the URL attributes only. They miss to give more concentration on Visual similarity-based features to identify fake websites by comparing their visual appearance with legitimate websites in terms of content such as page layout, page style, etc.

This study did not involve direct interaction with human participants or identifiable personal data; therefore, informed consent was not required. When building models using typical machine learning methods, human talent is needed for the feature extraction and selection process. These steps are completed independently of the classification process and cannot be merged to enhance the model’s performance in a single step.

Phishing attacks have become a critical threat in the digital era, targeting individuals and organizations to steal sensitive data, such as passwords, credit card information, and personal identification details. To deceive consumers into divulging personal information, these assaults employ social engineering, phony websites, and deceptive emails 43 . Despite improvements in cybersecurity, phishing techniques continue to evolve and become more sophisticated, making it more difficult for existing detection systems to stay up to date. Common defenses against assaults, such as blacklists and heuristic-based models, struggle to keep up with attackers’ evolving strategies. Phishing detection systems that are accurate, dynamic, and real-time are therefore desperately needed in order to safeguard consumers while they are online 44 .

After finding samples from different sources, we put together a collection of more than fifty phishing emails for testing and analysis. Most of the samples came from the Berkeley Information Security Office. We also got more samples from the email corpus at our university. Table 4 shows a list of high-risk phrases that are often used in phishing emails, along with their weights. The higher the values, the stronger the links to fake emails. These weights show how likely it is that the word will show up in phishing material. We used text mining to look at the samples for phrases that might be phishing.

2. System Architecture & Core Working Principles Phishing emails often contain specific words that indicate fraudulent intent. Table 4 lists common phishing-related terms along with their assigned weight, which helps in identifying patterns in phishing content. Identification techniques used 47 The Phishing Email samples were treated as documents, and we ingested them into our analytical approach. More specifically, we devised a computational methodology for determining the phrase incidence-inverse document frequency for every word in the corpus: The tf-idf metric is an analytical tool used for ascertaining how much importance is attached to a term in a corpus or a group of documents expressed in Equation. The Term Frequency reduces the bias of different document lengths by computing the number of occurrences of a particular term in a document and normalizing it by the length of the document.

On the other hand, the Inverted Document Frequency logarithmically downsizes the high-frequency term and upsizes the value of the low-frequency one to compute the importance of a term throughout the corpus. df(t) = \log{\frac{{Total \number \of \document}}{{Number \of \documents \with \term \t \in \it}}} \] We used the following method to get the tf-idf score for each word to balance term frequency with document importance: \(\:tf\_idf\left(t\right)=tf\left(t\right)\times\:idf\left(t\right)\) .

According to Fig. 2 , it was possible to identify and prioritize terms characteristic of phishing in the corpus, which later became the basis for further analysis and development of the model for detecting phishing. The proposed System starts from Phishing Website Dataset. This dataset contains 80,000 instances and in this, 50,000 is the no. of legitimate website instances and 30,000 is the no. of phishing website instances. And index sql file contains the website link, Result (0: legitimate, 1: phishing), and HTML file names (instances) 48 . After that, the visual features will be extracted from visual blocks. Each visual block can be regarded as a rectangle. We will extract the position coordinates of the top left corner of the rectangle and extract the length and width of the rectangle. On the other hand, the components, such as URL, Protocol, subdomain, primary domain, domain, base URL and hostname, etc. will be extracted.

Figure 4 illustrates the distribution of suspicious term weights computed using the Term Frequency–Inverse Document Frequency (TF–IDF) model for phishing emails. The bar chart highlights how specific terms exhibit higher relevance in phishing contexts compared to regular communication. The words with the greatest TF–IDF scores are “Request” (weight = 2.657), “Dear” (weight = 1.000), and “Subject” (weight = 0.988). This shows that they are good at spotting phishing emails because they are used a lot in those types of emails.

Although TF-IDF remains a widely used baseline for lexical feature extraction, recent information-retrieval (IR) research (2022–2025) has shifted toward embedding-driven and transformer-based representations such as BERT, Sentence-BERT (SBERT), DistilBERT, SimCSE, and contrastive retrieval models. These modern techniques capture contextual semantics, paraphrasing relationships, and subtle lexical variations far more effectively than TF-IDF, making them increasingly popular in phishing-URL analysis and malicious-content detection. Several recent phishing-detection studies also integrate hybrid deep-retrieval pipelines and optimization-enhanced embedding models to improve semantic understanding of misleading URLs and webpage text. However, such approaches typically require significant computational resources, GPU acceleration, and large memory footprints, which make them unsuitable for deployment inside lightweight, browser-based phishing detection systems. In this work, we enhance the classical TF-IDF signal by integrating it with MCC-optimized feature selection, visual similarity cues, and URL-based statistical features, enabling it to perform competitively without the computational overhead associated with modern embedding architectures.

The recommended way to find phishing sites depends a lot on how you get visual features. It uses tricks that are based on how things look to help the system find fake websites that look like real ones. A headless browser like Selenium with ChromeDriver goes to each site first. They then look at the HTML and the pictures. The CSS and DOM layout show you the different parts of the homepage. We check out where each block is, which has different kinds of content like logos, input forms, and navigation bars. This includes where it is, how big it is, and what shape it is. These shapes show what the page looks like. People look for logos and other things using perceptual hashing (pHash) and template matching. After that, color histograms, background gradients, and font styles are used to find problems with the way things look.The Cosine Similarity and the Structural Similarity Index (SSIM) are two ways we can see how similar the test and real templates are. The Grey Wolf Optimizer (GWO) is used to improve the features that were found.These features include location, color, style, and similarity metrics. These traits are put into one feature vector. These visual features are finally combined with URL- and content-based properties to make a complete feature matrix that makes the model more robust and easier to understand. This integrated approach makes the system better at giving accurate and easy-to-understand detection results, makes it more resistant to zero-day phishing attacks, and catches subtle visual mimicking that other methods often miss.

The progressive workflow of the visual feature extraction procedure utilized in the suggested phishing detection framework is depicted in Fig. 5 . Webpage rendering and screenshot capture are the first steps in the process, which involves processing each website in a controlled setting to extract both HTML and visual data. After that, the page is divided into visual blocks according to the CSS layout and Document Object Model (DOM). To obtain the structural and visual characteristics of the webpage, two studies are conducted simultaneously: positional attribute extraction and color and style analysis. These result in layout similarity measurement, which examines how closely the layout resembles those of reliable websites, and item or logo matching. To create a complete collection of features, the data is transformed into feature vectors, which are subsequently joined with URL- and content-based features. To more precisely identify phishing sites, this gathered data is then fed into the GWO-optimized classifier. The image illustrates how several structural and visual analysis layers cooperate to improve the detection model’s precision and dependability.

When clustering relevant websites, we look at things like HTML and JavaScript features (like website forwarding, on mouseover, right-click, etc.), domain-based features (like DNS, website traffic, page rank, etc.), address bar features (like having an IP address, URL length, having a @ symbol, etc.), and abnormal-based features (like Request URL, Links in tags SFH, etc.). Then, a Grey Wolf Optimizer (GWO) feature selection method based on interpolation will be used to choose the required features from the retrieved features. We used a binary GWO to find a small group of discriminative features from the fused representation. The optimizer finds a mask that keeps high-value features by finding a balance between validation F1 and subset size. GWO kept making smaller subsets with pack sizes of 25 and 60 iterations without hurting detection performance. The next step is word embedding. Feature selection was essential to reduce redundancy, improve classification efficacy, and avert overfitting, given the high dimensionality of the retrieved features. To choose the best feature subset, a binary Grey Wolf Optimizer (GWO) was used.

The grey wolf optimizer (GWO) algorithm is inspired by the social hierarchy and hunting mechanism of grey wolves in nature. It has been successfully applied for solving complex optimization problems due to its strong exploration exploitation balance and ability to converge efficiently toward optimal solutions. In this research, GWO is used to select an optimal subset of discriminative features from the combined feature space (URL, domain, HTML, and visual features) to enhance phishing detection performance 49 .

We select Grey Wolf Optimizer (GWO) for wrapper-based feature selection due to its low hyper-parameter footprint and strong exploration exploitation balance in binary FS settings. Prior studies demonstrate that GWO (including its binary and hybrid forms) attains competitive or enhanced accuracy with smaller subsets relative to PSO/GA, while concurrently minimizing tuning overheads. Recent updates from 2024 to 2025 have made convergence and subset compactness even better, proving that FS is still at the cutting edge. So, we use a binary GWO wrapper that optimizes a class-imbalance-aware objective (MCC) instead of accuracy.

In the past three years, many improved GWO variants and hybrid meta-heuristics have been released. However, our system is meant to be used as a real-time browser extension, which means that it has strict limits on memory use, latency, and computational overhead. Recent studies, such as Adaptive-Mechanism GWO (Li et al., 2025), Adaptive-Weight GWO (Thakur, 2024), hybrid Firefly–GWO models for phishing detection (Ovabor, 2024), and deep-learning-driven optimization pipelines (Barik et al., 2025), illustrate that an enhanced exploration-exploitation balance can yield performance improvements. But these more advanced versions usually need more complicated hyperparameter tuning, bigger population sizes, longer search cycles, or environments that support GPUs, which are not possible to run on the client side in Chrome.

The standard binary grey wolf optimizer (GWO), on the other hand, strikes the best balance between accuracy and ease of use. It consist: Minimal hyperparameters (pack size and iterations), ensuring reliability across devices. Stable convergence behavior on mixed-type phishing features (URL lexical, visual, DOM-based).

Low inference latency, making it suitable for on-page real-time classification (< 50 ms). To ensure fairness, Section X includes a comparative discussion referencing optimizers proposed between 2023 and 2025, demonstrating that although these enhanced variants may outperform classical GWO under offline, high-resource conditions, the standard Binary GWO achieves competitive performance with significantly lower computational cost. This makes it a more practical and reproducible choice for real-world browser-integrated phishing detection.

Institutional approval for the research was obtained, and all methods were performed in accordance with the relevant guidelines and regulations. Extract URL, domain, and visual-based features from 80,000 website samples (50,000 legitimate and 30,000 phishing). Where \(\:{F1}_{score}\) measures classifier accuracy, and ISI/IFI penalizes larger subsets.

The process continues until maximum iterations or no significant improvement is observed. The grey wolf optimizer (GWO) algorithm is based on how grey wolves hunt and how they organize themselves in groups. It has been effectively utilized for addressing intricate optimization challenges owing to its robust exploration-exploitation equilibrium and capacity to converge efficiently towards optimal solutions. This study employs GWO to identify an optimal subset of discriminative features from the integrated feature space (including URL, domain, HTML, and visual features) to improve phishing detection efficacy 50 .

We choose Grey Wolf Optimizer (GWO) for wrapper-based feature selection because it has a small hyper-parameter footprint and a good balance between exploration and exploitation in binary FS settings. Previous research indicates that GWO (along with its binary and hybrid variants) achieves competitive or superior accuracy with smaller subsets in comparison to PSO/GA, while also reducing tuning overheads. Recent variants from 2024 to 2025 make convergence and subset compactness even better, showing that FS is still cutting-edge. So, we use a binary GWO wrapper that directly optimizes a class-imbalance-aware objective (MCC) instead of accuracy.Since phishing features include heterogeneous numeric and categorical attributes, a single kernel function struggles to represent all decision boundaries effectively 51 , 52 . Moreover, SVM tends to be sensitive to noise and irrelevant features, leading to suboptimal generalization in high-dimensional, mixed-type datasets.Therefore, the superior performance of the Random Forest can be theoretically attributed to its ensemble-based variance reduction, robustness to noise, and ability to model complex nonlinear relationships. This aligns with ensemble theory and prior studies indicating that Random Forest classifiers often achieve higher stability and lower generalization error compared to single learners like DT or margin-based models like SVM 53 , 54 .

Given a suspect page \(\:S\) and a legitimate reference page \(\:R\) for the same brand/domain, compute a vector of layout, appearance, and content similarities that is robust to minor styling changes but sensitive to brand-spoofing. Normalization: convert to RGB; gamma 2.2; resize both to \(\:H\times\:W\) (e.g., \(\:900\times\:1366\) ). 3. Software Implementation, Frameworks & Protocols To reduce viewpoint drift, estimate an affine alignment from keypoints (below) and warp \(\:S\to\:\stackrel{\sim}{S}\) so it best overlays \(\:R\) .

Partition the page into a \(\:G\times\:G\) grid (default \(\:G=6\) ). For each cell \(\:c\) : Block density \(\:{b}_{c}\) : ratio of rendered pixels belonging to visible DOM boxes. Dominant tag map \(\:{m}_{c}\) : one-hot of {logo, nav, hero, form, footer, other} from rule-based heuristics. \(\:{b}_{c}^{S}\) and \(\:{b}_{c}^{R}\) = boundary-related feature representations of the Source (S) and Reference (R) domains at cell \(\:c\) .

\(\:{t}_{c}^{S}\) and \(\:{t}_{c}^{R}\) = texture-related feature representations for the same domains. \(\:a\) and \(\:b\) = weighting coefficients controlling the relative contribution of each feature term in the respective loss. \(\:{M}^{R}\) = the corresponding set of reference tags or feature maps from the Reference (R) domain. \(\:{h}_{i}^{S}\) = histogram value (or normalized bin frequency) for bin \(\:i\) in the Source (S) distribution.

\(\:{h}_{i}^{R}\) = histogram value for the same bin \(\:i\) in the Reference (R) distribution. \(\:a\) and \(\:b\) = weighting coefficients that balance numerator and denominator contributions. Perceptual hash (pHash/dHash, 64-bit): Hamming distance \(\:{d}_{H}\) ; use \(\:1-{d}_{H}/64\) . Descriptor match: Hamming, Lowe ratio \(\:<0.75\) ; estimate homography \(\:H\) with RANSAC (max reprojection 4 px).

Logo region similarity: detect brand logo in \(\:R\) via template (max-normed cross-corr); warp with \(\:H\) ; compute SSIM in that ROI. Compute earth mover’s distance (EMD) between the 2D distributions of form elements’ centers (normalized coordinates). Build bigram TF-IDF vectors from above-the-fold text; cosine similarity \(\:\text{c}\text{o}\text{s}({\mathbf{v}}_{S},{\mathbf{v}}_{R})\) .

Serialize visible DOM to unordered multiset of tag 3-grams along ancestor paths (e.g., header > nav > a). Similarity = Jaccard of these 3-grams; report Tree-Edit Approx via normalized Levenshtein on tag sequences at depth ≤ 4. Concatenate all scalars into \(\:{\mathbf{x}}_{vis}\in\:{\mathbb{R}}^{k}\) (typ.

\(\:k\approx\:30\text{\hspace{0.17em}I}-\text{\hspace{0.17em}I}60\) ). Apply robust scaling (median/IQR) fitted on training data. Missing cues (e.g., OCR fail) filled with feature-wise medians + a binary “missing” indicator. For late fusion, we pass calibrated probabilities from a visual-only model \(\:{p}_{\text{visual}}\) trained on \(\:{\mathbf{x}}_{vis}\) (RF + Platt scaling).

The fusion meta-learner consumes \(\:[{p}_{\text{URL}},{p}_{\text{visual}},{\mathbf{x}}_{meta}]\) , where \(\:{\mathbf{x}}_{meta}\) may include the top-k visual cues (e.g., SSIM, pHash, inlier ratio).

Calibrate \(\:{p}_{\text{visual}}\) with isotonic on a held-out set. Choose thresholds to meet FP rate ≤ 1% while maximizing MCC (reported in Results). This approach could be easily adapted to a multitude of websites with machine learning techniques to find potentially dangerous links, and the discovered links can be identified with a CSS attribute and then subsequently shown on the page.

The model can use real-time web-based information such as domain name, SSL certificate, web traffic, and web hosting provider to verify a URL. The study aims to uncover any links that a hacker might have inserted into a website to steal user credentials or infect the victim’s computer, with malware. These suspicious links have been categorized using a machine-learning method. Moreover, a list of URLs is. Links with very faint visibility and specific spacing characteristics are visible on the webpage. Overview of Technology Algorithm for Random Forest; A type of collective learning approach that combines decision trees into one entity is known as a forest. By selecting features from the dataset and using them to split the data into subsets each tree, in a random forest is constructed independently. This element of unpredictability helps prevent over-fitting and improves the model’s generalization capabilities. When making predictions the random forest process combines forecasts from each tree to arrive at a prediction. The blend of trees enhances the model’s accuracy. reduces variance. After testing algorithms, we opted for using the forests algorithm on our data sample and developing a Chrome extension, for it.

Before feature optimization and classification, a clustering mechanism is applied to organize websites into meaningful groups based on their similarities in URL structure, content, and visual features. The main goal of clustering is to group websites together based on how they act and how they are set up so that they are alike. For example, phishing sites often have too many subdomains, URLs that are too long, or layouts that are very similar to each other. By putting the sites together, the model can find hidden connections that might not be clear when looking at each site on its own.

We used the K-Means algorithm, which is a type of machine learning that doesn’t require supervision, to split the dataset into k groups. A cluster is a group of websites that have similar features. The Elbow Method, which finds a balance between compactness and separation of clusters, was used to choose the number of clusters (k) based on real-world data. Step 1: Feature Standardization: All URL-based, content-based, and visual features are normalized to a common scale to ensure fair distance computation.

Step 2: Centroid Initialization: The algorithm randomly initializes k centroids in the multi-dimensional feature space. 4. Practical Deployment, Analysis & Case Studies Step 3: Assignment Step: Each website instance is assigned to the nearest centroid based on Euclidean distance. Step 4: Update Step: The centroids are recalculated as the mean of all instances assigned to that cluster.

Step 5: Steps 3 and 4 are repeated until convergence (i.e., when centroid movement becomes minimal). Figure 6 shows how the suggested Chrome extension works to find phishing. the user browser environment is where the process begins. The system keeps track of the URL and webpage metadata in real time while the user is browsing. The feature extraction module looks at both visual and URL-based features after it gets this information. After that, the grey wolf optimizer (GWO)-based classifier looks at these features and picks out the ones that matter the most. Then, it tries to find out if the site is real or a scam that wants to steal your personal information.

Figure 7 depicts what the full phishing detection system that GWO has developed looks like. The architecture has a number of different parts. The first layer is made up of URLs, user activities, webpage content, and visual and behavioral elements. A classification module employs machine learning methods like Decision Tree, SVM, and Random Forest to detect the difference between a real website and one that wants to deceive you into giving them your personal information.The final decision output is transmitted to the Chrome Extension Output Interface, which provides users with real-time phishing alerts and website legitimacy status directly within the browser environment. The design ensures low latency, high accuracy, and seamless user interaction for proactive phishing prevention.

Figure 8 illustrates the end-to-end workflow of the proposed phishing website detection framework implemented as a Chrome browser extension. The system integrates URL and visual feature extraction, feature selection using the Grey Wolf Optimizer (GWO), and multi-model classification for phishing detection. We selected GWO’s pack size \(\:N\) and iteration budget \(\:T\) to balance convergence quality with training time. Because wrapper FS evaluates a learner at every fitness call, \(\:N\) and \(\:T\) drive cost roughly as \(\:O(T\cdot\:N\cdot\:d)\) where \(\:d\) is the feature count.

F = the full feature set, where \(\:\mid\:F\mid\:\) denotes the total number of available features. \(\:\text{MCC}\left(S\right)\) = the Matthews Correlation Coefficient obtained using the subset \(\:S\) . \(\:\lambda\:\) = the regularization coefficient (penalty term) controlling the trade-off between model accuracy and feature subset size.

with \(\:\lambda\:\:\) set small (e.g., 0.01–0.05) to prefer compact subsets when predictive utility is tied. Protocol. We ran a budgeted grid over \(\:N\in\:\left\{\text{10,25,40}\right\}\) and \(\:T\in\:\left\{\text{40,60,100}\right\}\) using stratified 5 × 2 CV on the training split, early stopping (patience = 10 iterations without MCC improvement), and a fixed random seed set \(\:\{0,\dots\:,4\}\) . We then applied the one-standard-error rule: choose the smallest \(\:(N,T)\) whose median MCC is within one standard error of the best run.

\(\:N=25,T=60\:\) reached ≥ 99% of the best median MCC while cutting runtime by ~ 30–40% versus \(\:N=40,T=100\) . Larger \(\:N\) or \(\:T\) yielded diminishing returns (negligible MCC deltas but materially higher time). Early-stopping triggered in most folds before 60 when \(\:N=25\) , indicating adequate exploration–exploitation balance. Table 5 summarizes the experimental evaluation of the MCC-optimized Grey Wolf Optimizer (GWO) feature selection framework across varying pack sizes ( \(\:N\) ) and iteration counts ( \(\:T\) ). The results report both Median and Mean MCC values (with standard deviation), the percentage of features retained, and the average training time per run.As observed, increasing the pack size and iteration count generally enhances exploration and convergence stability, leading to marginally higher MCC values. However, larger configurations (e.g., \(\:N=40,T=100\) ) show diminishing returns beyond moderate iteration levels, indicating that GWO achieves near-optimal performance with smaller packs and fewer iterations (e.g., \(\:N=25,T=60\) ).We fix \(\:N=25\) and \(\:T=60\) as the smallest configuration within one standard error of the best MCC, yielding competitive performance with materially lower compute. This choice also stabilizes population diversity without excessive evaluation cost.

Phishing datasets are typically imbalanced; MCC uses all four confusion-matrix terms and remains informative when accuracy/F1 can be misleading. When any denominator term is zero, we follow the standard convention of returning MCC \(\:=0\) . Also report confusion matrix, precision-recall AUC, Recall@low-FP (e.g., FP rate ≤ 1%) and Brier score (calibration), because deployment thresholds matter for user safety.

Provide per-dataset MCC and per-fold variance; include a calibration plot to justify alert thresholds. Across datasets, Random Forest + GWO-selected features achieved the highest MCC, indicating balanced gains in true positives and true negatives while controlling false positives—consistent with our deployment goal of minimizing user disruption.

The experiments were conducted using a hybrid dataset created from multiple verified and public phishing data repositories, ensuring diversity in attack vectors and site characteristics. The dataset sources include: Table 6 shows the main datasets that were used in phishing detection trials. It has both datasets that are managed by the university, like the Berkeley Information Security Office and university email archives, and datasets that anyone can access, like PhishTank and the UCI Machine Learning Repository. The project’s GitHub repository has a combined dataset that includes many URL-based, visual, and behavioral elements. This makes sure that all aspects of both real and fake websites are taken into account for strong model training and validation.

Min-Max normalization was used to bring all features into the [0,1] range before training.We used one-hot encoding to encode categorical attributes so that they would still be easy to understand. To keep the class distribution, the dataset was split up using a stratified random sample method: This division ensures that both legitimate and phishing samples are proportionally represented in all subsets.

The 30,000 phishing accounts and the 50,000 legitimate accounts were inherently out of balance. This was corrected by using a Synthetic Minority Oversampling Technique (SMOTE) to the training data in order to equalize the classes. This prevents the model from favoring real samples and enables it to effectively learn patterns unique to phishing. Examining model metrics with and without SMOTE allowed us to verify this. Finding minority (phishing) cases was made easier by balancing, as evidenced by the 6.4% improvement in recall for the phishing class when SMOTE was used.

We trained three classifiers: Random Forest (RF), Decision Tree (DT), and Support Vector Machine (SVM). We used features that GWO had improved. By cutting down the number of characteristics from 52 to the top 31 that were useful for telling different types of data apart, the GWO method made things more efficient and general. We used ten-fold cross-validation to check each model and make sure it was stable and worked the same way every time.

5. Performance Evaluation & Extended Technical Observations Table 7 shows how well three classification models support vector machine (SVM), decision tree (DT), and random forest (RF) worked on the GWO optimized feature set when tested with 10-fold cross-validation. The results of the confusion matrix for the Random Forest classifier when it was tested on the test dataset are shown in Table 8 . This happened after optimizing the features using GWO. Out of 12,000 test samples, the model correctly identified 5,867 phishing sites and 5,895 real sites. It made 133 mistakes that were wrong and 105 mistakes that were right. The results show that the model is very accurate (98.2%) and can easily tell the difference between real and fake websites. This shows that it can be trusted to find and stop phishing in the real world.

Table 9 shows the confusion matrix of the support vector machine (SVM) classifier evaluated on the test dataset using GWO-optimized features. The test results demonstrate that the Grey Wolf Optimizer (GWO) improved the system work much better by getting rid of features that were either unnecessary or already there. It was easier to get things in order, and the training took place faster.

The 10-fold cross-validation test showed that the model could easily work with new data. This implies that more effective classifiers, like Random Forest, could stay precise across various datasets and didn’t get too good at just one of them. The high-quality dataset had features that were based on links, actions, and pictures, among other things.This made sure that the strong identification worked on phishing sites that had never been put on a blacklist before. It worked well to add the trained Random Forest model to the back end of the Chrome extension.

We chose the Support Vector Machine (SVM), Decision Tree (DT), and Random Forest (RF) models because they can learn from one other and have been demonstrated to operate well in studies of phishing and cybersecurity classification. There are various ways to learn from an instructor. Support Vector Machines (SVM) assist make margins better in spaces that have more than one dimension. Random Forest makes better generalizations by looking at the differences between its members, while Decision Trees assist people make decisions in a certain order.From a theoretical point of view, SVM was chosen because it can make the best separating hyperplanes even in spaces with non-linear features. This is a great choice for working with hybrid URLs and visual features that have overlapping distributions. The Decision Tree benchmark model was useful for analyzing the importance of features because it was cheap to run and easy to understand. Random Forest, on the other hand, uses bagging and random feature selection to combine many decision trees that are not related to each other.

This makes it less likely to overfit and more able to handle noisy and unbalanced data. Tests that compared different methods showed that Random Forest consistently did better than the others in terms of precision, recall, and F1-score, while keeping the inference latency low enough for real-time detection in a browser. The fact that it was very stable, had a low false-positive rate, and was very resistant to changes in adversarial features more than made up for the fact that it cost more to train than SVM and DT. Random Forest was chosen to be used in the Chrome extension for real-time phishing attack detection because it was the fastest, most accurate, and most reliable option.

Support vector machines (SVM), decision trees (DT), and random forests (RF) are classic machine learning models that are still useful in modern phishing detection systems, especially when speed and accuracy are important. Researchers have been looking into more and more advanced architectures over the past three years. These include hybrid CNN–RNN pipelines, attention-based transformers, gradient-optimized fuzzy systems, and optimization-driven deep learning models. But these methods usually require a lot of processing power, GPU support, or batch processing, which makes them not good for use in a web browser. Recent research 52 shows that lightweight ML models can still compete when they are used with strong feature-engineering and optimization frameworks. In our system, the newness comes from the combination of URL features, visual similarity cues, and Binary GWO-optimized feature selection. These three things work together to make a hybrid lightweight detection pipeline. To make sure the evaluation is fair, we compare our classical models to newer phishing detectors that have come out in the last three years, such as EGSO-CNN 54 gradient-optimized TSK fuzzy classifiers and hybrid Firefly GWO phishing detectors (2024). This shows that our optimized RF model gets about the same accuracy and MCC values while keeping the time it takes to make an inference under 50 ms, which is important for browser extensions that work in real time.

In result section, we found out what makes phishing emails so bad by looking at lots of fake emails and noticing what they all have in common and what words they use to trick people. We used some fancy computer stuff to find out which words and phrases are used a lot in phishing emails by looking at how often they appear in different emails (tf-idf). The unit testing results in Table 5 demonstrate that the KNN-based phishing detection system achieved a 100% accuracy rate in this test case, as the predicted and actual outputs were identical.

Table 10 works by looking at new data points and comparing them to cases that are already known. This makes sure that the classification is correct when there are enough labeled examples. The algorithm is greatly affected by the quality of the dataset. The performance may drop if a new phishing attack is very different from known cases. The K-Nearest Neighbors (KNN) algorithm puts websites into groups based on how similar they are to real or known phishing sites. The KNN algorithm correctly identified the URL ‘ https://twitter.com/login ’ as real because the expected and actual outputs were the same, as shown in Table 6 . This shows that the model can tell the difference between phishing and safe websites with a high level of accuracy.

In Table 11 the KNN algorithm classifies URLs based on their similarity to known phishing and legitimate websites in its dataset. It assigns labels based on proximity to nearest neighbors, making it highly effective in environments where phishing sites exhibit unique structural characteristics. Table 7 shows that for https://www.udemy.com/ this input our code is showing Legitimate and in actuality also it is a Legitimate so the test is a success.

The results in Table 12 show that the SVM model always matched the expected output, which proves that it is reliable for checking URLs that might be fake. Table 12 shows that our code is showing Phishing for the input paypal.de@secure-server.de/secureenvironment. This is also Phishing, so the test is a success. Table 13 shows that the classification results show that the SVM model always matched the expected output. This shows that it is reliable for checking URLs that might be fraudulent. The findings in Table 7 demonstrate that the SVM-based classifier accurately recognized the website as legitimate, thereby reinforcing its efficacy in differentiating between phishing and secure websites. For https://www.wikipedia.org/ , Table 13 shows that Our code is showing that this input is Legitimate, and it really is, so the test is a success. The results in Table 13 show that the Decision Tree classifier is accurate because it correctly identified a well-known safe website as real. This shows that it works well in real-world phishing detection situations. But there is a limit: Decision Trees may have trouble with complex, unseen phishing URLs because they tend to fit too closely to known patterns. Future research might investigate ensemble techniques such as Random Forest or XGBoost to alleviate this problem.

We have some cool things, and we learned that using smart computer programs to tell if something is a scam works well. This system can find and stop phishing attacks by looking for the most common ways that hackers try to trick people online. Using our great idea, we made a Chrome add-on that finds phishing attacks. That’s a big deal. It’s important to remember that scammers are always coming up with new ways to trick people. That’s why the systems that try to catch them need to keep getting better and changing. The results show that the extension can tell the difference between real and phishing URLs in a number of situations. This makes it a very useful tool for stopping phishing in real time.

Due to the low inference latency (less than 250 ms), users can scan URLs rapidly in real time. Table 14 demonstrates that compared to models without optimization, GWO optimization speed up classification by 28%, used 19% less memory, and decreased the number of features from 52 to 31. We tested the trained Random Forest model’s ability to detect phishing in the real world using a Chrome plugin. The plugin records the URLs that users click on before the website loads. The website is then categorized as either “Legitimate” or “Phishing.” The responsiveness and reliability of the extension in the real world were illustrated in Table 15 . A 97.9% detection accuracy was found through user testing on 500 actual websites, 250 of which were phishing and 250 of which were authentic. We compared the effectiveness of the recommended solution to three well-known anti-phishing programs: Netcraft Toolbar, PhishTank Extension, and Google Safe Browsing (GSB). The rate of false positives, detection accuracy, and response time were the parameters that were compared.

Table 16 shows that we used live traffic data and controlled test samples to closely look at cases of false positives (FP) and false negatives (FN). 1.7% of the time, the False Positive Rate (FPR) is true. A small number of trustworthy websites were wrongly flagged, mostly because their URLs were unusual (for example, they were encrypted or shortened).

False negative rate (FNR): 2.1% A small number of very skilled phishing websites were able to avoid detection. This was often because they were new domains with real SSL certificates and favicon structures that looked like those of real websites. When the proposed GWO-optimized phishing detection system was tested in the real world, the false positive and false negative rates are displayed in Table 17 . Real websites with intricate URL structures or numerous redirects were primarily to blame for the low false positive rate (1.7%). New phishing domains that employed substantial obfuscation or SSL spoofing techniques were primarily responsible for the low false negative rate (2.1%).

User protection: The extension provides users real-time alerts so they can make smart choices while they browse. Scalability: The model’s adaptability to various phishing techniques ensures its relevance as attackers develop new strategies. Contribution to cybersecurity: By integrating advanced machine learning algorithms into a browser extension, this study advances the practical application of AI in online safety.

Assessment of classification models operate with and without the grey wolf optimizer (GWO) tool for choosing features. GWO made 3 three machine learning models better: SVM, Decision Tree, and Random Forest. Figure 9 shows this. Without selecting features, the models were 95%, 92%, and 96% accurate. After using GWO, their accuracy rates rose to 97%, 94%, and 98%. The outcomes indicate that GWO does a good job of removing extra features without making the accuracy of categorization worse or better. The most progress was made by Random Forest. Figure 9 illustrates that using GWO to choose features really does make things work better. The models were 95% accurate for SVM, 92% for Decision Tree, and 96% for Random Forest. This was without changing the features. The Grey Wolf Optimizer improved the accuracy to 97%, 94%, and 98%, in that order. This update demonstrates how optimizer can get rid of features that aren’t efficient and have bad correlations. This contributes to the algorithms that learn what makes things different. The random forest algorithm did best, which means it works effectively with GWO’s small but important feature sets. These results demonstrate that GWO does a great job of finding the right balance between exploring new things and using what it already knows.

Performance metrics (precision, recall, and F1-score) of classification models with grey wolf optimizer (GWO) feature selection. Figure 10 shows how the precision, recall, and F1-score values of three classifiers—SVM, Decision Tree, and Random Forest change after employing GWO-based feature selection. The best results were from Random Forest, which achieved a Precision of 97%, a Recall of 98%, and an F1-score of 97.5%. SVM finished in second with a Precision of 96%, a Recall of 97%, and an F1-score of 96.5%. The Decision Tree, on the other hand, generated findings that were a little lower but still dependable (Precision 93%, Recall 94%, F1-score 93.5%). Figure 10 demonstrates how well the classifiers did in terms of accuracy, completeness, and F1-score. This shows us how good the models are at making predictions. The Random Forest classifier did the best overall, with an F1 score of 97.5%, a Precision score of 97%, and a Recall score of 98The measures also show that the framework is strong, meaning that it can reliably find phishing in real-time situations with very few false positives.

To evaluate the effectiveness of the proposed GWO-optimized phishing detection system, several baseline approaches were implemented for comparative analysis. Each baseline represents a widely used category of phishing detection technique in existing literature. Performance comparisons were based on accuracy, precision, recall, and F1-score, using the same dataset of 80,000 URLs.4.2 as shown in (Table 18 ).

The low p-values (< 0.01) across all comparisons confirm that the observed improvements in accuracy are statistically significant and not random. This validates the effectiveness of the GWO feature selection mechanism in enhancing model generalization and performance stability as shown in (Table 19 ). Table 20 summarizes the results of the Wilcoxon signed-rank test applied to evaluate the statistical significance of performance improvements achieved by the GWO-optimized random forest (GWO-RF) model over baseline classifiers. The negative Z-statistics indicate that the GWO-RF consistently achieved higher precision, recall, and F1-scores across all 10-fold cross-validation runs. The low p-values (all below 0.01) confirm that these improvements are statistically significant, with the F1-score exhibiting the highest significance level ( p = 0.002). These findings validate that the enhancements observed in model performance are not random but are the result of effective feature optimization and improved generalization achieved through the GWO algorithm.

Table 21 shows a side-by-side comparison of the optimization methods that were suggested for feature selection and phishing-detection models from 2023 to 2025. Recent studies have produced sophisticated iterations of the Grey Wolf Optimizer, including Adaptive-Mechanism GWO (AM-GWO), Adaptive-Weight GWO (AWGWO), and hybrid meta-heuristics like Firefly GWO, designed to improve convergence velocity and classification precision in high-dimensional security datasets.

Harvested Online Documentation & Reference Sources • https://www.nature.com/articles/s41598-026-35655-7