PROACTIVE PHISHING DETECTION USING DEEP NEURAL NETWORKS: A MULTI-LAYER PERCEPTRON APPROACH FOR MALICIOUS URL CLASSIFICATION

Abstract

Phishing is still one of the most common entry points for cybercrime and is now responsible for a significant portion of the data breaches reported by organizations annually. This paper introduces a deep learning technique for phishing website detection before they extract user's credentials. The UCI Phishing Websites dataset was used for training a Multi-Layer Perceptron (MLP) with 30 structural attributes, attributes related to the address bar and domain attributes for 11,055 labeled URLs. The data was scaled using min-max method and divided into 8,844 training and 2,211 test samples. The network consists of two hidden layers: the first 64 rectified linear units (RLU) with a dropout rate of 0.2, and the second 32 rectified linear units (RLU) with a dropout rate of 0.2, followed by a sigmoid output neuron which is optimized with Adam and trained with binary cross-entropy loss over 30 epochs. The held-out test data was used to test the model, which achieved an accuracy of 95.5 percent, precision of 96 percent, recall of 95 percent, and an F1-score of 95.5 percent, while training data showed an accuracy of 98.1 percent and a recall of 97 percent, demonstrating a small and controlled gap of generalization. Recall was a point of focus for this reason: a false negative is more expensive in a security scenario than a false positive in a security scenario, that is, a phishing site falsely identified as safe. Verizon's 2025 Data Breach Investigations Report indicated that 16 percent of breaches continue to start with phishing, while IBM's 2025 Cost of a Data Breach Report revealed that it takes on average 241 days to detect and contain a data breach. A model that identifies malicious URLs at contact points, instead of after they've caused damage directly addresses that gap in detection. The results validate the fact that a relatively simple MLP can compete with or even exceed the performance of much more complex architectures recently reported in the literature but be still sufficiently fast for real-time use at the client.