Several significant research studies related to Preventing Phishing Attacks for Cyber Threat Mitigation have been reviewed and analyzed to inform and guide the development of the current work. Table 1 outlines authors, employed methods, datasets used, major findings, and identified challenges or gaps for each study.

Noor et al. (2019) provide a framework for automating the attribution of cyberthreats. Create Cyber Threat Actors (CTAs) specifically by using the distributional semantics approach of NLP to attack patterns that are taken from CTI data. Cyber threats are detected 94% more accurately by the DL Neural Network (DLNN)-based classifier than by earlier classifiers [11] .

Nathezhtha, Sangeetha and Vaidehi’s (2019) phishing detection techniques are unable to address issues such as zero-day phishing website assaults. A three-phase attack detection method called Web Crawler-based Phishing Attack Detector (WC-PAD) has been developed to overcome these issues and precisely identify phishing attacks. It categorizes websites as phishing or non-phishing based on input features such URL, online content, and internet traffic. Datasets from real-world phishing instances are used to experimentally study the proposed WC-PAD. The testing findings show that the suggested WC-PAD has a 98.9% accuracy rate in detecting phishing and zero-day phishing attacks [12] .

Arivudainambi et al. (2019) suggested approach that seeks to reveal different AI-based cyberattacks, their current effects, and their prospects for the future. A self-developed, self-learning autonomous agent is used to carry out the simulation. When comparing the proposed systems with the most advanced methods, experimental findings demonstrate their effectiveness in classifying attack traffic with 99% accuracy [13] .

Niu et al.’s (2017) high-accuracy phishing email detection has been a topic of intense study. It has been shown that ML-based detection techniques, especially SVM, are successful. The study uses a dataset that contains 1384 phishing emails and 20,071 non-phishing emails. According to experimental data, the recommended approach works better in terms of phishing email detection accuracy than the SVM classifier with the default parameter value. The maximum accuracy of 99.52 percent may be achieved using the CS-SVM classifier [14] .

Li and Wang (2017) provide Phish Box, an efficient method for gathering phishing data and developing models for phishing detection and validation. To monitor the PhishTank blacklist and quickly detect and verify phishing websites, the proposed approach integrates the collection, validation, and incorporation of phishing website detection into an online program. The outcome demonstrates that the ensemble validation model can perform well, with a 3.9% false-positive rate and 95% accuracy [15] .

Table 1 provides an outline for a literature review on phishing attacks, with associated data, guidance on what to expect, main findings and issues or gaps still to be resolved.

In this study, PhishTank and Phishing Detection are the two datasets that have been used, both of which are described in detail below:

1) Phishing Dataset

This experiment made use of a Kaggle Phishing dataset. Thirty of the 2670 occurrences in the sample are traits that are used to classify them as phishing websites, and one is a target. As shown in Figure 2 , every website in the dataset is assigned a class indication, where “1” designates a phishing website as well as “0” identifies a non-phishing (legitimate) website.

Figure 2 shows how two classes are distributed within a dataset, likely corresponding to a binary classification problem such as phishing detection. The x-axis is labeled “Value” with two categories: 0 and 1, which typically denote the two classes for example, 0 could represent legitimate instances and 1 could represent phishing instances. The y-axis, labeled “Count”, shows the number of records in each class. From the chart, it is evident that class 0 has a higher count, approximately above 6000, while class 1 has a slightly lower count, around 5000. This points to the fact that the set of data contains more real cases than phishing cases. Though this difference exists, both classes are represented enough to keep bias to a minimum when training using the dataset.

2) PhishTank Dataset

In this study, the PhishTank dataset was utilized, which comprises URLs of websites reported as phishing or fraudulent by users. The dataset includes essential metadata such as the URL itself, the date it was reported, verification status, and whether the site remains active. It contains approximately 38,000 instances with eight distinct features. The dataset is publicly accessible and can be obtained either via a web API or in CSV format. Because PhishTank is updated every day, using the most recent version guarantees that models continue to be successful against changing phishing attacks. This dataset serves as a valuable resource for developing and evaluating anti-phishing detection systems.

Figure 3 illustrates the class distribution of phishing (label 1) and legitimate (label −1) URLs before and after dataset balancing. The pie chart on the left shows the original distribution, where phishing URLs constitute 55.7% and legitimate URLs account for 44.3%, indicating a mild class imbalance. In contrast, the right chart displays a balanced distribution with an equal 50% representation for both classes. Balancing the dataset helps prevent model bias toward the majority class and enhances the fairness and accuracy of phishing detection models.

The Phishing dataset, consisting of different and practical attack cases, was used to prepare and assess the models. It cleaned the data by handling empty values, removing outliers, extracting features, encoding the labels and normalizing the data. With these methods, the dataset became orderly and useful for creating an effective model. The key steps for preprocessing are mentioned below:

A critical process in ML, feature extraction converts unstructured input data into a more concise and informative representation, enhancing model performance and computing efficiency [16] . This work utilizes the Enhanced Global Search Optimization (EGSO) algorithm to extract and choose the characteristics that will help in the categorisation process the most.

1) EGSO Overview and Motivation

EGSO is a metaheuristic optimization technique that improves upon classical global search algorithms by integrating adaptive strategies and exploration-exploitation balancing mechanisms. Its objective in this context is to select an optimal subset of features from the original feature space that maximizes the classification performance while minimizing redundancy and dimensionality.

2) Implementation Details and Parameter Settings

The EGSO algorithm operates as a population-based evolutionary approach with the following key parameters:

Fitness = α × (1 − Accuracy) + β × (Total Features Selected Features), where α = 0.7 and β = 0.3, balancing performance and feature compactness.

3) Optimization Strategy

The optimization process includes:

a) Initialization: Random feature subsets are generated as binary vectors (1 = selected, 0 = not selected).

b) Evaluation: Each candidate is evaluated using a classifier (e.g., Random Forest or SVM) with 5-fold cross-validation to compute accuracy.

c) Search Enhancement: EGSO integrates:

d) Termination: The search ends after T iterations or if convergence is reached early based on minimal improvement over 10 successive generations.

In ML, one-hot encoding changes categories from data into numerical form. Every class is given a new column in the data and the value in that column is 1 if the data point fits the category and 0 if not [17] . This way, every category functions independently, something necessary in many ML algorithms that are built on the idea of measuring distances.

The data was adjusted to equalize the proportion of authentic samples and phishing samples. When the class ratio in a dataset is wildly out of balance, another technique called SMOTE is used to generate additional minority class samples [18] .

Each feature in this study is normalized using min-max normalization, so its value lies between 0 and 1. This method is expressed as Equation (1):

$X_{\text{normalized}}=\frac{X-X_{\min }}{X_{\max }-X_{\min }}$ (1)

where X shows the current value, ${\text{X}}_{\text{min}}$ is the minimum and ${\text{X}}_{\text{max}}$ is the maximum value connected to the data feature.

In this analysis, phishing attack data is divided into a test dataset and a training dataset to study cyber threat mitigation. 75% of the assets are in stocks and 25% are in cash. 25% - 75% of the remaining data is reserved for testing, while the remaining data is utilized for training.

The Phishing dataset was subjected to 5-fold cross-validation using CNN and XGBoost in order to reinforce the assessment, while the PhishTank dataset was excluded as it already demonstrated superior and stable performance. This validation highlights the robustness and consistency of the CNN model over traditional classifiers.

In this study, a CNN was adapted for tabular phishing data by reshaping the feature vectors into 2D matrices of shape (4, 4, 1), enabling convolutional layers to capture spatial relationships between features. A MaxPooling2D layer with a (2 × 2) pool size comes after each of the two Conv2D layers in the design, 32 filters for the first one and 64 filters for the second one. A kernel with ReLU activation (3 × 3) is used in both layers. After flattening the output, the following stages are a Softmax output layer with 5 neurons representing the classification labels and a Dense layer with 64 neurons (ReLU). Following its assembly using the Adam optimizer and training for 50 epochs with a batch size of 32, the model was optimized using categorical cross-entropy loss. This structure leverages the CNN’s capability to automatically extract complex patterns from structured input, as supported by Kanter and Veeramachaneni (2015) [19] , who demonstrated the effectiveness of deep learning models on tabular datasets.

Assess DL’s effectiveness against phishing attempts by using the confusion matrix, F1-score, memory, accuracy, and precision. A confusion matrix gives the total number for each kind of prediction for each class. Accuracy, precision, recall, and F1-score are all determined using a confusion matrix. It is important to know these methods well when looking at how phishing attack detection models work:

Accuracy: ACC stands for the fraction of websites that are correctly divided into legitimate and phishing sites. The relationship can be written mathematically with Equation (2):

$\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{FP}+\text{TN}+\text{FN}}$(2)

Precision: It explains what percentage of positive outcomes are associated with actual phishing attacks. This is shown using the following Equation (3):

$\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}}$(3)

Recall: Recall considers the ratio of phishing attacks in comparison to all attack flows and quantifies the percentage of accurate real positive predictions. It sees its ability to list and remember good things in its past from recall. The relationship for elasticity can also be expressed by Equation (4):

$\text{Recall}=\frac{\text{TP}}{\text{TP}+\text{FN}}$(4)

F1-score: This metric makes it possible to get a trustworthy view of how the model has performed. The metric is ready by computing the mean between precision and recall after reconciliation. It computes Equation (5):

$\text{F}1\text{-score}=2\times \frac{\text{Precision}\times \text{Recall}}{\text{Precision}+\text{Recall}}$(5)

When considering both, it can tell just how well and accurately the model predicts the chosen outcome.

This comparative study presents an evaluation of classification models on two distinct datasets. The resulting performance metrics and key observations from these experiments are summarized below.

1) For Phishing Dataset

Here, using a Phishing dataset, the effectiveness of several models for stopping phishing assaults is assessed, as shown in Table 4 , a comparison among Logistic Regression (LR) [20] , XGBoost (XGB) [21] , and a CNN model that has been presented shows that the CNN model is the most effective. With comparatively straightforward probabilistic assumptions, the XGBoost model demonstrated a strong baseline performance with an accuracy of 91.11%. With an accuracy of 93.97%, LR somewhat beat NB thanks to its superior capacity to represent linear connections. However, the CNN model surpassed both traditional ML approaches, achieving an accuracy of 94.92%. This improvement highlights the CNN’s capability to automatically extract and learn complex patterns from the dataset, making it more adept at distinguishing between phishing and legitimate data. The results suggest that DL models like CNN offer a more powerful solution for phishing attack prevention, especially when working with rich and complex feature representations.

The CNN model can offer several important benefits in detecting phishing attacks. Complex and hierarchical features can be taken from the data automatically without anyone having to manually create them. CNNs do well at finding patterns in the layouts of phishing data, making them the appropriate choice for analyzing structured Phishing datasets. Besides, the model has the ability to generalize well, so the risk of overfitting stays low with noisy or high-dimensional data. Neural network technology allows it to learn complex relationships between features, which makes phishing classifiers more able to adapt as attacks change.

2) For PhishTank Dataset

In this evaluation, the performance of three classification models—Recurrent Neural Network (RNN) [22] , Random Forest (RF) [23] , and Convolutional Neural Network (CNN) was assessed for phishing detection, with results summarized in Table 5 . The RNN model, known for its ability to model sequential dependencies, achieved a strong accuracy of 95.61%, effectively capturing the temporal structure in URL patterns. The RF model performed better than the RNN, with an accuracy of 97.14 percent, leveraging its ensemble learning mechanism to handle feature variability and improve generalization. However, with an astounding accuracy of 99.3%, the CNN model showed the most efficacy. This notable improvement highlights CNN’s strength in automatically learning and extracting complex patterns from structured inputs such as URLs. The results demonstrate that, in contrast to conventional and sequence-based ML models, DL models, in particular, CNNs offer a very reliable and accurate method of phishing detection.

There are several advantages to using DL and sophisticated ML models for phishing detection. The use of DL and advanced ML models for phishing detection has a number of benefits. In addition to their excellent accuracy, these models are flexible enough to adjust to the ever-changing landscape of phishing attempts. For instance, CNNs can automatically extract intricate spatial patterns from URL structures, removing the requirement for human feature extraction and greatly enhancing detection capabilities. RNNs are effective in capturing sequential dependencies within URLs, making them suitable for modeling temporal patterns in phishing behavior. Random Forests offer robustness through ensemble learning, handling diverse features and minimizing overfitting, while also maintaining interpretability. Collectively, these models enhance detection precision, reduce false positives, and enable scalable and real-time deployment, making them highly effective tools for proactive phishing threat prevention.

According to a comprehensive analysis of many DL and ML models for phishing detection, CNN outperforms the others. Because it can predict linear connections, LR marginally outperformed NB, although traditional models like NB and LR obtained acceptable accuracies of 93.48% and 93.97%, respectively. More advanced models like RNN and RF further improved detection capabilities, achieving accuracies of 95.61% and 97.14% respectively, by capturing sequential patterns and leveraging ensemble learning. However, across both evaluations, the CNN model consistently demonstrated the highest performance, achieving 94.47% in one study and an exceptional 99.3% in another, highlighting its ability to automatically extract deep, complex features from URL structures. These results clearly establish CNN as the most effective model among those evaluated for phishing URL detection.