How I Built an AI-Powered Phishing Defense Platform from Scratch
By Anveeksh Mahesh Rao | MS Cybersecurity Researcher | Northeastern University, Khoury College of Computer Sciences
Introduction
Phishing continues to be one of the most effective cyberattack techniques in modern cybersecurity. Despite advances in security awareness training, browser protections, and enterprise filtering systems, attackers continue to compromise users through deceptive login pages, impersonation campaigns, malicious redirects, and credential harvesting attacks.
The problem is no longer simply detecting malicious links.
The real challenge is building security systems that users can understand, trust, and act upon correctly.
Most phishing detection tools rely on black-box classifications or generic browser warnings that provide little explanation to users. As a result, users often ignore warnings, misunderstand risks, or become desensitized to security alerts entirely.
This problem led to the development of PhishGuard an AI-powered phishing detection and prevention platform focused on explainable AI, human-centered security, and real-time browser protection.
Rather than functioning as a simple URL scanner, PhishGuard was designed around one core
objective:
Prevent phishing attacks before the user clicks while clearly explaining why the threat exists.
This article explores the architecture, engineering decisions, machine learning pipeline, browser extension system, research alignment, and lessons learned while building PhishGuard v2.0.
The Problem with Traditional Phishing Detection
Most traditional phishing defense systems fall into three categories:
Blacklist-based detection
Browser warning systems
Reputation-based filtering
While effective against previously known malicious domains, these systems struggle with:
Newly registered phishing domains
Brand impersonation attacks
Obfuscated URLs
Social engineering campaigns
Explainability
More importantly, many existing systems fail from a usability perspective.
A generic warning such as:
“This website may be dangerous.”
does not explain:
Why the website is suspicious
What behavior triggered detection
Whether the domain is impersonating a trusted brand
Whether the user’s credentials may be at risk
Users are expected to make security decisions without context.
PhishGuard was designed specifically to solve this gap.
System Design Philosophy
PhishGuard was built using four foundational principles:
Explainability
Human-centered security
Real-time intervention
Hybrid intelligence
The platform combines:
Rule-based detection
Machine learning
Threat intelligence
Browser-based user protection
Domain intelligence analysis
The objective was not merely achieving high classification accuracy.
The objective was building a system that behaves intelligently in real-world user environments.
PhishGuard Architecture
PhishGuard v2.0 uses a multi-layer hybrid phishing detection architecture where every URL is analyzed across multiple independent detection engines simultaneously.
The system contains five major detection layers:
Feature Engineering Engine
Machine Learning Ensemble
Google Safe Browsing Integration
VirusTotal Threat Intelligence
WHOIS Domain Intelligence
Each layer contributes independently to the final phishing verdict.
Layer 1: Feature Engineering Engine
The foundation of PhishGuard is a handcrafted feature-engineering engine containing more than 45 phishing indicators derived from real-world phishing behavior.
These features were intentionally selected based on observed attacker tactics rather than arbitrary URL statistics.
Structural URL Analysis
Phishing URLs often attempt to visually confuse users through excessive complexity.
Structural analysis includes:
URL length
Number of subdomains
Dot count
Hyphen count
Query complexity
Port detection
Double file extensions
Example:
Attackers commonly use long URLs and nested subdomains to hide malicious intent from users.
Entropy Analysis
Entropy measures randomness inside URLs and domains.
High entropy often indicates:
Obfuscated phishing links
Randomized domains
Encoded payloads
Domain Generation Algorithms (DGAs)
Examples:
Legitimate domains are usually human-readable and contain lower entropy values.
Typosquatting Detection
One of the most common phishing techniques involves typosquatting.
Examples:
PhishGuard uses Levenshtein distance analysis to identify domains that closely resemble legitimate brands.
This became one of the strongest indicators within the detection pipeline.
Homoglyph Detection
Modern phishing campaigns increasingly exploit Unicode homoglyph attacks.
Example:
The domain visually appears identical to “paypal.com” but contains Cyrillic characters.
PhishGuard normalizes homoglyphs before analysis to detect these attacks.
Brand Impersonation Detection
The platform contains trusted domain profiles for major brands including:
Google
Apple
Microsoft
PayPal
Amazon
Facebook
Coinbase
Banking institutions
If a URL references a trusted brand but does not belong to an approved domain list, the system elevates the phishing score significantly.
Layer 2: Machine Learning Ensemble
PhishGuard combines three independent machine learning models:
Random Forest
XGBoost
Multi-Layer Perceptron (Neural Network)
The models operate using soft-voting probability averaging.
Random Forest
The Random Forest model captures non-linear relationships between phishing indicators.
Configuration:
400 estimators
Balanced class weighting
Feature subsampling
This model performed particularly well on structural phishing patterns.
XGBoost
XGBoost became the strongest structured-data classifier in the pipeline.
Configuration:
400 estimators
Depth 6
Learning rate 0.05
Subsampling enabled
The model achieved excellent generalization on large phishing datasets.
Neural Network (MLP)
The Neural Network captures higher-dimensional feature relationships missed by tree-based models.
Architecture:
128 neurons
64 neurons
32 neurons
ReLU activation
Adam optimizer
Early stopping
Layer 3: Google Safe Browsing
Every URL is checked against Google Safe Browsing threat intelligence databases in real time.
This provides:
Malware detection
Social engineering detection
Dangerous download protection
Known phishing reputation
If Google confirms a domain as malicious, the phishing score increases immediately.
Layer 4: VirusTotal Threat Intelligence
PhishGuard integrates VirusTotal for multi-engine reputation analysis.
URLs are scanned against more than 70 security vendors simultaneously.
Advantages:
Faster detection of emerging threats
Cross-engine validation
Reputation intelligence aggregation
This layer catches phishing campaigns before they appear in traditional blacklist systems.
Layer 5: WHOIS Domain Intelligence
WHOIS analysis became one of the most powerful phishing indicators inside the system.
Most phishing campaigns rely on newly registered domains because:
Reputation systems have no historical data
Blacklists have not indexed them yet
Short-lived campaigns reduce detection windows
PhishGuard analyzes:
Domain registration age
Registrar information
Expiration patterns
Registration anomalies
Scoring logic:
Registered within 7 days → High risk
Registered within 30 days → Elevated risk
WHOIS unavailable → Suspicious
A banking login page registered yesterday is highly unlikely to be legitimate.
Browser Extension Architecture
Detection accuracy alone is not enough.
Security systems must intervene during the actual user decision-making moment.
This led to the development of the PhishGuard browser extension.
Real-Time Link Scanning
The extension automatically scans webpage links in real time.
Features include:
Background link analysis
Phishing risk badges
Red phishing indicators
Amber suspicious warnings
Users receive visual security context before clicking links.
Click Interception System
When users attempt to open dangerous links:
Navigation is paused
Threat details are displayed
Risk explanations appear
Users can safely cancel navigation
The system focuses on explainability rather than simple blocking.
Gmail Phishing Detection
The extension monitors Gmail dynamically using MutationObservers.
Capabilities:
Email link scanning
Dangerous email highlighting
Real-time phishing alerts
Embedded phishing badge injection
This provides phishing protection directly inside user email workflows.
Login Form Protection
This became one of the most important components of the platform.
When a password field is detected:
The page URL is scanned immediately.
Domain reputation is evaluated.
Phishing intelligence is analyzed before credential entry.
If the page is malicious:
Credential entry is blocked
A warning overlay appears
Users are informed before typing passwords
This stops credential harvesting attacks at the point of interaction.
The False Positive Challenge
One of the hardest engineering problems was false positives.
Early versions incorrectly flagged:
as:
Phishing - 100/100
This revealed a major flaw in the typosquatting logic.
The root cause:
“apps” had low edit distance similarity to “apple”
The detection engine incorrectly analyzed trusted subdomains
Entropy thresholds were overly aggressive
URL path analysis inflated phishing scores
Fixes included:
Trusted registered-domain whitelisting
Safe subdomain bypass systems
Domain-only hyphen analysis
Improved ML training data
Trusted brand overrides
After redesign:
apps.apple.com → Safe
faceb00k.com → Phishing
This reinforced an important lesson:
In cybersecurity systems, false positives destroy trust faster than missed detections.
Research Alignment
PhishGuard aligns strongly with several cybersecurity research domains.
Usable Security
The platform explores whether explainable warnings improve user decision-making behavior.
Explainable AI in Cybersecurity
Every phishing verdict includes:
Risk explanations
Triggered features
Domain intelligence reasoning
Users understand why a threat was detected.
Human-Centered Security
PhishGuard was designed around real user behavior moments:
Clicking links
Opening emails
Entering credentials
Phishing Psychology
The system directly addresses:
Authority impersonation
Urgency manipulation
Trust exploitation
Visual deception
These are central mechanisms in phishing attacks.
Lessons Learned
Building PhishGuard revealed several important cybersecurity engineering lessons.
High Accuracy Is Not Enough
Cross-validation scores alone do not guarantee real-world performance.
Edge cases matter more than benchmark metrics.
Explainability Builds Trust
The most valuable output is not:
Risk Score: 91/100
The most valuable output is:
“This domain was registered 2 days ago and impersonates PayPal.”
Human Factors Matter
Security systems must account for human psychology, attention, and decision-making behavior.
Deployment Challenges Are Real
Operational issues matter:
DNS propagation
Browser permissions
Extension sandboxing
Hosting cold starts
Trusted-domain handling
Real-world deployment is often harder than model development itself.
Future Research Directions
Future research areas include:
Visual phishing detection
Logo similarity analysis
Screenshot hashing
JavaScript obfuscation analysis
Credential harvesting detection
Behavioral warning analytics
Transformer-based URL classification
Adaptive phishing prevention systems
These areas represent the next stage of AI-powered phishing defense research.
Conclusion
Phishing attacks continue to evolve because attackers exploit both technical weaknesses and human behavior simultaneously.
Traditional security tools often focus only on detection.\
PhishGuard focuses on:
Detection
Explainability
User understanding
Real-time intervention
Human-centered protection
The goal is not simply blocking malicious URLs.
The goal is helping users recognize threats, understand risks, and make safer security decisions before compromise occurs.
About the Author
Anveeksh Mahesh Rao is an MS Cybersecurity Researcher at Northeastern University specializing in:
Phishing Detection
Explainable AI
Human-Centered Security
Browser Security
Usable Security Systems
His research focuses on designing cybersecurity defenses that users can understand, trust, and interact with effectively.
Comments