Deep Learning-Based Detection of Phishing URLs Using URL Structure and Character-Level Features

Deep Learning-Based Detection of Phishing URLs Using URL Structure and Character-Level Features | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Deep Learning-Based Detection of Phishing URLs Using URL Structure and Character-Level Features Yosef Jbara, Bassam Elzaghmouri, Marwan Abu-Zanona This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8688375/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 11 You are reading this latest preprint version Abstract Phishing attacks are one of the most targeted cybercrimes today, causing billions of dollars in losses each year. Detection systems that rely on phishing blacklists fail to capture new and evolving phishing attacks, while systems based on manually engineered features often lack the accuracy required to detect previously unseen threats. In this paper, we present an effective end-to-end deep learning solution for phishing URL detection by integrating a multi-branch neural network architecture with character embeddings and structural URL features. Our proposed model consists of a combined deep learning architecture incorporating multi-kernel CNN layers, dilated convolution layers, Bi-directional LSTM, and structural features extracted from URLs. To support real-world applicability and scalability, we developed an interactive Streamlit-based dashboard that dynamically generates and manages large-scale datasets, enabling non-static data collection and experimentation. Using this dashboard-driven dynamic data pipeline, we generated synthetic datasets containing up to 2 million URLs. The proposed model was evaluated on datasets containing 1 million URLs and achieved 99.44% accuracy, 99.21% recall, and 99.32% F1-score, significantly outperforming existing machine learning-based baselines. The model was further analyzed using decision curves, lift and gain charts, Kolmogorov–Smirnov statistics, and calibration metrics. Experimental results demonstrate strong generalization capabilities, robustness against zero-day attacks, and suitability for real-world deployment. Additionally, the model provides high interpretability through feature importance and correlation analyses. Physical sciences/Engineering Physical sciences/Mathematics and computing phishing detection deep learning character-level embeddings CNN-LSTM URL features cybersecurity neural networks feature engineering. Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviews received at journal 13 Mar, 2026 Reviews received at journal 08 Mar, 2026 Reviewers agreed at journal 28 Feb, 2026 Reviews received at journal 28 Feb, 2026 Reviewers agreed at journal 28 Feb, 2026 Reviewers agreed at journal 28 Feb, 2026 Reviewers invited by journal 28 Feb, 2026 Editor assigned by journal 23 Feb, 2026 Editor invited by journal 23 Feb, 2026 Submission checks completed at journal 02 Feb, 2026 First submitted to journal 02 Feb, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8688375","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":585060721,"identity":"e10b8b54-3cd3-4df1-a6c7-205dcef43abf","order_by":0,"name":"Yosef Jbara","email":"","orcid":"","institution":"Buraydah Colleges","correspondingAuthor":false,"prefix":"","firstName":"Yosef","middleName":"","lastName":"Jbara","suffix":""},{"id":585060723,"identity":"33f10c94-b819-4d78-bc7b-5d0f0f4f5204","order_by":1,"name":"Bassam Elzaghmouri","email":"","orcid":"","institution":"Al-Ahliyya Amman University","correspondingAuthor":false,"prefix":"","firstName":"Bassam","middleName":"","lastName":"Elzaghmouri","suffix":""},{"id":585060725,"identity":"476d26a3-baa5-457a-a7b9-29a78722a236","order_by":2,"name":"Marwan Abu-Zanona","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA6klEQVRIiWNgGAWjYFACHjiD8WGDDYiRQLwWZsOGNBK1sEkSpUW3/ezBhz9q7siZs/ceq5yRcJiBnz3HgPFHDW4tZmfykg0kjj0ztuw5l3ZzA1CLZM8bA2aeY3i0HMgxkzBgO5y44UaO2c2HPw4zGNzIMWBmYMOj5fwbM4mEf0At99+YFT4A2mJ/A+Swf3i0AA2XONgGsoXHjBHkMAOJHAMG3jZ8Wt4lGzb2HTY2OJNjLDkjIZ1H4syzgsO8ffgclgsMsW+H5QyOnzH82JNgLcffnrwRKIJbCwYAR9MBEjSMglEwCkbBKMACAKxfV6SfCC3mAAAAAElFTkSuQmCC","orcid":"","institution":"King Faisal University","correspondingAuthor":true,"prefix":"","firstName":"Marwan","middleName":"","lastName":"Abu-Zanona","suffix":""}],"badges":[],"createdAt":"2026-01-24 17:23:54","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8688375/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8688375/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":102746742,"identity":"1789cd5a-f152-47c4-902c-6d76b4292969","added_by":"auto","created_at":"2026-02-16 09:00:48","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":834079,"visible":true,"origin":"","legend":"","description":"","filename":"DeepLearningBasedDetectionofPhishingURLv5.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8688375/v1_covered_cf1c6ade-8772-45e4-be12-5ed04d84517b.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Deep Learning-Based Detection of Phishing URLs Using URL Structure and Character-Level Features","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"phishing detection, deep learning, character-level embeddings, CNN-LSTM, URL features, cybersecurity, neural networks, feature engineering.","lastPublishedDoi":"10.21203/rs.3.rs-8688375/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8688375/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003ePhishing attacks are one of the most targeted cybercrimes today, causing billions of dollars in losses each year. Detection systems that rely on phishing blacklists fail to capture new and evolving phishing attacks, while systems based on manually engineered features often lack the accuracy required to detect previously unseen threats. In this paper, we present an effective end-to-end deep learning solution for phishing URL detection by integrating a multi-branch neural network architecture with character embeddings and structural URL features. Our proposed model consists of a combined deep learning architecture incorporating multi-kernel CNN layers, dilated convolution layers, Bi-directional LSTM, and structural features extracted from URLs. To support real-world applicability and scalability, we developed an interactive Streamlit-based dashboard that dynamically generates and manages large-scale datasets, enabling non-static data collection and experimentation. Using this dashboard-driven dynamic data pipeline, we generated synthetic datasets containing up to 2\u0026nbsp;million URLs. The proposed model was evaluated on datasets containing 1\u0026nbsp;million URLs and achieved 99.44% accuracy, 99.21% recall, and 99.32% F1-score, significantly outperforming existing machine learning-based baselines. The model was further analyzed using decision curves, lift and gain charts, Kolmogorov\u0026ndash;Smirnov statistics, and calibration metrics. Experimental results demonstrate strong generalization capabilities, robustness against zero-day attacks, and suitability for real-world deployment. Additionally, the model provides high interpretability through feature importance and correlation analyses.\u003c/p\u003e","manuscriptTitle":"Deep Learning-Based Detection of Phishing URLs Using URL Structure and Character-Level Features","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-12 07:21:15","doi":"10.21203/rs.3.rs-8688375/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"editorInvitedReview","content":"","date":"2026-03-14T02:42:13+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-03-09T01:21:54+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"189599914154348248414108431793272268728","date":"2026-03-01T04:50:39+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-02-28T09:20:07+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"154815005005758819574013295917488841724","date":"2026-02-28T09:05:10+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"165086076613311812243820997282913208903","date":"2026-02-28T08:38:42+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-02-28T08:27:46+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-02-23T07:33:55+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2026-02-23T07:28:26+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-02-02T15:47:14+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2026-02-02T15:14:19+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"b2cfedb9-cb0a-4cc8-b131-6854fd63839b","owner":[],"postedDate":"February 12th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":62241533,"name":"Physical sciences/Engineering"},{"id":62241534,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-02-28T08:38:22+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-12 07:21:15","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8688375","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8688375","identity":"rs-8688375","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}