A Hybrid Framework Combining 1D-CNN Feature Learning, Handcrafted Features, and Bayesian Updating for Phishing URL Detection

Abstract

Phishing remains a widespread cyber threat, deceiving users into revealing sensitive information. Traditional detection draws on URL-based features and non-URL-based features obtained through page parsing or third-party queries, yet adapting to evolving tactics remains challenging. This study proposes a four-phase framework and investigates whether Bayesian inference can revise classification decisions using external evidence proxies. Classical classifiers are trained on 52 handcrafted URL-based features; a one-dimensional convolutional neural network (1D-CNN) is trained directly on raw URL strings; the two are fused; and Bayes' theorem is applied, treating the 1D-CNN output as the prior and updating it with four non-URL-based evidence items: Google indexing, DNS record, WHOIS registration and suspicious top-level domain. On a balanced benchmark of 11,430 URLs, the 1D-CNN with subword tokenisation and particle swarm optimised hyperparameters reaches 92.25% accuracy, exceeding the strongest classical baseline (XGBoost, 91.21%), and hybrid fusion attains 92.53%. The Bayesian layer raises recall from 90.57% to 92.01%, reducing false negatives from 105 to 89. Because false negatives dominate the security cost of phishing, this trade-off favours real-time deployment. Likelihoods were estimated from the benchmark distribution rather than live queries, so the Bayesian component is a proof of concept.