Now 5070 visitors
Today:0 Yesterday:0
Total: 147078 212S 50P 4R
2026-10-20, Week 43
Member Login
TACT Journal Homepage
Call for Paper
Committee
Find My Paper
Author Homepage
Statistics & History
Welcome Message
Paper Procedure
FAQ
Paper Archives
Outstanding Papers
Program & Proceedings
Presentation Platform
Hotel & Travel Info
Photo Gallery
Scheduler Login
Seminar
Archives Login
Sponsors


















Presentation Assistant Go to [Q&A Session]
Paper Number
Paper Title
Keyword
ICACT20260103 Slide.01        [Big Slide]      [YouTube] Chrome Click!!
Good morning, everyone. I am honored to present our research today at ICACT 2026. Our paper is titled: A Hybrid Approach to Phishing URL Detection using Bidirectional LSTM and Evolutionary–Spider Wasp Optimization. Our team from Delhi Technological University recognized a critical gap in current cybersecurity defenses. While phishing attacks are becoming more sophisticated, many detection systems still rely on static rules. Today, we are introducing a robust, hybrid framework that treats a URL as a temporal sequence and optimizes the detection process using a brand-new hybrid optimization algorithm we call hEVOSWO. We believe this approach significantly moves the needle in proactive phishing prevention.
ICACT20260103 Slide.02        [Big Slide]      [YouTube] Chrome Click!!
To give you an overview of today’s presentation, we will begin by discussing the Motivation behind this work and the unique Challenges posed by modern, deceptive URLs. I will then briefly touch upon the Literature Review to show where current systems fall short. The heart of our talk will be the Proposed Methodology, where I will explain our 4-phase feature selection and our novel hEVOSWO algorithm. Finally, we will look at our Results, including a comprehensive Comparison Table and discuss the Real-World Applications and future impact of this framework.
ICACT20260103 Slide.03        [Big Slide]      [YouTube] Chrome Click!!
Moving to the core motivation of our work. Phishing is no longer just a nuisance; it is a global crisis. As you can see from our data, over 5 million attacks were recorded in just one year. The financial stakes are staggering and the average cost of these attacks has surged to nearly $15 million annually for organizations. Large-scale breaches are even more devastating, with IBM reporting that major incidents involving millions of records can cost up to $401 million. These numbers illustrate that traditional blacklists are not enough. There is an urgent, critical need for a robust, integrated framework capable of identifying sophisticated, ever-evolving URL-based threats before they reach the victim. This financial and security gap is exactly what our research aims to bridge.
ICACT20260103 Slide.04        [Big Slide]      [YouTube] Chrome Click!!
While we understand the global impact of phishing, identifying these threats remains a moving target. Traditional defenses, such as rule-based systems and blacklists, are essentially static. They consistently fail to generalize to novel or obfuscated attacks that attackers generate daily. Even recent Deep Learning attempts using standard CNNs and RNNs face hurdles. They often rely on raw, noisy features and require meticulous manual tuning to reach high accuracy. This brings us to the core Research Need our paper addresses. We recognized that a truly effective model must be able to do three things: first, automatically extract deep sequential patterns from the URL string itself, second, optimize feature selection to cut through the noise, and third, fine-tune hyperparameters with high precision. Our hybrid approach was designed specifically to meet these three challenges head-on.
ICACT20260103 Slide.05        [Big Slide]      [YouTube] Chrome Click!!
To ground our research in real-world conditions, we utilized a high-quality dataset derived from the ISCX-URL2016 benchmark. This dataset contains over 11,000 unique samples, providing a robust foundation for our training and testing phases. Each URL in our study is represented by a broad range of lexical and structural features, including length-based metrics, special character counts, and entropy. Crucially, the dataset is almost perfectly balanced, with over 5,500 phishing and 5,500 legitimate URLs. This balance ensures that our model learns to distinguish between classes without bias, providing a challenging yet fair environment to prove the effectiveness of our BiLSTM and hEVOSWO approach.
ICACT20260103 Slide.06        [Big Slide]      [YouTube] Chrome Click!!
To place our research in context, we reviewed the evolving landscape of phishing detection. Early work, such as by Sahingoz et al., highlighted the move away from static blacklists toward machine learnings ability to detect unseen URLs. More recently, Sohaib et al. identified Random Forest as a dominant traditional algorithm, while Putri et al. achieved solid results with it on a dataset similar in size to ours. We also looked at deep learning advancements. Gopal et al. introduced autoencoders for IoT environments, and Jishnu K S et al. leveraged transformer-based RoBERTa and LSTM to capture complex semantic patterns, reaching an accuracy of 97.14%. While these studies are impressive, they often rely on fixed architectures. Our work builds on this foundation by introducing hEVOSWO, a hybrid optimizer that doesnt just use deep learning, but dynamically fine-tunes it to achieve even higher precision and robustness.
ICACT20260103 Slide.07        [Big Slide]      [YouTube] Chrome Click!!
Now, I would like to detail the primary innovations that set our research apart. Our approach is built on three major technical contributions. First, we implemented a multi-phase voting feature selection strategy. Rather than relying on a single method, we combined mutual information, recursive feature elimination, and model-based importance with correlation filtering. This ensures that only the most non-redundant and discriminative features move forward. Second and perhaps most importantly, we propose a novel hybrid metaheuristic algorithm called hEVOSWO. By integrating Evolutionary Optimization with Spider Wasp Optimization, we are able to concurrently optimize both the feature subset and the SVM hyperparameters. This allows for a much more efficient exploration of the search space compared to standard algorithms. Finally, we utilize a BiLSTM-based deep learning architecture. This is crucial because it allows the model to extract both sequential and contextual features from the URL string itself. When these deep embeddings are fed into our optimized SVM, the result is the high-performance detection framework you see here, designed to stay ahead of increasingly complex phishing attempts.
ICACT20260103 Slide.08        [Big Slide]      [YouTube] Chrome Click!!
Before we could feed our data into the complex hybrid architecture, we performed meticulous preprocessing to maintain absolute numerical integrity. As you can see in our workflow, we first addressed mathematical inconsistencies by replacing infinite values with NaNs and entirely discarding any features with more than 30% missing data. Next, we ensured our targets were machine-ready by encoding them into binary classes: legitimate versus phishing. Finally, to ensure no single feature dominated the model based on its scale, we standardized all numerical features using a z-score normalization approach. This rigorous cleaning process ensures that our BiLSTM and SVM models are training on the most informative, standardized data possible, which is the first step in achieving our high accuracy results.
ICACT20260103 Slide.09        [Big Slide]      [YouTube] Chrome Click!!
A critical component of our methodology is the Multi-Phase Voting Feature Selection Framework, designed to distill the most discriminative features from noisy URL data. To achieve this, we employ three distinct selection stages: Mutual Information Filtering: This stage ranks features according to their individual relationship with the target class, retaining only those that exceed the 70th percentile. Recursive Feature Elimination (RFE): We use a lightweight Random Forest to iteratively strip away the weakest features based on their direct impact on predictive performance. Model-Based Selection (SFM): Here, a deep Random Forest with 50 estimators is used to rank and select features based on their importance scores calculated during the training process. As shown in the accompanying diagram, these individual outputs, along with correlation filtering, are fed into a voting-based selection mechanism to ensure our final feature set is both highly relevant and non-redundant.
ICACT20260103 Slide.10        [Big Slide]      [YouTube] Chrome Click!!
Completing our feature selection process, we implement two final layers of refinement to ensure model stability. First, we apply Correlation-Based Pruning. Any redundant features with an inter-feature correlation coefficient above 0.8 are removed, using mutual information scores as a tie-breaker. This prevents our model from being over-fitted to repetitive data. All four strategies: Mutual Information, RFE, SFM, and Correlation Filtering are then synthesized through a Majority Voting Mechanism. A feature is only retained if it is selected by at least three out of the four methods. Finally, we’ve built in a Fallback Mechanism to guarantee stability; if the voting result is too sparse, the system automatically selects the top 20% of features based on mutual information. This dual-layered approach ensures that the BiLSTM network receives only the most discriminative, high-quality data, which is fundamental to our performance.
ICACT20260103 Slide.11        [Big Slide]      [YouTube] Chrome Click!!
Once our features are selected, we pass them into the core of our deep learning model: a stacked Bidirectional LSTM architecture. Unlike standard LSTMs, this bidirectional approach allows the model to capture complex temporal relationships by looking at URL sequences from both the beginning and the end simultaneously. We’ve engineered this with a high-capacity 160-unit first layer, followed by an 80-unit second layer. To ensure the model doesnt just memorize the data, we integrated rigorous regularization, specifically Layer Normalization and Dropout layers ranging from 0.25 to 0.30. This is paired with gradient clipping to maintain absolute training stability. The extracted deep features are then processed through a 256-neuron ReLU-activated dense layer, concluding with a sigmoid-activated head for the final detection. We trained this using the Adam optimizer at a precise learning rate of 0.0004, utilizing early stopping to maximize our ability to generalize to new, unseen phishing threats.
ICACT20260103 Slide.12        [Big Slide]      [YouTube] Chrome Click!!
We now arrive at the core technical innovation of our work: the Hybrid Evolutionary–Spider Wasp Optimization, or hEVOSWO. The primary objective here is to move beyond simple classification by jointly optimizing two critical factors: the most relevant BiLSTM feature embeddings and the optimal SVM hyperparameters, specifically the penalty parameter C and the RBF kernel parameter gamma. Our population is initialized with binary vectors where each bit represents a features inclusion, paired with random values for C and gamma. Over 100 iterations, we evaluate the fitness of each individual using a dynamic sample of training data and the F1-score as our primary metric. What makes this hybrid truly powerful is the balance of search strategies. We utilize Evolutionary Optimization (EVO) to introduce diversity through genetic-style perturbations, ensuring we explore the entire search space. Simultaneously, Spider Wasp Optimization (SWO) imposes localized refinements, probabilistically guiding the feature masks toward the elite solution. This dual-layered optimization allows us to achieve a level of precision that standard algorithms simply cannot reach.
ICACT20260103 Slide.13        [Big Slide]      [YouTube] Chrome Click!!
To understand why hEVOSWO is so effective, we must look at the three mathematical principles that govern its optimization process. First, Equation 1 represents the Spider Wasp Optimization (SWO) component. It uses a probabilistic mechanism where, at any given iteration t, a feature j in the population f subscript i, has a time-decaying probability of inheriting the state of the elite solution f subscript e. This allows for aggressive local refinement as the search progresses. Second, Equation 2 introduces the Evolutionary (EVO) diversity. We apply a mutation operator with a dynamic mutation probability p subscript m. By scaling p subscript m inversely with time, we ensure the model maintains global exploration in the early stages and stabilizes as it converges toward the optimal solution. Finally, Equation 3 defines our Adaptive Stochastic Search. We apply Gaussian noise delta superscript t with a decaying standard deviation sigma subscript t. By using this exponential decay, controlled by the initial magnitude sigma subscript 0 and the decay rate lambda, we ensure that our hyperparameter tuning for C and gamma starts broad but becomes incredibly precise as the algorithm matures. This mathematical synergy is what allows our model to find the global optimum without getting trapped in local minima.
ICACT20260103 Slide.14        [Big Slide]      [YouTube] Chrome Click!!
To finalize our optimization framework, we move to the specific parameter update rules that define how our SVM learns. Equations 4 and 5 represent the core logic for updating the penalty parameter C and the RBF kernel parameter gamma. As you can see, each update is a combination of the current value, a learning coefficient alpha directed toward the elite solution, and the adaptive Gaussian noise delta superscript t we discussed previously. We use a clip function to ensure these parameters stay within their logically defined search spaces between 0.1 and 50 for C, and between 0.0001 and 1 for gamma. This hybridization is the secret to our model’s success. It allows the optimizer to navigate massive, complex solution spaces using the Evolutionary global exploration, while simultaneously zeroing in on the most promising regions using the Spider Wasp local refinement. By the end of our 100 iterations, we are not just guessing the best parameters; we have mathematically converged on them.
ICACT20260103 Slide.15        [Big Slide]      [YouTube] Chrome Click!!
On the Left, The Algorithm 1 details our Multi-Stage Feature Selection. It illustrates our rigorous four-phase approach, where features must survive mutual information filtering, recursive elimination, and model-based ranking. By using a majority voting mechanism where a feature index is only included in the final set, F superscript asterisk, if it appears in at least three out of the four selection sets then we ensure that our input to the deep learning model is highly discriminative and incredibly lean. On the right, we have Algorithm 2, our Hybrid Evolutionary-Spider Wasp Optimization (hEVOSWO). This pseudocode shows how we concurrently optimize both the binary feature mask and the real-valued SVM hyperparameters, C and gamma. It highlights the iterative process where, for each of our 100 iterations, we evaluate the fitness of our population using the F1-score. You can see the Elite solution index mechanism in step 12, which then guides the localized refinement of the other solutions in the search space. This combination of global exploration and local fine-tuning is what allows our model to reach its peak performance.
ICACT20260103 Slide.16        [Big Slide]      [YouTube] Chrome Click!!
Once our hEVOSWO algorithm has completed its 100 iterations, we move to the final stage: Classifier Integration. The primary step here is Final Training. We take the specific Optimal Features Parameter and the best feature mask discovered during the optimization phase and use them to retrain our final SVM model using the RBF kernel. This ensures that the classifier is not just using generic settings, but is perfectly tuned to the deep temporal patterns identified by the BiLSTM. Finally, we perform a rigorous Evaluation to ensure real-world readiness. We validate the model’s generalizability on a 25% stratified holdout set. This separate, unseen data is what produces our final classification of a URL as either PHISHING or LEGITIMATE, confirming that our hybrid framework can handle new threats with the high accuracy we are about to see in our results.
ICACT20260103 Slide.17        [Big Slide]      [YouTube] Chrome Click!!
Moving to our performance results, these curves provide clear evidence of our model’s learning efficiency. On the left, the Training and Validation Accuracy graph shows a rapid climb that stabilizes near 97%. Notice how the validation curve closely tracks the training curve. This is a critical indicator that our hybrid framework generalizes exceptionally well to unseen data and is not suffering from overfitting. On the right, the Loss Curves show a steady, synchronized decline. The smooth stabilization of both training and validation loss further validates our early stopping mechanism, proving that the model reaches its peak predictive power without unnecessary computational waste. Together, these results confirm that the combination of BiLSTM and hEVOSWO creates a highly stable and reliable detection system.
ICACT20260103 Slide.18        [Big Slide]      [YouTube] Chrome Click!!
To further evaluate the robustness of our classifier, we analyze its performance through two critical diagnostic curves. On the left, our Precision-Recall curve maintains a high level of precision across nearly all recall values, achieving an Average Precision of 0.9772. This is a vital result because it proves the classifier remains robust and reliable even in the face of potential class imbalances, ensuring we do not sacrifice accuracy to catch more phishing attempts. On the right, the Receiver Operating Characteristic, or ROC curve, shows near-ideal performance with an AUC value of 0.9867. The curves sharp ascent toward the top-left corner demonstrates an exceptional True Positive Rate paired with an extremely low False Positive Rate. These results collectively confirm that our hybrid BiLSTM and hEVOSWO model is not just accurate on paper, but possesses superior discriminative power for real-world deployment.
ICACT20260103 Slide.19        [Big Slide]      [YouTube] Chrome Click!!
To conclude our quantitative analysis, we present the Confusion Matrix, which offers a granular look at our models decision-making precision. As the matrix illustrates, our hybrid framework demonstrates exceptional clarity in distinguishing between classes. Out of our testing set, the model correctly identified 1,598 legitimate URLs and 1,585 phishing URLs. What is most impressive for a security application is the extremely low error rate; we recorded only 42 false positives and 46 false negatives. The fact that the vast majority of our predictions fall squarely on the diagonal confirms that our model achieves high accuracy while maintaining an incredibly low false-alarm rate. This level of reliability is exactly what is required for a real-world phishing detection system to be both effective and trusted by users.
ICACT20260103 Slide.20        [Big Slide]      [YouTube] Chrome Click!!
To truly validate our research, we conducted a comprehensive benchmark analysis against the most recent and prominent state-of-the-art models in the field. As you can see in this comparison table, our BiLSTM with hEVOSWO framework outperforms existing methodologies across every key metric. While advanced models like the RoBERTa and LSTM hybrid by Jishnu et al. achieved a strong accuracy of 97.14%, our approach reaches a superior 97.31%. We also see significant leads over traditional machine learning models, such as the Random Forest model by Putri et al., which stands at 93.7%, and the KNN model by Irsan et al. at 95%. What is most notable is our Precision of 0.9742 and F1-Score of 0.9730. These are the highest in the cohort, proving that our hybrid optimization doesnt just improve raw accuracy, it creates a more reliable, balanced, and high-performance system than currently available alternatives. This comparative success highlights the effectiveness of our novel hEVOSWO algorithm in fine-tuning deep learning architectures for critical cybersecurity tasks.
ICACT20260103 Slide.21        [Big Slide]      [YouTube] Chrome Click!!
To conclude our presentation, I want to discuss how our hybrid framework translates into tangible Real-World Applications. Our research is not just a theoretical exercise; it is designed for immediate integration into the global cybersecurity ecosystem. First, this model serves as a proactive layer of Real-Time Cyber Defense. By identifying zero-day phishing attempts before they ever reach the user, it can be deployed directly into web browsers and email gateways to block threats at the point of entry. Second, we see a massive opportunity for Financial Fraud Mitigation. By safeguarding banking institutions against credential theft and Business Email Compromise, our framework directly addresses the multi-million dollar economic impact of phishing we discussed at the start. Finally, our approach is uniquely suited for Critical Infrastructure Protection. Within complex Industrial Internet of Things (IIoT) environments, such as power grids and smart manufacturing, our model can detect sophisticated intrusions that traditional systems often miss. By combining deep temporal learning with high-speed optimization, we provide a robust, scalable shield for the digital infrastructure of tomorrow.
ICACT20260103 Slide.22        [Big Slide]      [YouTube] Chrome Click!!
To wrap up our presentation, we have introduced a hybrid framework for phishing URL detection that effectively bridges the gap between deep temporal learning and advanced metaheuristic optimization. By integrating a four-stage feature selection process with a BiLSTM network for deep embedding extraction, and optimizing the final classifier through our custom hEVOSWO algorithm, we have achieved a system that offers both high classification accuracy and remarkable computational efficiency. Our experimental results on the ISCX-URL2016 benchmark speak for themselves: reaching a peak accuracy of 97.31% and an ROC AUC of 0.9867. These results confirm that combining deep sequential learning with precise optimization makes this framework highly suitable for real-world cybersecurity deployment. Looking ahead, our Future Work will focus on bringing this research into the hands of users through real-time deployment as a browser extension or API. We also plan to expand the models capabilities to support multilingual and obfuscated URLs, integrate transformer-based encoders, and conduct rigorous evaluations under adversarial phishing scenarios to ensure long-term robustness.
ICACT20260103 Slide.23        [Big Slide]      [YouTube] Chrome Click!!
Finally, here are the core References that supported our research, including the benchmark ISCX-URL2016 dataset and the foundational metaheuristic and deep learning studies we built upon.
ICACT20260103 Slide.24        [Big Slide]      [YouTube] Chrome Click!!
Our second set of references includes recent state-of-the-art studies in deep learning and metaheuristic optimization. These works provided the baseline metrics against which we proved the superior 97.31% accuracy of our hEVOSWO framework.
ICACT20260103 Slide.25        [Big Slide]      [YouTube] Chrome Click!!
This concludes our presentation, and I am now open to any questions. Thank you.
ICACT20260103 Slide.26        [Big Slide]      [YouTube] Chrome Click!!
This concludes our presentation, and I am now open to any questions. Thank you.