Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →15 papers
Adaptive Phishing in the 2026 Enterprise: Threat Modeling, Multi-Layer Detection, and Operational Defenses Against Credential Theft, Business Email Compromise, and AI-Assisted Social Engineering
Phishing remains one of the most economically efficient and operationally resilient attack classes in cybersecurity because it exploits human trust, workflow dependence, and identity-centric access control. By 2026, the problem has evolved well beyond mass email lures into a multi-channel ecosystem that spans email, collaboration platforms, SMS, QR codes, OAuth consent abuse, adversary-in-the-middle (AiTM) session hijacking, callback phishing, and AI-assisted personalization at scale. This paper presents a 2026-accurate, publication-ready study of phishing as a socio-technical attack surface and proposes a defense methodology centered on identity telemetry, content and URL analysis, behavioral detection, and automated containment. We formalize phishing as a probabilistic interaction between attacker capability, user susceptibility, and control-plane exposure, and we define measurable security objectives in terms of compromise probability, detection latency, and dwell time. Building on modern enterprise controls such as zero trust, DMARC alignment, conditional access, secure email gateways, browser isolation, CNAPP, and eBPF-based telemetry, we present a layered detection architecture that integrates message analysis, identity signals, endpoint events, and cloud audit logs into a unified risk model. We also evaluate the approach using realistic phishing scenarios representative of 2024–2026 tradecraft, including QR credential theft, Microsoft 365 token replay, and invoice-themed BEC. The experimental section compares baseline filtering to a fused detection pipeline and demonstrates substantial gains in recall and mean time to containment while preserving acceptable false-positive rates. A detailed case study of an enterprise-grade AiTM phishing campaign illustrates the operational value of cross-domain telemetry and fast revocation. The paper concludes with practical guidance for defenders, highlighting why the next generation of phishing defense must be identity-aware, AI-assisted, and built for high-speed response rather than static signature matching.
Read paper →PhishingPhishing in 2026: Adversary Tradecraft, Detection Engineering, and a Risk-Adaptive Defense Framework for Modern Identity-Centric Enterprises
Phishing remains the dominant initial access vector in enterprise compromise because it exploits the most scalable weakness in modern environments: human decision-making under time pressure, ambiguity, and trust. By 2026, phishing has evolved well beyond mass email lures into a multi-channel ecosystem spanning email, SMS, collaboration suites, QR codes, OAuth consent abuse, adversary-in-the-middle (AiTM) credential interception, browser-in-the-browser deception, and AI-assisted social engineering. This paper presents a technical, publication-ready analysis of phishing as an operational cyber threat and a defense problem. We formalize phishing as an identity-centric attack pipeline in which an adversary optimizes the probability of a victim completing a harmful action while minimizing pre-delivery and post-delivery detection. We then propose a risk-adaptive defense methodology that combines authentication hardening, provenance enforcement, content and URL analysis, user interaction telemetry, detection engineering, and response automation. The methodology is designed for 2026-era environments characterized by widespread MFA adoption, conditional access, cloud collaboration, mature zero trust architectures, and the integration of eBPF, CNAPP, and SIEM/SOAR pipelines. The paper includes an implementation blueprint, a reproducible evaluation design, and a case study illustrating how AiTM phishing bypasses legacy MFA assumptions. Our evaluation framework models the expected loss reduction from layered controls, using both static controls such as DMARC enforcement and FIDO2-resistant authentication, and dynamic controls such as time-of-click URL analysis and session risk scoring. We show that no single control is sufficient: robust phishing defense requires coupling preventative controls with rapidly-instrumented detection and response. The paper concludes with practical recommendations for enterprises, security vendors, and incident responders, emphasizing identity governance, phishing-resistant MFA, continuous control validation, and the operational limits of user awareness training in isolation.
Read paper →PhishingPhishing in 2026: A Cyber Operational Framework for Detection, Resistance, and Large-Scale Measurement Across Email, Identity, and AI-Mediated Attack Surfaces
Phishing remains the most persistent and adaptable initial-access vector in modern cybersecurity, but its 2026 form is materially different from the message-spam archetype of the 2010s. Contemporary phishing operations are multi-stage identity attacks that blend credential theft, session hijacking, adversary-in-the-middle (AiTM) reverse-proxy infrastructure, OAuth consent abuse, business email compromise (BEC), QR-based lures, domain impersonation, and increasingly AI-assisted social engineering. This paper presents a publication-ready, operationally grounded framework for understanding, measuring, and defending against phishing as an end-to-end kill chain spanning delivery, deception, authentication bypass, and post-compromise monetization. We formalize phishing risk as a function of exposure, user susceptibility, control-plane weaknesses, and attacker infrastructure resilience, and we map this model to concrete controls spanning DMARC/DKIM/SPF, conditional access, phishing-resistant MFA, browser and DNS protections, egress telemetry, identity threat detection, and user-facing reporting loops. The paper synthesizes 2026-era threat intelligence and defensive practice, including trends in AiTM kits, token theft, QR phishing, cloud identity abuse, and generative-AI-enabled lure optimization. We propose a methodology for high-fidelity phishing defense that combines graph-based sender reputation, URL and page feature extraction, identity-context scoring, and response orchestration, then describe an implementation architecture using mail gateway telemetry, cloud identity logs, browser isolation signals, and SOAR playbooks. Experimental evaluation is presented as a realistic comparative analysis of layered controls across simulated enterprise traffic, showing that no single control is sufficient; rather, robust reduction in compromise rates emerges only when content filtering, authentication hardening, and identity telemetry are fused. A case study of a Microsoft 365 tenant demonstrates how an AiTM campaign can be detected after token replay, and how rapid containment reduces blast radius. The paper closes with operational lessons for 2026: phishing should be treated as an identity-security and fraud problem, not merely a spam-filter problem, and defensive maturity now depends on integration across email, endpoint, browser, cloud identity, and governance layers.
Read paper →PhishingPhishing in 2026: A Socio-Technical, Identity-Centric, and AI-Aware Defense Framework for Detection, Disruption, and Resilience
Phishing remains the dominant initial access vector in cyber intrusion campaigns because it exploits the most difficult boundary in security: human trust operating inside identity systems that are increasingly federated, cloud-native, and machine-augmented. In 2026, the phishing landscape is characterized by highly personalized lures, adversary-in-the-middle credential interception, OAuth consent abuse, QR-based delivery, business email compromise, deepfake-enabled social engineering, and large-scale infrastructure rotation that defeats simplistic URL-blocking approaches. This paper presents a full-stack research treatment of phishing as a socio-technical attack class and proposes an identity-centric defense methodology designed for the 2026 threat environment. The methodology integrates mail authentication, browser and endpoint telemetry, identity-provider signals, user-risk modeling, content and network analysis, and incident response automation. We formalize phishing as a probabilistic attacker-success optimization problem under constraints on time, cost, and detection risk, and we derive defense objectives that minimize both compromise probability and dwell time. The paper further presents an implementation blueprint using widely deployed controls and open tooling, including DMARC, SPF, DKIM, MTA-STS, TLS-RPT, Microsoft Defender for Office 365, Google Workspace protections, YARA, Zeek, Sigma, and SOAR workflows. Experimental evaluation is reported through a realistic lab design that compares attachment, URL, credential-harvest, QR, and consent-phishing variants, showing that no single control is sufficient but layered identity-aware defenses can materially reduce success rates and shorten containment time. A detailed case study illustrates a modern adversary-in-the-middle campaign and the practical value of token revocation, conditional access, and tenant-wide hunt logic. The paper concludes with an operational discussion of limitations, user training, organizational governance, and future work in passkey adoption, browser isolation, post-quantum readiness, and AI-assisted defense.
Read paper →PhishingOperational Phishing in the AI Era: Offensive Tradecraft, Detection Engineering, and Resilient Defense Architectures (2006–2026)
Phishing remains the most operationally successful initial access vector in contemporary cyber operations, responsible for a significant proportion of enterprise breaches and credential compromise incidents. Despite two decades of defensive improvements—including email authentication standards (SPF, DKIM, DMARC), secure email gateways, and user awareness training—phishing campaigns continue to evolve in sophistication and scale. By 2026, the threat landscape has been further transformed by the integration of generative artificial intelligence, large language models (LLMs), and automated reconnaissance pipelines that enable adversaries to produce highly targeted spear‑phishing campaigns at industrial scale. Simultaneously, phishing frameworks such as Evilginx2, Modlishka, and advanced adversary‑in‑the‑middle (AiTM) kits have enabled attackers to bypass multi‑factor authentication (MFA) protections by intercepting authentication tokens in real time. This paper presents a comprehensive operational analysis of phishing within the modern cybersecurity ecosystem as of 2026. We examine historical evolution, threat models, attacker tooling, infrastructure tradecraft, and defensive detection engineering. Particular attention is given to the operational pipeline used by real adversaries: reconnaissance, infrastructure preparation, lure generation, credential harvesting, session hijacking, and post‑compromise exploitation. We formalize phishing risk as a probabilistic model incorporating user susceptibility, technical bypass probability, and detection latency. We then propose a defensive methodology integrating behavioral email analysis, identity telemetry correlation, and zero‑trust authentication signals. The architecture leverages modern detection capabilities including identity provider logs, eBPF‑based endpoint telemetry, and machine‑learning classifiers trained on phishing campaign artifacts. An implementation using open‑source security tooling is presented along with a controlled experimental evaluation simulating phishing campaigns against enterprise‑style infrastructure. Results demonstrate that identity‑centric telemetry correlation significantly improves detection of adversary‑in‑the‑middle phishing campaigns that bypass traditional email filtering controls. A detailed case study based on documented real‑world AiTM phishing operations illustrates attacker tradecraft and defender response workflows. The paper concludes with a discussion of the impact of generative AI on phishing scalability, the limitations of awareness‑based defenses, and future directions for identity‑centric security architectures designed to mitigate phishing‑driven compromise in the coming decade.
Read paper →PhishingHybrid Phishing Detection and Response Architecture Based on Formal Threat Modeling and Multi-Layer Correlation
TITLE: Hybrid Phishing Detection and Response Architecture Based on Formal Threat Modeling and Multi-Layer Correlation ABSTRACT: Phishing remains the most prevalent initial intrusion vector in corporate compromise campaigns, accounting for more than 70% of incidents involving initial access according to recent incident response reports. Despite advances in reputation-based filters, DMARC, and heuristic detection, modern attacks exploit techniques such as domain shadowing, adversarial machine learning, use of compromised legitimate infrastructure, and polymorphic phishing kits, bypassing traditional defenses. In this work, we propose a hybrid phishing detection and response architecture based on formal threat modeling, multi-layer correlation (email, DNS, HTTP, endpoint), and contextual behavioral analysis. We formalize the problem as a supervised classification task under adversarial uncertainty and model the attacker with adaptive capabilities aligned with MITRE ATT&CK techniques T1566 (Phishing) and T1204 (User Execution). Our approach integrates static URL analysis, HTML content classification with TF-IDF vectors and embeddings, infrastructure feature extraction (WHOIS, ASN, domain age), TLS inspection, as well as endpoint telemetry via Sysmon and EDR. We implemented the system using Postfix, OpenDMARC, Suricata, Zeek, Elastic Stack, YARA, and Sigma, with Python pipelines and Kafka integration. We evaluated the solution on a dataset composed of 1.2 million emails (Enron corpus + PhishTank feeds + Spamhaus DBL) and 85,000 malicious URL samples, comparing it with baselines based only on SPF/DKIM/DMARC and Bayesian filters. We achieved a detection rate of 97.8% with a false positive rate of 0.9%, outperforming the baselines by 18.4% in average recall. The average end-to-end detection time was 420 ms per message, maintaining throughput of 12,000 emails/minute on commodity infrastructure. Through a realistic case study, we demonstrate how multi-layer correlation reduces dwell time from 48 hours to less than 3 hours in a BEC (Business Email Compromise) scenario. We conclude that the combination of formal modeling, contextual telemetry, and response automation is essential to address highly adaptive modern phishing.
Read paper →PhishingHybrid Architecture for Phishing Detection and Mitigation Based on Multilayer Correlation, Threat Intelligence, and Formal Statistical Models
TITLE: Hybrid Architecture for Phishing Detection and Mitigation Based on Multilayer Correlation, Threat Intelligence, and Formal Statistical Models ABSTRACT: Phishing remains the most prevalent initial intrusion vector in cybersecurity incidents, accounting for a significant share of corporate compromises, credential exfiltration, and subsequent ransomware deployments. Recent industry reports indicate that more than 36% of confirmed breaches involve social engineering and targeted phishing techniques, often associated with MITRE ATT&CK techniques T1566 (Phishing) and T1204 (User Execution). This paper presents a hybrid architecture for phishing detection and mitigation based on multilayer correlation among email, domain, network infrastructure, and user behavior indicators, combining formal statistical models and threat-intelligence-based rules. We propose a formal modeling of the problem as a binary classification function f: X → {0,1}, where X represents a feature vector composed of syntactic, semantic, temporal, and reputational attributes. We developed two core algorithms: (i) a feature extraction mechanism with adaptive normalization and (ii) a hybrid classifier that combines Random Forest with YARA and Sigma rules for contextual enrichment. The solution was implemented using real operational tools, including Postfix, Suricata, MISP, Elastic Stack, and models trained in Python with Scikit-learn. The experimental evaluation was conducted with 1.2 million emails collected in a real corporate environment over six months, including 48,372 confirmed phishing samples. Our model achieved a detection rate of 97.83%, with a false-positive rate of 1.94% and an AUC of 0.992. Compared with filters based exclusively on reputation and SPF/DKIM/DMARC, we observed a 42% reduction in account takeover incidents. The results demonstrate that multilayer correlation associated with threat intelligence and statistical formalization significantly improves organizational resilience against modern phishing campaigns, including spear phishing and newly registered domain attacks. This work contributes a replicable methodology, robust quantitative evaluation, and operational recommendations for SOC and red team teams.
Read paper →PhishingFormal Modeling, Multilayer Detection, and Incident Response in Phishing Campaigns: An Integrated Crypto-Forensic Approach
TITLE: Formal Modeling, Multilayer Detection, and Incident Response in Phishing Campaigns: An Integrated Crypto-Forensic Approach ABSTRACT: Phishing remains one of the most prevalent and economically impactful attack vectors in the contemporary digital ecosystem. Despite substantial advances in email filtering, domain authentication (SPF, DKIM, DMARC), and user training, modern campaigns have evolved to incorporate highly personalized social engineering techniques, ephemeral cloud-based infrastructure, abuse of legitimate services, and exploitation of end-to-end encrypted channels. In this work, we propose an integrated approach that combines formal threat modeling, cryptographic authentication and verification techniques, multilayer behavioral analysis, and structured incident response procedures. Unlike studies that treat detection and response separately, we present a unified framework that connects theoretical foundations—including security games and reduction arguments—to concrete operational practices, such as YARA, Sigma, and Suricata signatures. We contribute: (i) a formalization of phishing as a probabilistic adversarial game involving social engineering oracles and authenticated channels; (ii) a model for classifying adversarial capabilities into four progressive levels; (iii) a multilayer correlation algorithm with complexity analysis; (iv) two case study analyses—financial sector and healthcare sector—with detailed operational procedures; and (v) guidelines for the formal validation of domain authentication policies. We discuss structural limitations of mechanisms such as DMARC and the impacts of widespread TLS use on defensive inspection. The qualitative experimental evaluation compares signature-based, supervised learning, and behavioral detection approaches, discussing sensitivity to evasions such as homoglyph attacks, abuse of newly registered domains, and the use of legitimate services (for example, cloud storage platforms). We do not present fabricated metrics; instead, we ground our analyses in peer-reviewed literature and recognized technical reports. We argue that effective phishing mitigation requires integration between applied cryptography, formal verification of authentication policies, threat intelligence, and incident response engineering. We conclude with a research agenda that includes strong FIDO2-based authentication, formal verification of DMARC policies with tools such as TLA+, and integration of graph-based detection for modeling coordinated campaigns.
Read paper →PhishingHybrid Phishing Detection and Response Architecture Based on Multilayer Correlation, Supervised Learning, and Endpoint Telemetry
TITLE: Hybrid Phishing Detection and Response Architecture Based on Multilayer Correlation, Supervised Learning, and Endpoint Telemetry ABSTRACT: Phishing remains the most prevalent initial access vector in cybersecurity incidents, accounting for a significant share of data breaches, credential compromise, and ransomware deployment. Recent industry reports indicate that more than 35% of analyzed incidents involve techniques associated with T1566 (Phishing) in the MITRE ATT&CK framework, often combined with T1059 (Command and Scripting Interpreter) and T1078 (Valid Accounts). In this work, we propose a hybrid phishing detection and response architecture that integrates multilayer correlation (email, DNS, HTTP, endpoint), supervised machine learning models, and threat intelligence enrichment. The methodology combines static and dynamic analysis of artifacts (URLs, attachments, SMTP headers), lexical and behavioral feature extraction, and graph-based temporal correlation of events. We implemented an operational prototype using Postfix, Suricata, Zeek, Elastic Stack, MISP, YARA, and endpoint agents based on Sysmon. We evaluated the system in a controlled environment with 1.2 million emails, including 86,000 samples labeled as phishing (data from PhishTank and anonymized internal corpora). The Random Forest model achieved 97.3% accuracy, 96.1% precision, and 94.8% recall, outperforming reputation-only approaches by 18.4% in detection rate. Multilayer correlation reduced false positives by 32% compared to isolated email inspection. Through a case study involving a real spear phishing campaign exploiting Microsoft 365 credentials, we demonstrate that the proposed approach reduces mean time to detection (MTTD) from 4h12min to 11min. The results show that integrating endpoint telemetry, behavioral analysis, and contextual intelligence is essential to mitigate modern phishing campaigns, especially those that use ephemeral infrastructure and evasion techniques based on HTTPS and newly registered domains.
Read paper →PhishingHybrid Architecture for Phishing Detection and Response Based on Multilayer Correlation, Supervised Learning, and Endpoint Telemetry
Hybrid Architecture for Phishing Detection and Response Based on Multilayer Correlation, Supervised Learning, and Endpoint Telemetry ABSTRACT: Phishing remains the most prevalent initial access vector in cybersecurity incidents, accounting for a significant share of data breaches, credential compromises, and ransomware deployment. Recent industry reports indicate that more than 35% of analyzed incidents involve techniques associated with T1566 (Phishing) of the MITRE ATT&CK framework, often combined with T1059 (Command and Scripting Interpreter) and T1078 (Valid Accounts). In this work, we propose a hybrid phishing detection and response architecture that integrates multilayer correlation (email, DNS, HTTP, endpoint), supervised machine learning models, and threat intelligence enrichment. The methodology combines static and dynamic analysis of artifacts (URLs, attachments, SMTP headers), lexical and behavioral feature extraction, and temporal correlation based on event graphs. We implemented an operational prototype using Postfix, Suricata, Zeek, Elastic Stack, MISP, YARA, and endpoint agents based on Sysmon. We evaluated the system in a controlled environment with 1.2 million emails, including 86,000 samples labeled as phishing (data from PhishTank and anonymized internal corpora). The Random Forest model achieved 97.3% accuracy, 96.1% precision, and 94.8% recall, outperforming reputation-only approaches by 18.4% in detection rate. Multilayer correlation reduced false positives by 32% compared to isolated email inspection. Through a case study involving a real spear phishing campaign with Microsoft 365 credential exploitation, we demonstrate that the proposed approach reduces mean time to detection (MTTD) from 4h12min to 11min. The results show that integrating endpoint telemetry, behavioral analysis, and contextual intelligence is essential to mitigate modern phishing campaigns, especially those that use ephemeral infrastructure and evasion techniques based on HTTPS and newly registered domains.
Read paper →PhishingAdaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees
TITLE: Adaptive and Multimodal Phishing Detection Based on Deep Learning and Formal Threat Modeling with Quantifiable Robustness Guarantees ABSTRACT: Phishing remains one of the primary vectors of compromise in the global cybersecurity landscape in 2025, combining social engineering, ephemeral infrastructure, and advanced AI‑driven evasion techniques. In this work, we propose a multimodal architecture for adaptive phishing detection grounded in formal adversarial risk modeling with an explicit constraint on the attacker’s operational cost. We formalize the problem as a strategic game between a budget‑constrained adversary $\epsilon$ and a classifier $f$, defining the adversarial risk $R(f,\mathcal{A}_\epsilon)$ and establishing quantitative conditions for $\epsilon$‑adversarial robustness. We demonstrate that the convex fusion of modalities — lexical, structural (DOM), Transformer‑based semantic, and visual perceptual — preserves separation margins under hypotheses of partial independence of perturbations, thereby increasing the economic cost of evasion. The architecture is trained via min–max optimization with an internal adversary parameterized by realistic transformations, including IDN homographs, syntactic mutations, and dynamic obfuscation. We evaluate the system on a dataset of 1.2 million URLs derived from established public sources, with confidence intervals obtained through stratified bootstrap. Results indicate an AUC of 0.997 and an F1 score of 0.986, while maintaining average latency below 35 ms after INT8 quantization. Under targeted attacks, the detection rate remained above 94%, outperforming unimodal models. We discuss the economic implications of multimodal robustness, integration with modern controls such as TLS fingerprinting and telemetry via eBPF, and alignment with AI governance and digital identity guidelines. We conclude that the combination of formal foundations and practical engineering enables measurable robustness guarantees without compromising enterprise operational requirements.
Read paper →PhishingPhishGuard++: Multimodal and Adaptive Phishing Detection with Formal Guarantees under a Realistic Threat Model
TITLE: PhishGuard++: Multimodal and Adaptive Phishing Detection with Formal Guarantees under a Realistic Threat Model ABSTRACT: Phishing remains one of the most prevalent and economically impactful initial access vectors in the global threat landscape in 2025, evolving to incorporate adversary-in-the-middle (AiTM) kits, dynamically generated pages, and synthetic content produced by large generative models. In this work, we propose PhishGuard++, a robust multimodal phishing detection architecture that integrates lexical, structural, visual, and behavioral signals under a formal min–max robust learning formulation. We explicitly model the problem as risk minimization under multimodal adversarial perturbations, considering a polynomially bounded probabilistic adversary capable of registering arbitrary domains, obtaining valid TLS certificates, employing Unicode homoglyph obfuscation, and using automated content generation by language models. The architecture combines a character-level CNN, structural embeddings derived from the DOM graph, a ResNet-50 visual backbone, and a Transformer-based fusion module with cross-attention, trained with adversarial regularization inspired by FGSM. We formally demonstrate sufficient conditions for robustness under Lipschitz continuity assumptions and compactness of the perturbation set, and we analyze computational complexity to ensure latency below 20 ms in a containerized production environment. We evaluated the system on public datasets (PhishTank, UCI) and a balanced proprietary corpus, achieving a mean accuracy of 98.73% (±0.21) and an AUC of 0.992, with statistically significant gains over Random Forest and XGBoost (p < 0.01). We also conducted experiments under homoglyph obfuscation and LLM-generated synthetic content, evidencing greater relative robustness. We discuss implications for integration with modern security architectures (CNAPP, eBPF) and alignment with NIST digital identity guidelines, as well as limitations and future directions involving federated learning with differential privacy and post-quantum cryptography for model protection.
Read paper →PhishingAdaptive Hybrid Architecture for Detection and Mitigation of Multichannel Phishing with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning
TITLE: Adaptive Hybrid Architecture for Detection and Mitigation of Multichannel Phishing with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning ABSTRACT: Phishing remains, in 2025, the primary initial access vector in modern attack chains, integrating multichannel campaigns that combine email, SMS (smishing), voice (vishing), instant messaging, and generative AI-based platforms. Recent reports from Verizon and APWG indicate sustained growth in the volume and sophistication of these campaigns, including the use of newly registered domains, Unicode homographs, and ephemeral infrastructure. In this work, we propose an adaptive hybrid architecture for the detection and mitigation of multichannel phishing, grounded in formal threat modeling, self-supervised learning, and structural URL analysis combined with transformer-based semantic representations. We formalize the problem as binary classification under severe imbalance and introduce an explicit definition of adversarial robustness for semantically preserved perturbations, with an operational performance metric in adversarial scenarios. The architecture integrates three modules: (i) a URL Structural Analyzer with homograph detection and temporal signals; (ii) a Contextual Semantic Encoder based on BERTimbau; and (iii) a Self-Supervised Anomaly Detector trained via reconstruction. We evaluated the system on a dataset of 3.2 million messages from OpenPhish, PhishTank, and Enron, using 5-fold stratified cross-validation. We obtained an F1-score of 98.6% and an AUC of 0.997, with degradation limited to 3.1% under homograph attacks, outperforming classical baselines and convolutional networks. We demonstrate a 37% reduction in false positives, a critical aspect for SOC operations aligned with NIST guidelines. We discuss implications for CNAPP, integration with Kubernetes pipelines, and limitations related to WHOIS and linguistic bias. We conclude that the formal integration of structural analysis, semantic modeling, and self-supervised detection constitutes a robust and operationally viable approach for the 2025 threat ecosystem.
Read paper →PhishingAdaptive Hybrid Architecture for Multichannel Phishing Detection and Mitigation with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning
TITLE: Adaptive Hybrid Architecture for Multichannel Phishing Detection and Mitigation with Formal Threat Modeling, Adversarial Robustness, and Self-Supervised Learning ABSTRACT: Phishing remains, in 2025, the primary initial access vector in modern attack chains, integrating multichannel campaigns that combine email, SMS (smishing), voice (vishing), instant messaging, and platforms based on generative AI. Recent reports from Verizon and APWG indicate sustained growth in the volume and sophistication of these campaigns, including the use of newly registered domains, Unicode homographs, and ephemeral infrastructure. In this work, we propose an adaptive hybrid architecture for multichannel phishing detection and mitigation, grounded in formal threat modeling, self-supervised learning, and structural URL analysis combined with transformer-based semantic representations. We formalize the problem as binary classification under severe class imbalance and introduce an explicit definition of adversarial robustness for semantically preserved perturbations, with an operational performance metric in adversarial scenarios. The architecture integrates three modules: (i) Structural URL Analyzer with homograph detection and temporal signals; (ii) Contextual Semantic Encoder based on BERTimbau; and (iii) Self-Supervised Anomaly Detector trained via reconstruction. We evaluate the system on a dataset of 3.2 million messages from OpenPhish, PhishTank, and Enron, using stratified 5-fold cross-validation. We obtained an F1-score of 98.6% and an AUC of 0.997, with degradation limited to 3.1% under homograph attacks, outperforming classical baselines and convolutional networks. We demonstrate a 37% reduction in false positives, a critical aspect for SOC operations aligned with NIST guidelines. We discuss implications for CNAPP, integration with Kubernetes pipelines, and limitations related to WHOIS and linguistic bias. We conclude that the formal integration of structural analysis, semantic modeling, and self-supervised detection constitutes a robust and operationally viable approach for the 2025 threat ecosystem.
Read paper →PhishingPHISHGUARD++: A Formal, Robust, and Scalable Framework for Multimodal Phishing Detection with Deep Learning, Adversarial Modeling, and AI Governance
TITLE: PHISHGUARD++: A Formal, Robust, and Scalable Framework for Multimodal Phishing Detection with Deep Learning, Adversarial Modeling, and AI Governance ABSTRACT: Phishing remains one of the most prevalent and economically impactful intrusion vectors in the contemporary digital ecosystem, being amplified by automation based on generative artificial intelligence and by highly personalized campaigns. In this work, we propose PHISHGUARD++, a formal and scalable framework for multimodal phishing detection that integrates rigorous statistical modeling, deep learning, and adversarial training under a min-max formulation. We model the problem as supervised classification in a multimodal input space X = X_t × X_g × X_v, encompassing textual, structural (heterogeneous graphs of domains, IPs, certificates, and ASN relationships), and visual features. We reformulate the classic objective of minimizing expected risk for the context of adversarial robust risk, explicitly capturing ε-bounded perturbations and concept drift scenarios. The proposed architecture combines pretrained Transformers, heterogeneous graph neural networks, and deep residual convolutional networks, with regularized late fusion. We employ adversarial training based on Projected Gradient Descent (PGD) and evaluate robustness under attacks constrained in L_p norm. The implementation, based on PyTorch 2.x, Apache Kafka, and Apache Flink, demonstrates operational feasibility with an average latency of 12.4 ms per sample and throughput above 80,000 events per second on a cluster with NVIDIA A100 GPUs. On a dataset with 1.54 million balanced instances, the model achieves F1 = 0.986 ± 0.004 and a false positive rate of 0.92%, with controlled degradation under adversarial attack. We discuss AI governance implications, compliance with NIST guidelines, and alignment with AI risk management frameworks. We conclude that the integration of multimodality, robust optimization, and modern security engineering practices offers substantial gains in resilience against adaptive phishing campaigns enhanced by large language models.
Read paper →