CyberHull: Deterministic Malicious URL Isolation via Convex Hull

Avijit Gayen; Aniket Ghosal; Durba Chakraborty; Sayan Mondal; Md Abdul Aziz Al Aman; Angshuman Jana

cs.CROct 20, 2026

CyberHull: Deterministic Malicious URL Isolation via Convex Hull

Authors: Avijit Gayen, Aniket Ghosal, Durba Chakraborty, Sayan Mondal, Md Abdul Aziz Al Aman, Angshuman Jana

Abstract

The emergence of increasingly sophisticated and evasion-resistant phishing attack strategies represents a significant threat to modern cybersecurity, particularly in cyber-physical systems and internet-based networks. Traditional probabilistic methods and certain machine learning approaches often struggle to detect novel attacks and may lack interpretability or portability. To address these challenges, we introduce CyberHull, a resource-efficient and deterministic framework for identifying malicious URLs through mathematically defined convex hull boundaries across multiple orthogonal feature domains, including structural content entropy, hyperlink graph topology, and semantic token distribution. CyberHull constructs compact convex hulls, referred to as vaults, using the QuickHull algorithm, with a training complexity of O(n log n) under suitable assumptions. URL classification is performed through point-in-polyhedron tests that impose relatively low computational overhead on standard CPUs. Experimental results demonstrate that CyberHull achieves 92 percent detection accuracy, substantially outperforming a baseline linear approach based on Principal Component Analysis (PCA), which achieves 32 percent accuracy. Furthermore, CyberHull offers a computationally efficient alternative to resource-intensive deep learning approaches for malicious URL detection.

Figures & tables

Requirement	Statistical	DL	$\mathbb{C}$ yber $\mathbb{H}$ ull
Previously Unseen Detection	$\times$	$\checkmark$	$\checkmark$
Explainability	$\checkmark$	$\times$	$\checkmark$
Edge Efficiency	$\checkmark$	$\times$	$\checkmark$
Autonomous Scaling	$\times$	$\checkmark$	$\checkmark$

Table 1: Technological Capability Matrix

Panel of Figure 1 — Figure 1: Structural organization and thematic flow of the remainder of the paper.

Panel of Figure 2 — Figure 2: Dual-Phase CyberHull System Architecture: The framework is divided into an offline geometric boundary generation phase (Phase I) and a lightweight, real-time edge-inference phase utilizing Point-in-Polyhedron testing (Phase II).

Panel of Figure 3 — Figure 3: Ranking the 46 selected geometric vaults by absolute feature-pair separability score. The definitions of all vault feature pairs (V1–V46) are provided in Appendix A .

Figure 4: 2D spatial mapping and Explicit Safe Zone Perimeters across the top-performing Vaults. The MACRO view demonstrates the global isolation of previously unseen anomalies, while the MICRO view confirms the strict geometric boundaries of the trusted core.

Figure 5: Macro and Micro views of the 3D Tri-Space Perimeter. The genuine data points naturally form a mathematically bounded dense core (blue), easily distinguished from the scattered adversarial payloads (red).

Initial Feature Space Analytics
Category	Metric
Total Features Extracted	91
Total Attacks Evaluated	1,470
Probabilistic Pruning & Selection
Candidate Feature Pairs Evaluated	4,095
Pairs Exceeding Separability	46

Table 2: Summary of Feature Space and Vault Generation

Model	Accuracy	Precision	Recall	F1-Score	FPR
PCA	32.0%	0.28	0.31	0.29	0.41
SVM	81.0%	0.79	0.76	0.77	0.14
Random Forest	88.0%	0.86	0.84	0.85	0.09
XGBoost	90.0%	0.89	0.87	0.88	0.07
$\mathbb{C}$ yber $\mathbb{H}$ ull	92.0%	0.93	0.91	0.92	0.03

Table 3: Comparative Performance Evaluation Across Classical, Ensemble, and Geometric Detection Frameworks

Panel of Figure 6 — Figure 6: Results Dashboard for Dynamic Multi-Vault using Dual Stem and Area Under Curve Visualization. The dashboard highlights 92.0% of the global AI accuracy while cutting down clutter. True positives are shown in Indigo, whereas false positives are in Amber. Both are shown in pairs in order to have a comparative analysis across the top 12 vaults in terms of priority. The overall efficiency of the system is represented by Rose Red curve.

Panel of Figure 7 — Figure 7: Topographical Description of the Top 3 Interception Vaults. The following 3-Dimensional scatter plots demonstrate the mathematics of the dynamic safe space (Light Blue Polygons) that has been created based on legitimate traffic (Blue Dots). In contrast, malicious packets (Red Crosses) are not capable of emulating the randomness of authentic traffic due to their extreme entropy distortion (Left), topological vacuity (Center), or semantic imbalance (Right).

Model	Avg Inference Latency	Memory Usage	CPU Utilization
Support Vector Machine (SVM)	14.8 ms	182 MB	41%
Random Forest (RF)	11.2 ms	244 MB	53%
XGBoost	9.6 ms	318 MB	61%
Proposed $\mathbb{C}$ yber $\mathbb{H}$ ull Framework	0.84 ms	38 MB	9%

Table 4: Computational Benchmarking of Edge Deployment Feasibility

Phishing Detection

See all 20 papers

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features
May 30, 2026Uche Unoke Emmanuel, Gideon Francis OghieMultilayer Perceptrons Phishing Detection
Department of Cyber Security Science, School of Information and Communication Technology, Federal University of Technology, Minna, Nigeria
Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection
Mar 2, 2026Tailai Song, Pedro Casas, Michela MeoPhishing Detection Graph Neural Networks
Politecnico di Torino Turin, Italy · AIT Austrian Institute of Technology Vienna, Austria
A Computer Vision Approach to Visual Fraud Detection in Phishing Websites Using YOLOv8
Sep 27, 2026Basil Sajid ShaikhPhishing Detection
Independent Researcher Seattle, WA, USA

May 30, 2026J/K move · Enter open · S save

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features

Uche Unoke Emmanuel, Gideon Francis Oghie

Department of Cyber Security Science, School of Information and Communication Technology, Federal University of Technology, Minna, Nigeria

Multilayer Perceptrons Phishing Detection

Open paper AskPDF arXiv

Phishing attacks remain a major cybersecurity threat, exploiting deceptive URLs to steal sensitive user information. Traditional blacklist and rule-based detection approaches are reactive and often fail to identify newly emerging phishing URLs. This paper proposes a lightweight hybrid framework for real-time phishing URL detection that combines blacklist-based screening with a Multi-Layer Perceptron (MLP) classifier operating solely on structural URL features. The framework extracts 16 URL-derived features capturing structural, domain-based, and security-related characteristics without requiring webpage content access, third-party APIs, or visual rendering, making it computationally efficient for real-time deployment. The system was trained and evaluated on the PhiUSIIL phishing dataset containing 235,795 labelled URLs. Experimental results show that the proposed MLP achieved 99.24% accuracy, 98.74% precision, 99.95% recall, 99.34% F1-score, and 99.65% ROC-AUC, outperforming Random Forest, Logistic Regression, XGBoost, LightGBM, and CatBoost under the same evaluation setting. The hybrid architecture achieved an average inference latency of 1.2 ms per URL and a peak throughput of 4,200 URLs per second under concurrent processing. A functional desktop application prototype, CyberGuard, further demonstrates deployment viability. The results indicate that the proposed framework provides an accurate and computationally efficient solution for real-time phishing URL detection in resource-constrained environments.

Abstract

Phishing Detection

Explore similar work

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features

Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection

A Computer Vision Approach to Visual Fraud Detection in Phishing Websites Using YOLOv8