CoGReV is a hybrid framework that enhances machine‑learning phishing classifiers with a post‑hoc, non‑monotonic reasoning layer written in Answer Set Programming. It uses a confidence‑gated defeasible rule to revise low‑confidence phishing predictions toward legitimate only when website metadata is available, thereby allocating uncertain decisions to the reasoning layer while leaving confident ones to the classifier. The gated rule reduces false positives by 0.27 % of decisions and maintains recall within 0.7 % of the baseline, operating in linear time.
arXiv:2607. 28460v1 Announce Type: new Abstract: A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day.
A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models (LLMs) to emit a triage label directly, but does not train them to reason about whether a detection is a genuine threat.
arXiv:2606. 21690v2 Announce Type: replace-cross Abstract: Phishing is a multi-modal threat.
A novel phishing URL detection system is introduced that employs a first-order Takagi-Sugeno-Kang (TSK) fuzzy inference model optimized via gradient-based techniques, specifically using the Adam optimizer. The framework combines fuzzy logic’s interpretability with gradient optimization’s precision, achieving an average accuracy of 99.95% and a perfect AUC of 1.00 across 5 cross-validation folds on a dataset of over 235,000 URLs. The optimized fuzzy rules and membership functions provide clear decision pathways, enhancing transparency for cybersecurity applications.
arXiv:2507.15393v2 Announce Type: replace-cross Abstract: Phishing email is a critical step in the cybercrime kill chain due to the high reachability of victims' email accounts and the low cost of la...
arXiv:2607. 18429v1 Announce Type: cross Abstract: Phishing emails remain one of the most persistent cybersecurity threats, and machine-learning classifiers are widely used to detect them.
arXiv:2511. 12085v3 Announce Type: replace-cross Abstract: Phishing and related cyber threats are becoming increasingly sophisticated, with email-based phishing remaining the most persistent attack vector.
The paper introduces the Latent Diagnostic Taxonomy, a framework that builds a dimensionality‑optimized classifier and a diagnostic tool to assess the trustworthiness of its confident predictions. It identifies a small set of influential prompts (latent support vectors) that reveal tokens which can change the classifier’s output, and uses these tokens to create a taxonomy that classifies prompts into safe, heuristic bias, heuristic override, or insufficient context categories. Applied to a prompt‑injection detection model, the framework shows that about 77% of confident decisions are fragile to a single token, distinguishing between calibration failures and exploitable shortcuts, and offers remediation strategies for each taxonomy zone.
The paper evaluates TypeSafe AI’s Jev safety judge against GPT and GLM judges and local classifiers using a controlled adversarial test harness. Jev shows strong robustness on rule‑based tasks like input moderation, with minimal bypasses, but performs less well on judgment‑based tasks such as phishing detection, where it misses a higher proportion of phishing emails and is more prone to false positives. The study highlights Jev’s speed advantage and varying resilience depending on task type.
This paper proposes a framework for constructing a classifier as a safeguard layer, and for developing a complementary diagnostic that identifies which of the classifier's confident decisions can be t...
arXiv:2512. 10104v2 Announce Type: cross Abstract: Email phishing is one of the most prevalent and globally consequential vectors of cyber intrusion.
arXiv:2606. 00889v1 Announce Type: cross Abstract: Phishing attacks remain a major cybersecurity threat, exploiting deceptive URLs to steal sensitive user information.