{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T16:24:27Z","timestamp":1790699067273,"version":"4.1.0"},"reference-count":52,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,8,11]],"date-time":"2026-08-11T00:00:00Z","timestamp":1786406400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:p>Modern phishing pages are challenging to detect because they can appear like legitimate brand sites using dynamic document object model (DOM) structures, misleading visual displays, and changing hyperlinks. Most conventional blacklists and URL-based methods do not capture the relationships at multiple levels of the web page structure. In this paper, we introduce a new graph-based phishing detection method to represent a web page with a Multi-Level Web Page Graph (MLWPG). MLWPGs incorporate DOM hierarchies, rendered visual blocks, and hyperlink relations into one heterogeneous graph. We use a novel Deep Learning Method called DHGAN that has Type-Aware Attention and Dynamic Convolution to learn how to differentiate discriminative interaction amongst structural, spatial, and navigation elements. APDA will be used in feature space to enhance robustness to evasive phishing versions. Using a balanced data set of 50,000 web pages, our complete pipeline showed a 97.0% accuracy, 96.8% F1-Score, 3.0% False Positive Rate, and 95.5% Robustness to Adversaries. The proposed MLWPG-DHGAN-APDA framework outperformed all baseline models. Our experimental results demonstrate that multi-level graph models provide improvements to both detection accuracy and reliability of operation for real-time phishing defenses.<\/jats:p>","DOI":"10.3389\/frai.2026.1880282","type":"journal-article","created":{"date-parts":[[2026,8,11]],"date-time":"2026-08-11T05:34:35Z","timestamp":1786426475000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Improved graph-based model for phishing website detection using multi-level web page graphs and dynamic heterogeneous graph attention network"],"prefix":"10.3389","volume":"9","author":[{"given":"S.","family":"Kavya","sequence":"first","affiliation":[{"name":"School of Computer Science Engineering and Information Systems, Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"D.","family":"Sumathi","sequence":"additional","affiliation":[{"name":"School of Computer Science Engineering and Information Systems, Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,8,11]]},"reference":[{"key":"ref1","doi-asserted-by":"publisher","first-page":"42459","DOI":"10.1109\/ACCESS.2022.3168235","article-title":"PDGAN: phishing detection with generative adversarial networks","volume":"10","author":"Al-Ahmadi","year":"2022","journal-title":"IEEE Access"},{"key":"ref2","doi-asserted-by":"publisher","first-page":"1687867","DOI":"10.3389\/fcomp.2025.1687867","article-title":"Identifying key features for phishing website detection through feature selection techniques","volume":"7","author":"Alazaidah","year":"2026","journal-title":"Front. Comput. Sci."},{"key":"ref3","doi-asserted-by":"publisher","first-page":"10654","DOI":"10.1109\/ACCESS.2023.3241121","article-title":"A URL-based social semantic attacks detection with character-aware language model","volume":"11","author":"Almousa","year":"2023","journal-title":"IEEE Access"},{"key":"ref4","doi-asserted-by":"publisher","first-page":"350","DOI":"10.3390\/electronics15020350","article-title":"Hybridizing explainable AI (XAI) for intelligent feature extraction in phishing website detection","volume":"15","author":"Alsakarnah","year":"2026","journal-title":"Electronics"},{"key":"ref5","doi-asserted-by":"publisher","first-page":"3753","DOI":"10.1109\/TDSC.2022.3210029","article-title":"Mitigating adversarial gray-box attacks against phishing detectors","volume":"20","author":"Apruzzese","year":"2023","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"ref6","doi-asserted-by":"publisher","first-page":"82355","DOI":"10.1109\/ACCESS.2022.3196018","article-title":"Combining long-term recurrent convolutional and graph convolutional networks to detect phishing sites using URL and HTML","volume":"10","author":"Ariyadasa","year":"2022","journal-title":"IEEE Access"},{"key":"ref7","doi-asserted-by":"publisher","first-page":"6421","DOI":"10.1109\/ACCESS.2023.3237798","article-title":"A survey of intelligent detection designs of HTML URL phishing attacks","volume":"11","author":"Asiri","year":"2023","journal-title":"IEEE Access"},{"key":"ref8","doi-asserted-by":"publisher","first-page":"1200","DOI":"10.1109\/TDSC.2022.3151103","article-title":"Sixteen years of phishing user studies: what have we learned?","volume":"20","author":"Baki","year":"2023","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"ref9","first-page":"428","author":"Bilot","year":"2022"},{"key":"ref10","doi-asserted-by":"publisher","first-page":"115105","DOI":"10.1016\/j.knosys.2025.115105","article-title":"Enhanced phishing detection using multimodal data","volume":"334","author":"Bustio-Mart\u00ednez","year":"2026","journal-title":"Knowl. Based Syst."},{"key":"ref11","doi-asserted-by":"publisher","first-page":"40779","DOI":"10.1109\/ACCESS.2023.3268027","article-title":"PhikitA: phishing kit attacks dataset for phishing websites identification","volume":"11","author":"Casta\u00f1o","year":"2023","journal-title":"IEEE Access"},{"key":"ref12","doi-asserted-by":"publisher","first-page":"790","DOI":"10.1109\/TDSC.2021.3119323","article-title":"An explainable multi-modal hierarchical attention model for developing phishing threat intelligence","volume":"19","author":"Chai","year":"2022","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"ref13","doi-asserted-by":"publisher","first-page":"1762","DOI":"10.1109\/TDSC.2019.2937783","article-title":"PPSB: an open and flexible platform for privacy-preserving safe browsing","volume":"18","author":"Cui","year":"2021","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"ref14","doi-asserted-by":"publisher","first-page":"46","DOI":"10.1109\/LNET.2023.3347724","article-title":"A network model to study the underlying characteristics of phishing sites","volume":"6","author":"Gayen","year":"2024","journal-title":"IEEE Netw. Lett."},{"key":"ref15","doi-asserted-by":"publisher","first-page":"48","DOI":"10.3390\/jcp6020048","article-title":"Small language models for phishing website detection: cost, performance, and privacy trade-offs","volume":"6","author":"Goldenits","year":"2026","journal-title":"J. Cybersecurity Privacy"},{"key":"ref16","doi-asserted-by":"publisher","first-page":"2236","DOI":"10.1109\/JIOT.2023.3292171","article-title":"A method for detecting phishing websites based on tiny-Bert stacking","volume":"11","author":"He","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref17","doi-asserted-by":"publisher","first-page":"347","DOI":"10.23919\/JCN.2022.000009","article-title":"Use chains to block DNS attacks: a trusty blockchain-based domain name system","volume":"24","author":"Hsieh","year":"2022","journal-title":"J. Commun. Netw."},{"key":"ref18","doi-asserted-by":"publisher","first-page":"46","DOI":"10.3390\/computation14020046","article-title":"Phishing email detection using BERT and RoBERTa","volume":"14","author":"Ibrahim","year":"2026","journal-title":"Computation"},{"key":"ref19","doi-asserted-by":"publisher","first-page":"640","DOI":"10.3390\/app16020640","article-title":"Phishing website impersonation: comparative analysis of detection and target recognition methods","volume":"16","author":"Jarczewski","year":"2026","journal-title":"Appl. Sci."},{"key":"ref20","doi-asserted-by":"publisher","first-page":"1406","DOI":"10.1109\/TDSC.2023.3277613","article-title":"Detecting malicious websites from the perspective of system provenance analysis","volume":"21","author":"Jiang","year":"2024","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"ref21","doi-asserted-by":"publisher","first-page":"326","DOI":"10.23919\/ICN.2023.0027","article-title":"A systematic review: detecting phishing websites using data mining models","volume":"4","author":"Jibat","year":"2023","journal-title":"Intell. Converg. Networks"},{"key":"ref22","doi-asserted-by":"publisher","first-page":"543","DOI":"10.13052\/jwe1540-9589.2237","article-title":"Improving phishing website detection using a hybrid two-level framework for feature selection and XGBoost tuning","volume":"22","author":"Jovanovic","year":"2023","journal-title":"J. Web Eng."},{"key":"ref23","doi-asserted-by":"publisher","first-page":"79543","DOI":"10.1109\/ACCESS.2022.3194672","article-title":"Multilayer stacked ensemble learning model to detect phishing websites","volume":"10","author":"Kalabarige","year":"2022","journal-title":"IEEE Access"},{"key":"ref24","doi-asserted-by":"publisher","first-page":"71180","DOI":"10.1109\/ACCESS.2023.3293649","article-title":"A boosting-based hybrid feature selection and multi-layer stacked ensemble learning model to detect phishing websites","volume":"11","author":"Kalabarige","year":"2023","journal-title":"IEEE Access"},{"key":"ref25","doi-asserted-by":"publisher","first-page":"124420","DOI":"10.1109\/ACCESS.2022.3223111","article-title":"Characteristics of understanding URLs and domain names features: the detection of phishing websites with machine learning methods","volume":"10","author":"Kara","year":"2022","journal-title":"IEEE Access"},{"key":"ref26","doi-asserted-by":"publisher","first-page":"36805","DOI":"10.1109\/ACCESS.2023.3252366","article-title":"Phishing detection system through hybrid machine learning based on URL","volume":"11","author":"Karim","year":"2023","journal-title":"IEEE Access"},{"key":"ref27","doi-asserted-by":"publisher","first-page":"476","DOI":"10.14569\/IJACSA.2026.0170476","article-title":"Adaptive phishing website detection using incremental machine learning: a dynamic approach to cybersecurity threats","volume":"17","author":"Kulaglic","year":"2026","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref28","doi-asserted-by":"publisher","first-page":"141610","DOI":"10.1109\/ACCESS.2023.3343411","article-title":"An empirical analysis of incorrect account remediation in the case of broken authentication","volume":"11","author":"Lee","year":"2023","journal-title":"IEEE Access"},{"key":"ref29","doi-asserted-by":"publisher","first-page":"80866","DOI":"10.1109\/ACCESS.2021.3084897","article-title":"Classification of attack types and analysis of attack methods for profiling phishing mail attack groups","volume":"9","author":"Lee","year":"2021","journal-title":"IEEE Access"},{"key":"ref30","doi-asserted-by":"publisher","first-page":"71925","DOI":"10.1109\/ACCESS.2023.3293063","article-title":"Uncovering the cloak: a systematic review of techniques used to conceal phishing websites","volume":"11","author":"Li","year":"2023","journal-title":"IEEE Access"},{"key":"ref31","doi-asserted-by":"publisher","first-page":"210","DOI":"10.1109\/JPROC.2024.3379855","article-title":"Internet-based social engineering psychology, attacks, and defenses: a survey","volume":"112","author":"Longtchi","year":"2024","journal-title":"Proc. IEEE"},{"key":"ref32","doi-asserted-by":"publisher","first-page":"3184","DOI":"10.1109\/TNSM.2021.3065422","article-title":"Adoption of email anti-spoofing schemes: a large scale analysis","volume":"18","author":"Maroofi","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref33","doi-asserted-by":"publisher","first-page":"50578","DOI":"10.1109\/ACCESS.2024.3384840","article-title":"An efficient hybrid feature selection technique toward prediction of suspicious URLs in IoT environment","volume":"12","author":"Mohanty","year":"2024","journal-title":"IEEE Access"},{"key":"ref34","doi-asserted-by":"publisher","first-page":"245","DOI":"10.1109\/TSUSC.2018.2808430","article-title":"Generalized outlier gaussian mixture technique based on automated association features for simulating and detecting web application attacks","volume":"6","author":"Moustafa","year":"2021","journal-title":"IEEE Trans. Sustain. Comput."},{"key":"ref35","doi-asserted-by":"publisher","first-page":"85561","DOI":"10.1109\/ACCESS.2023.3293062","article-title":"Digital risk assessment framework for individuals: analysis and recommendations","volume":"11","author":"Muammar","year":"2023","journal-title":"IEEE Access"},{"key":"ref36","first-page":"2483","author":"Otieno","year":"2023"},{"key":"ref37","doi-asserted-by":"publisher","first-page":"952","DOI":"10.1109\/TrustCom53373.2021.00133","article-title":"Phishing web page detection with HTML-level graph neural network","author":"Ouyang","year":"2021","journal-title":"Proc. IEEE TrustCom"},{"key":"ref38","doi-asserted-by":"publisher","first-page":"19375","DOI":"10.1109\/ACCESS.2023.3342840","article-title":"Evasion attacks and defense mechanisms for machine learning-based web phishing classifiers","volume":"12","author":"Pillai","year":"2024","journal-title":"IEEE Access"},{"key":"ref39","doi-asserted-by":"publisher","first-page":"3591","DOI":"10.1109\/TCC.2023.3300083","article-title":"A novel web attack detection mechanism using maximal-munch with torrent deep network","volume":"11","author":"Pillai","year":"2023","journal-title":"IEEE Trans. Cloud Comput."},{"key":"ref40","doi-asserted-by":"publisher","first-page":"11633","DOI":"10.1109\/ACCESS.2021.3051374","article-title":"Knowledge-based approach to detect potentially risky websites","volume":"9","author":"Prieto","year":"2021","journal-title":"IEEE Access"},{"key":"ref41","doi-asserted-by":"publisher","first-page":"1497","DOI":"10.1109\/TIFS.2022.3164212","article-title":"PhishSim: aiding phishing website detection with a feature-free tool","volume":"17","author":"Purwanto","year":"2022","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref42","doi-asserted-by":"publisher","first-page":"92523","DOI":"10.1109\/ACCESS.2023.3291811","article-title":"QsecR: secure QR code scanner according to a novel malicious URL detection framework","volume":"11","author":"Rafsanjani","year":"2023","journal-title":"IEEE Access"},{"key":"ref43","doi-asserted-by":"publisher","first-page":"42949","DOI":"10.1109\/ACCESS.2022.3168681","article-title":"Phishing URL detection: a real-case scenario through login URLs","volume":"10","author":"S\u00e1nchez-Paniagua","year":"2022","journal-title":"IEEE Access"},{"key":"ref44","doi-asserted-by":"publisher","first-page":"2411","DOI":"10.1109\/TSC.2023.3234806","article-title":"Adversarial autoencoder data synthesis for enhancing machine learning-based phishing detection algorithms","volume":"16","author":"Shirazi","year":"2023","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref45","doi-asserted-by":"publisher","first-page":"1509","DOI":"10.1109\/ACCESS.2021.3137636","article-title":"A deep learning-based framework for phishing website detection","volume":"10","author":"Tang","year":"2022","journal-title":"IEEE Access"},{"key":"ref46","doi-asserted-by":"publisher","first-page":"11","DOI":"10.3390\/make8010011","article-title":"A multimodal phishing website detection system using explainable artificial intelligence technologies","volume":"8","author":"Vulfin","year":"2026","journal-title":"Mach. Learn. Knowl. Extr."},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-026-07207-z","article-title":"Advancing semi-supervised phishing website detection in noisy conditions via optimal transport","author":"Wang","year":"2026","journal-title":"Appl. Intell."},{"key":"ref48","doi-asserted-by":"publisher","first-page":"124103","DOI":"10.1109\/ACCESS.2022.3224781","article-title":"Sufficiency of ensemble machine learning methods for phishing websites detection","volume":"10","author":"Wei","year":"2022","journal-title":"IEEE Access"},{"key":"ref49","doi-asserted-by":"publisher","first-page":"1156","DOI":"10.1109\/TSMC.2020.3016821","article-title":"Who are the phishers? Phishing scam detection on Ethereum via network embedding","volume":"52","author":"Wu","year":"2022","journal-title":"IEEE Trans Syst Man Cybern Syst"},{"key":"ref50","doi-asserted-by":"publisher","first-page":"4461","DOI":"10.1109\/TNSM.2022.3162885","article-title":"MOE\/RF: a novel phishing detection model based on revised multiobjective evolution optimization algorithm and random forest","volume":"19","author":"Zhu","year":"2022","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref51","doi-asserted-by":"publisher","first-page":"18499","DOI":"10.1109\/ACCESS.2023.3247135","article-title":"Phishing or not phishing? A survey on the detection of phishing websites","volume":"11","author":"Zieni","year":"2023","journal-title":"IEEE Access"},{"key":"ref52","doi-asserted-by":"publisher","first-page":"757","DOI":"10.13052\/jwe1540-9589.2251","article-title":"HCNN-LSTM: hybrid convolutional neural network with long short-term memory integrated for legitimate web prediction","volume":"22","author":"Zonyfar","year":"2023","journal-title":"J. Web Eng."}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1880282\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,11]],"date-time":"2026-08-11T05:34:36Z","timestamp":1786426476000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1880282\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,11]]},"references-count":52,"alternative-id":["10.3389\/frai.2026.1880282"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1880282","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,11]]},"article-number":"1880282"}}