Predict, Detect, Defend: A Machine Learning Framework for Next-Generation Cyber Risk Modelling

Introduction: This study examines how machine learning can advance next-generation cyber risk modelling, focusing on phishing detection and prevention. Phishing remains one of the most common and evolving cyber threats, exploiting both technical weaknesses and human psychology to obtain confidential information. Blacklists and static rule-based filters often fail to catch advanced techniques such as spear-phishing, homograph attacks, and dynamically generated malicious URLs. This study draws on email content, URL structure, website metadata, and user interactions to enhance the real-world applicability of ML in detecting and preventing phishing attacks.

Methodology: Phishing and legitimate emails, URLs, and website content were collected and pre-processed. Feature engineering extracted suspicious URL patterns, domain age, sender reputation, and textual features as phishing indicators. Transformer-based models analysed email text for phishing-related keywords and phrases, while supervised classifiers, random forest, support vector machines, and gradient boosting identified phishing URLs using features such as link count, domain names, and special characters. Convolutional neural networks assessed visual similarity between phishing and legitimate brand pages to detect spoofed interfaces, and ensemble models combined multiple outputs to strengthen detection robustness. Performance was evaluated using precision, recall, F1-score, and false-positive rate, with emphasis on minimising detection time for real-time filtering.

Findings: ML models substantially outperformed traditional blacklist- and rule-based filters in detecting known and novel phishing attempts. Transformer-based NLP models effectively identified deceptive language and social engineering cues, while CNNs classified brand-mimicking websites. Multimodal ensemble approaches combining URL-based, content-based, and visual features achieved the highest detection accuracy, capturing the diverse tactics phishing attacks employ.

Conclusion: Aligning ML techniques, NLP, visual similarity detection, and ensemble learning with phishing's distinct characteristics enables more accurate, adaptive anti-phishing defences. This multimodal approach improves real-time detection and reduces false alarms, better protecting users and organisations while informing future research into adaptive filtering, user-awareness-integrated security, and brand protection.