{"id":"https://openalex.org/W7118199437","doi":"https://doi.org/10.3390/fi18010030","title":"Synergistic Phishing Intrusion Detection: Integrating Behavioral and Structural Indicators with Hybrid Ensembles and XAI Validation","display_name":"Synergistic Phishing Intrusion Detection: Integrating Behavioral and Structural Indicators with Hybrid Ensembles and XAI Validation","publication_year":2026,"publication_date":"2026-01-04","ids":{"openalex":"https://openalex.org/W7118199437","doi":"https://doi.org/10.3390/fi18010030"},"language":"en","primary_location":{"id":"doi:10.3390/fi18010030","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18010030","pdf_url":"https://www.mdpi.com/1999-5903/18/1/30/pdf?version=1767531449","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/18/1/30/pdf?version=1767531449","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019060398","display_name":"Isaac Kofi Nti","orcid":"https://orcid.org/0000-0001-9257-4295"},"institutions":[{"id":"https://openalex.org/I63135867","display_name":"University of Cincinnati","ror":"https://ror.org/01e3m7079","country_code":"US","type":"education","lineage":["https://openalex.org/I63135867"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Isaac Kofi Nti","raw_affiliation_strings":["Information Technology and Analytics Center (ITAC), School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA"],"raw_orcid":"https://orcid.org/0000-0001-9257-4295","affiliations":[{"raw_affiliation_string":"Information Technology and Analytics Center (ITAC), School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","institution_ids":["https://openalex.org/I63135867"]},{"raw_affiliation_string":"School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","institution_ids":["https://openalex.org/I63135867"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121947355","display_name":"Murat Ozer","orcid":null},"institutions":[{"id":"https://openalex.org/I63135867","display_name":"University of Cincinnati","ror":"https://ror.org/01e3m7079","country_code":"US","type":"education","lineage":["https://openalex.org/I63135867"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Murat Ozer","raw_affiliation_strings":["Information Technology and Analytics Center (ITAC), School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA"],"raw_orcid":"https://orcid.org/0000-0002-2518-3398","affiliations":[{"raw_affiliation_string":"Information Technology and Analytics Center (ITAC), School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","institution_ids":["https://openalex.org/I63135867"]},{"raw_affiliation_string":"School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","institution_ids":["https://openalex.org/I63135867"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121915515","display_name":"Chengcheng Li","orcid":null},"institutions":[{"id":"https://openalex.org/I63135867","display_name":"University of Cincinnati","ror":"https://ror.org/01e3m7079","country_code":"US","type":"education","lineage":["https://openalex.org/I63135867"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chengcheng Li","raw_affiliation_strings":["School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information Technology, University of Cincinnati, Cincinnati, OH 45221, USA","institution_ids":["https://openalex.org/I63135867"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5019060398"],"corresponding_institution_ids":["https://openalex.org/I63135867"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.01558769,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"18","issue":"1","first_page":"30","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9768999814987183,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9768999814987183,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.007600000128149986,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.003599999938160181,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.738099992275238},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.6586999893188477},{"id":"https://openalex.org/keywords/behavioral-pattern","display_name":"Behavioral pattern","score":0.5996000170707703},{"id":"https://openalex.org/keywords/profiling","display_name":"Profiling (computer programming)","score":0.5845000147819519},{"id":"https://openalex.org/keywords/behavioral-modeling","display_name":"Behavioral modeling","score":0.567300021648407},{"id":"https://openalex.org/keywords/behavioral-analysis","display_name":"Behavioral analysis","score":0.5558000206947327},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5317999720573425},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.43939998745918274}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8513000011444092},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.738099992275238},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.6586999893188477},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.5996000170707703},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.5845000147819519},{"id":"https://openalex.org/C78639753","wikidata":"https://www.wikidata.org/wiki/Q3318160","display_name":"Behavioral modeling","level":2,"score":0.567300021648407},{"id":"https://openalex.org/C2989277270","wikidata":"https://www.wikidata.org/wiki/Q168338","display_name":"Behavioral analysis","level":2,"score":0.5558000206947327},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5317999720573425},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.48809999227523804},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4828000068664551},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.47540000081062317},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.43939998745918274},{"id":"https://openalex.org/C70518039","wikidata":"https://www.wikidata.org/wiki/Q16000077","display_name":"Dimensionality reduction","level":2,"score":0.390500009059906},{"id":"https://openalex.org/C27438332","wikidata":"https://www.wikidata.org/wiki/Q2873","display_name":"Principal component analysis","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.33160001039505005},{"id":"https://openalex.org/C166955791","wikidata":"https://www.wikidata.org/wiki/Q629579","display_name":"Macro","level":2,"score":0.3296999931335449},{"id":"https://openalex.org/C111030470","wikidata":"https://www.wikidata.org/wiki/Q1430460","display_name":"Curse of dimensionality","level":2,"score":0.3285999894142151},{"id":"https://openalex.org/C2778565505","wikidata":"https://www.wikidata.org/wiki/Q2207566","display_name":"Spec#","level":2,"score":0.30570000410079956},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.2815000116825104},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2630000114440918},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25429999828338623}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/fi18010030","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18010030","pdf_url":"https://www.mdpi.com/1999-5903/18/1/30/pdf?version=1767531449","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:33ce871bb2284512bdbcda75f179d480","is_oa":true,"landing_page_url":"https://doaj.org/article/33ce871bb2284512bdbcda75f179d480","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 18, Iss 1, p 30 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/fi18010030","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18010030","pdf_url":"https://www.mdpi.com/1999-5903/18/1/30/pdf?version=1767531449","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4286532998085022,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7118199437.pdf"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W1971842139","https://openalex.org/W1985920648","https://openalex.org/W2029470356","https://openalex.org/W2070896531","https://openalex.org/W2163220194","https://openalex.org/W2800391419","https://openalex.org/W2890718808","https://openalex.org/W2899992227","https://openalex.org/W2963834533","https://openalex.org/W3004831388","https://openalex.org/W3033013607","https://openalex.org/W3094117827","https://openalex.org/W3134340954","https://openalex.org/W3171729851","https://openalex.org/W3184585466","https://openalex.org/W3195446130","https://openalex.org/W3209545352","https://openalex.org/W4229011440","https://openalex.org/W4281291316","https://openalex.org/W4312341861","https://openalex.org/W4313824596","https://openalex.org/W4315643577","https://openalex.org/W4322706916","https://openalex.org/W4323065767","https://openalex.org/W4362552717","https://openalex.org/W4379518989","https://openalex.org/W4381741171","https://openalex.org/W4385078831","https://openalex.org/W4385221456","https://openalex.org/W4387055688","https://openalex.org/W4394015528","https://openalex.org/W4394597023","https://openalex.org/W4395448865","https://openalex.org/W4399827668","https://openalex.org/W4401314842","https://openalex.org/W4402680049","https://openalex.org/W4404075990","https://openalex.org/W4405218961","https://openalex.org/W4405654320","https://openalex.org/W4407819781","https://openalex.org/W4408006173","https://openalex.org/W4408656758"],"related_works":[],"abstract_inverted_index":{"Phishing":[0],"websites":[1],"continue":[2],"to":[3,11,98,145,183],"evolve":[4],"in":[5,47,115,152],"sophistication,":[6],"making":[7],"them":[8],"increasingly":[9],"difficult":[10],"distinguish":[12],"from":[13],"legitimate":[14],"platforms":[15],"and":[16,44,54,80,148,166,173,180],"challenging":[17],"the":[18,29,100,139],"effectiveness":[19],"of":[20,31,103,130,141],"current":[21],"detection":[22,50,62],"systems.":[23],"In":[24],"this":[25],"study,":[26],"we":[27,93],"investigate":[28],"role":[30],"subtle":[32],"deceptive":[33],"behavioral":[34,104,110,143,160,174],"cues":[35],"such":[36],"as":[37],"mouse-over":[38],"effects,":[39],"pop-up":[40],"triggers,":[41],"right-click":[42],"restrictions,":[43],"hidden":[45],"iframes":[46],"enhancing":[48],"phishing":[49,73,91,184],"beyond":[51],"traditional":[52],"structural":[53],"domain-based":[55],"indicators.":[56,105],"We":[57],"propose":[58],"a":[59,81,89,126,177],"hierarchical":[60],"hybrid":[61],"framework":[63],"that":[64,109,159,169],"integrates":[65],"dimensionality":[66],"reduction":[67],"through":[68],"Principal":[69],"Component":[70],"Analysis":[71],"(PCA),":[72],"campaign":[74],"profiling":[75],"using":[76,136],"K":[77],"Means":[78],"clustering,":[79],"stacked":[82],"ensemble":[83],"classifier":[84],"for":[85],"final":[86],"prediction.":[87],"Using":[88],"public":[90],"dataset,":[92],"evaluate":[94],"multiple":[95],"feature":[96],"configurations":[97],"quantify":[99],"added":[101],"value":[102],"The":[106],"results":[107],"demonstrate":[108],"indicators,":[111],"while":[112],"weak":[113],"predictors":[114],"isolation,":[116],"significantly":[117],"improve":[118],"performance":[119],"when":[120],"combined":[121],"with":[122],"conventional":[123],"features,":[124],"achieving":[125],"macro":[127],"F1":[128],"score":[129],"97":[131],"percent.":[132],"Explainable":[133],"AI":[134],"analysis":[135],"SHAP":[137],"confirms":[138],"contribution":[140],"specific":[142],"characteristics":[144],"model":[146],"decisions":[147],"reveals":[149],"interpretable":[150],"patterns":[151],"attacker":[153],"manipulation":[154],"strategies.":[155],"This":[156],"study":[157],"shows":[158],"interactions":[161],"leave":[162],"measurable":[163],"forensic":[164],"signatures":[165],"provides":[167],"evidence":[168],"combining":[170],"structural,":[171],"domain,":[172],"features":[175],"offers":[176],"more":[178],"comprehensive":[179],"reliable":[181],"approach":[182],"intrusion":[185],"detection.":[186]},"counts_by_year":[],"updated_date":"2026-05-05T08:41:31.759640","created_date":"2026-01-05T00:00:00"}