Implementation of a Browser Extension with Multi-Layer Security Filtering Architecture for Real-Time Phishing Website Detection

Phishing Detection XGBoost Browser Extension Multi-Layer Architecture URL Lexical Feature Real-Time

Authors

  • Muhammad Rafly Wirayudha Department of Informatics Engineering, Faculty of Science and Technology, Universitas Islam Negeri Sultan Syarif Kasim Riau, Indonesia
  • Rahmad Abdillah Department of Informatics Engineering, Faculty of Science and Technology, Universitas Islam Negeri Sultan Syarif Kasim Riau, Indonesia
  • Novriyanto Department of Informatics Engineering, Faculty of Science and Technology, Universitas Islam Negeri Sultan Syarif Kasim Riau, Indonesia
  • Pizaini Department of Informatics Engineering, Faculty of Science and Technology, Universitas Islam Negeri Sultan Syarif Kasim Riau, Indonesia
May 29, 2026
May 31, 2026

Downloads

The increasingly sophisticated evolution of phishing attacks poses a significant challenge for cybersecurity systems, particularly regarding zero-day threats that frequently evade traditional blacklist detection. This study proposes the development of a browser extension with a Multi-Layer Security Filtering architecture to provide real-time protection. The system is designed across three defensive layers: Layer 1 employs the PhishTank API as a blacklist filter, Layer 2 uses the Tranco List API for whitelist verification, and Layer 3 applies an Extreme Gradient Boosting (XGBoost) model to detect emerging threats based on 22 lexical URL features. The system architecture is built on a Thin-Client model with a FastAPI backend to execute all security logic centrally on the server-side. The XGBoost model achieves an accuracy rate of 97.73% at an optimal threshold of 0.7 and an AUC score of 0.9927. Functionality testing demonstrates the system's success in performing automatic blocking and visual intervention through a blocking page. Furthermore, memory consumption testing validates the efficiency of the Thin-Client architecture, as the extension is proven to avoid persistent memory footprint allocation during URL capture, thereby ensuring lightweight browser performance. This implementation demonstrates that integrating list-based methods with artificial intelligence provides a proactive, accurate, and efficient detection response.