CloudPhishNet: collaborative detection via large-small model synergy

Large foundation models such as BERT achieve remarkable phishing detection accuracy but are impractical for real-time deployment on resource-constrained devices, while lightweight models offer low latency but limited generalization. This paper proposes CloudPhishNet, a three-tier collaborative phishing detection framework that synergizes large and small models across a cloud-edge-client continuum. The cloud tier deploys a fine-tuned BERT model for deep semantic analysis and serves as the knowledge distillation teacher; the edge tier uses a CatBoost classifier for secondary validation; and the client tier employs an aggressively pruned CatBoost variant for rapid local screening. A soft-label knowledge distillation pipeline transfers the teacher’s semantic understanding to lightweight student models, improving pruned-model accuracy by up to 0.38 points. A reinforcement learning mechanism integrating Q-learning, DQN, and PPO dynamically orchestrates cross-layer workload offloading based on real-time device states. Experiments on benchmark phishing datasets demonstrate that CloudPhishNet achieves 96.9% detection accuracy—only 1.2 points below cloud-only BERT—while reducing inference latency by 86.4% and processing 75% of samples locally. The client model compresses to 0.02 MB (98% compression ratio) while retaining 97.4% F1 performance. The DQN-based offloading strategy outperforms all heuristic baselines in average reward.