An Explainable and Context-Aware Hybrid Phishing Detection Framework Using Machine Learning and Retrieval-Augmented Generation

Abstract—Phishing attacks have become a major problem inthe area of cybersecurity, with attackers continuously finding newways to deceive users through fake websites, malicious links,and misleading emails. Such attacks are traditionally detectedby rules, blacklists and machine learning techniques. But theseapproaches might not always catch new or tweaked phishingattacks. They also give little information about why a particularURL, website or email is considered suspicious.In this paper we propose a hybrid phishing detection frame-work leveraging machine learning, Retrieval-Augmented Genera-tion (RAG) and Large Language Models (LLMs). The system usesmachine learning classifiers to analyze URLs, website informationand email content. It also uses a cybersecurity knowledge baseto locate applicable information about known phishing methodsand suspicious actions. This information is then used to generateexplanations of the detection results using an LLM. The LLMhelps the classifier by giving it more context, but does not changeits own prediction.The framework will be evaluated based on accuracy, precision,recall, F1-score and false-positive rate. We will also consider howrelevant the retrieved information is, how good the generatedexplanations are and how long it takes to produce results. We willperform cross-dataset tests and ablation experiments to explorethe contribution of different components.