Dual-Path Phishing Detection Framework

• The paper demonstrates that dual-path frameworks fuse heterogeneous signals (e.g., URL, text, image) via sequential, parallel, or hierarchical methods to enhance detection accuracy.
• It employs specialized modules such as low-cost URL analysis and deep NLP or visual processing to balance performance and operational cost.
• The approach improves interpretability and scalability by leveraging distinct evidence channels for both instance-level classification and campaign-level linkage.

Dual-path phishing detection denotes a family of phishing-analysis architectures in which two complementary routes examine the same artifact or campaign and then produce a final decision through escalation, score fusion, hierarchical clustering, or post-hoc revision. In recent work, the two routes have been instantiated as a URL-only agent followed by a multimodal URL-plus-screenshot agent (Trad et al., 2024), a transformer-based email-text path coupled with structural URL analysis (Altan et al., 25 Sep 2025), a blacklist screen coupled with an MLP over structural URL features (Emmanuel et al., 30 May 2026), a structural layer coupled with a contextual graph layer for campaign detection (Kang et al., 28 Feb 2025), a character-level URL CNN coupled with an HTML CAPE module (Castaño et al., 26 Jun 2025), and a machine-learning path coupled with a non-monotonic ASP reasoning path (Sen et al., 28 Apr 2026). This suggests that the term identifies a recurring design principle—pairing heterogeneous signals with different operating characteristics—rather than a single standardized pipeline.

1. Architectural scope and recurring patterns

The published literature uses the dual-path label for several distinct orchestration schemes. Some frameworks are explicitly sequential. Trad and Chehab describe a two-tiered agentic design in which a URL-only agent first emits one of PHISHING, LEGITIMATE, or UNSURE, and only inconclusive cases are escalated to a multimodal agent that sees both the URL and a screenshot (Trad et al., 2024). The hybrid MLP system of 2026 follows the same high-level principle: a blacklist-based screening stage first checks exact membership, and only URLs not found in the blacklist proceed to the MLP classification stage (Emmanuel et al., 30 May 2026). PHISHREV is also sequential, but its second stage is not another statistical classifier; it is a post-hoc ASP reasoner that revises initial machine-learning beliefs using contextual rules (Sen et al., 28 Apr 2026).

Other frameworks are parallel. The email-security system based on DistilBERT and Random Forest processes each incoming email through a textual NLP path and a URL structural path, then fuses their phishing probabilities in a lightweight decision layer (Altan et al., 25 Sep 2025). PhishKey runs a URL path and an HTML path in parallel and combines their scores with soft voting (Castaño et al., 26 Jun 2025). The multi-layered pipeline of 2026 keeps URL, header, and NLP content signals independent until a calibrated decision-level fusion stage combines them (Ismail et al., 19 Jun 2026).

A third pattern is hierarchical rather than purely sequential or parallel. EPhishCADE first constructs structural clusters from URL- and page-derived attributes, then performs graph-based contextual analysis and a final component-level merge to infer phishing campaigns rather than individual page labels (Kang et al., 28 Feb 2025). A plausible implication is that “dual-path” in phishing research spans both instance-level classification and campaign-level linkage.

Pattern	Representative form	Decision mechanism
Sequential	URL-only $\rightarrow$ multimodal; blacklist $\rightarrow$ MLP; ML $\rightarrow$ ASP	Stop on conclusive output or revise later
Parallel	Text $\parallel$ URL; URL $\parallel$ HTML	Weighted average, soft vote, calibrated OR
Hierarchical	Structural layer $\rightarrow$ contextual layer	Community detection and hierarchical merge

2. Path-specific representations and feature spaces

The first path in a dual-path framework is often optimized for low-cost or high-throughput evidence. In the agentic multimodal system, the URL-only agent takes a raw URL string and uses a brief prompt engineered to avoid irrelevant context; inconclusiveness is represented by an explicit UNSURE token or by probability below a threshold $\theta$ (Trad et al., 2024). In the transformer-plus-URL email framework, the textual path lowercases each email, tokenizes it with the DistilBERT WordPiece tokenizer, and pads or truncates to 256 tokens, yielding input IDs $\mathbf{x}\in\mathbb{Z}^{256}$ and attention mask $\mathbf{m}$; classification is performed by a linear head over the $[\mathrm{CLS}]$ embedding $\rightarrow$0 (Altan et al., 25 Sep 2025). The 2026 multi-layered pipeline uses DistilBERT again, but hardens it with 11 preprocessing steps, focal loss with $\rightarrow$1, adversarial training, character-noise augmentation, and leetspeak normalization so that the model learns text intent rather than URLs or token quirks (Ismail et al., 19 Jun 2026).

The second path usually captures information that the first path cannot reliably express. Structural URL paths are common. The email dual-path framework applies character-level TF-IDF with n-grams of length 2–6 and then classifies the resulting sparse vectors with a Random Forest having $\rightarrow$2, unlimited max depth, and Gini impurity (Altan et al., 25 Sep 2025). The lightweight hybrid URL detector uses 16 hand-defined structural features, including URL length, domain length, ratios of letters and digits, number of subdomains, suspicious TLD indicators, IP-based host flags, URL-shortener flags, and a redirect-count proxy; these features feed an MLP with topology $\rightarrow$3, ReLU activations in hidden layers, a sigmoid output, dropout $\rightarrow$4, and $\rightarrow$5 regularisation $\rightarrow$6 (Emmanuel et al., 30 May 2026). The URL stack in the multi-layered pipeline supplements lexical modeling with Domain Guard heuristics, threat-intelligence lookup, and an asymmetric L2 fusion sidecar based on character n-grams and live host features (Ismail et al., 19 Jun 2026).

HTML and visual paths represent another major branch of dual-path design. Trad and Chehab use screenshots as the second input modality and ask the multimodal agent to integrate visual and textual clues (Trad et al., 2024). PhishKey instead tokenizes raw HTML into tags, attributes, text, inline CSS, and JS tokens, maps each token through a pre-trained 100-dimensional Word2Vec space, and then keeps the $\rightarrow$7 most informative tokens per sample using centroid-based selection before Random Forest classification (Castaño et al., 26 Jun 2025). EPhishCADE expands the feature inventory further by combining URL-based lexical tokens, DOM tag-frequency vectors, DNS and reverse-DNS strings, target-brand labels, and submission timestamps in its structural layer, then uses textual, numeric, temporal, and spatial similarities in its contextual layer (Kang et al., 28 Feb 2025). Across these systems, the defining property is not a fixed modality pair but the deliberate partition of evidence into two analytically distinct channels.

3. Fusion, escalation, and decision logic

Decision logic is the core differentiator among dual-path frameworks. In Trad and Chehab’s sequential design, the logic is explicit: a first agent classifies the URL; if the returned label is not UNSURE, the system outputs that label and stops; otherwise a second agent classifies the URL together with the screenshot (Trad et al., 2024). The same paper formalizes average per-website cost as

$\rightarrow$8

where $\rightarrow$9 is the cost of the URL-only agent, $\rightarrow$0 is the cost of the multimodal agent, and $\rightarrow$1 is the fraction of sites escalated to the second stage (Trad et al., 2024). Here, escalation is both an inferential and an economic mechanism.

Parallel systems usually expose both path outputs as probabilities and then fuse them at decision time. The email dual-path model defines

$\rightarrow$2

and also evaluates a stacked meta-classifier

$\rightarrow$3

with $\rightarrow$4 chosen on a held-out validation set and typically $\rightarrow$5 (Altan et al., 25 Sep 2025). PhishKey uses an analogous soft-voting rule,

$\rightarrow$6

followed by thresholding, with $\rightarrow$7 tuned by grid search and $\rightarrow$8 commonly used as the decision threshold (Castaño et al., 26 Jun 2025). The multi-channel pipeline of 2026 adopts a calibrated probabilistic-OR:

$\rightarrow$9

where each $\parallel$0 is a calibrated phishing probability from one channel (Ismail et al., 19 Jun 2026). That paper also reports weighted-average and hand-set noisy-OR fallbacks, indicating that fusion remains a deployment-sensitive rather than universally fixed component.

Hierarchical and reasoning-based systems broaden the meaning of “fusion.” EPhishCADE combines structural and contextual signals through a convex score

$\parallel$1

and then performs community detection followed by component-level agglomerative clustering (Kang et al., 28 Feb 2025). PHISHREV uses symbolic fusion instead of probabilistic fusion: if a URL is predicted phishing but has meta tags, the ASP rules revise the final belief to benign (Sen et al., 28 Apr 2026). A common misconception is that dual-path phishing detection always implies late score averaging between two neural models. The published record shows that gating, hierarchical merging, and non-monotonic revision are all legitimate realizations of the same broader architectural idea.

4. Reported accuracy, robustness, and efficiency

The empirical case for dual-path design is strongest when complementary paths materially improve performance or reduce operating cost. In the large multimodal-agent study, URL-only analysis is weaker than multimodal analysis, but the dual-path agentic design preserves much of the multimodal accuracy while sharply reducing API cost. For Gemini 1.5 Flash, the reported accuracies are $\parallel$2 for URL-only, $\parallel$3 for image-only, $\parallel$4 for multimodal, and $\parallel$5 for agentic dual-path; for GPT-4o mini, they are $\parallel$6, $\parallel$7, $\parallel$8, and $\parallel$9, respectively (Trad et al., 2024). The same paper reports that GPT-4o mini can process $\parallel$0 websites per $\parallel$1100 (Trad et al., 2024). It also states that URL-only token usage is reduced by about $\parallel$2 for GPT-4o mini and $\parallel$3 for Gemini 1.5 Flash, and that the majority ($\parallel$4) of sites end at the URL-only stage (Trad et al., 2024).

In the email domain, the transformer-plus-URL framework reports that the fused dual-path model reaches Accuracy $\parallel$5, Precision $\parallel$6, Recall $\parallel$7, F1-Score $\parallel$8, and AUC $\parallel$9, compared with DistilBERT-only performance of Accuracy $\rightarrow$0, F1 $\rightarrow$1, and AUC $\rightarrow$2, and URL-only Random Forest performance of Accuracy $\rightarrow$3, F1 $\rightarrow$4, and AUC $\rightarrow$5 (Altan et al., 25 Sep 2025). The paper further states that a paired bootstrap test over 1,000 resamples yields $\rightarrow$6 on the F1 improvement of dual-path versus NLP-only, and gives a 95% confidence interval for dual F1 of $\rightarrow$7 (Altan et al., 25 Sep 2025). The associated ablation study reports that removing the URL path drops F1 from $\rightarrow$8 to $\rightarrow$9, while removing the NLP path yields $\theta$0, directly supporting the claim that the two paths contribute unique information (Altan et al., 25 Sep 2025).

For URL-only real-time detection, the blacklist-plus-MLP framework reports held-out test performance of Accuracy $\theta$1, Precision $\theta$2, Recall $\theta$3, F$\theta$4-Score $\theta$5, and ROC-AUC $\theta$6 for the MLP classifier, with average end-to-end hybrid latency $\theta$7 ms/URL and 8-thread concurrent throughput $\theta$8 URLs/s on an Intel Core i5-9300HF CPU (Emmanuel et al., 30 May 2026). Relative to baseline models trained on the same 16 features and train/test split, the proposed MLP outperforms Random Forest, Logistic Regression, XGBoost, LightGBM, and CatBoost under the reported setting (Emmanuel et al., 30 May 2026). PhishKey reports up to $\theta$9 F1 on the Opara dataset and shows that adversarial HTML-word injection causes only $\mathbf{x}\in\mathbb{Z}^{256}$0–$\mathbf{x}\in\mathbb{Z}^{256}$1 percentage-point F1 degradation, versus $\mathbf{x}\in\mathbb{Z}^{256}$2–$\mathbf{x}\in\mathbb{Z}^{256}$3 points in the baseline method (Castaño et al., 26 Jun 2025).

At larger system scale, the independently validated multi-channel pipeline reports that the recommended channel set $\mathbf{x}\in\mathbb{Z}^{256}$4 reaches Recall $\mathbf{x}\in\mathbb{Z}^{256}$5, FPR $\mathbf{x}\in\mathbb{Z}^{256}$6, F1 $\mathbf{x}\in\mathbb{Z}^{256}$7, and spam-FPR $\mathbf{x}\in\mathbb{Z}^{256}$8 on a $\mathbf{x}\in\mathbb{Z}^{256}$9-email whole-system benchmark (Ismail et al., 19 Jun 2026). The same work emphasizes generalization rather than in-distribution scoring, noting that its NLP path improved held-out real-phishing recall from $\mathbf{m}$0 in an overfit version to $\mathbf{m}$1 after data-centric hardening (Ismail et al., 19 Jun 2026). This shifts evaluation from raw benchmark optimism to deployable detection behavior.

5. Interpretability, privacy, and operational deployment

Dual-path designs frequently preserve or improve interpretability by separating semantically distinct evidence channels. In the transformer-plus-URL framework, self-attention weights on the $\mathbf{m}$2 token can be projected back onto input tokens to highlight suspicious words such as “verify,” “account,” and misspellings like “sauront,” while the URL Random Forest exposes high-weight TF-IDF n-grams such as “accoun,” “0paypal,” and “bank” through feature_importances_ (Altan et al., 25 Sep 2025). PHISHREV offers a different type of interpretability: its second path is an explicit ASP knowledge base whose defeasible rule revises phishing predictions when meta-tag evidence is present, making the revision logic inspectable rather than latent (Sen et al., 28 Apr 2026).

Privacy is a first-class design variable in some dual-path systems. EPhishCADE states that it never uses private email fields such as sender, recipient, subject, or body; instead it relies on extracted URLs and publicly available enrichments including IP, DNS, scraped HTML, screenshot/OCR text, geolocation, and timestamps (Kang et al., 28 Feb 2025). The paper further notes that URL strings can be hashed with SHA256 before cross-organizational sharing, and that one may add differential-privacy noise to numeric counts or use secure-aggregation protocols when combining graph weights across parties (Kang et al., 28 Feb 2025). This makes the framework explicitly privacy-aware while still supporting collaborative campaign identification.

Deployment details vary sharply by path design. The agentic multimodal framework notes API rate limits, throughput trade-offs, and conditional latency: GPT-4o mini is reported at about $\mathbf{m}$3 s/query for the agentic design versus $\mathbf{m}$4 s/query for the pure multimodal design, and the recommended deployment strategy is to queue URL-only requests, escalate a subset to multimodal analysis in parallel, and throttle to avoid HTTP 429 errors with backoff (Trad et al., 2024). The transformer-plus-URL framework proposes a modular microservice layout with /predict_email, /predict_urls, and a fusion service; it reports approximately $\mathbf{m}$5 emails/sec for DistilBERT inference, approximately $\mathbf{m}$6 URLs/sec for CPU-based Random Forest URL analysis, and approximately $\mathbf{m}$7 emails/sec for the combined pipeline (Altan et al., 25 Sep 2025). The multi-layered 2026 pipeline adds an observability dimension by instrumenting Kafka-carried trace context with OpenTelemetry, Prometheus, and Jaeger, and by verifying exactly 1:1 message conservation end-to-end (Ismail et al., 19 Jun 2026). The lightweight hybrid URL system complements these service-oriented deployments with a user-facing desktop prototype, CyberGuard, reporting startup time of about $\mathbf{m}$8 seconds, idle memory $\mathbf{m}$9 MB, memory under load $[\mathrm{CLS}]$0 MB, and UI latency below $[\mathrm{CLS}]$1 ms (Emmanuel et al., 30 May 2026).

6. Limitations, misconceptions, and research directions

A persistent misconception is that a dual-path framework is inherently superior to a strong single-path detector under all conditions. The evidence is more specific. In the agentic multimodal setting, dual-path is valuable because it attains near-multimodal accuracy while substantially reducing per-site token cost; the benefit is therefore jointly economic and predictive, not purely predictive (Trad et al., 2024). In transformer-plus-URL email detection, the fused model improves on both constituent paths, but the margin over the NLP-only model is modest in absolute F1 terms ($[\mathrm{CLS}]$2 versus $[\mathrm{CLS}]$3), whereas the gap to URL-only is much larger (Altan et al., 25 Sep 2025). This suggests that the utility of a second path depends on how much independent information it contributes.

Another misconception is that “dual-path” necessarily means “two modalities.” The surveyed systems include multimodal URL-plus-screenshot detection (Trad et al., 2024), but also URL-only dual-stage screening (Emmanuel et al., 30 May 2026), structural-plus-contextual campaign clustering (Kang et al., 28 Feb 2025), and machine-learning-plus-reasoning revision (Sen et al., 28 Apr 2026). A plausible implication is that the essence of the paradigm is complementary inductive bias rather than sensory modality.

The limitations reported in the literature are concrete. The email dual-path framework notes that its email dataset is relatively small and that scaling to millions of messages will require continual retraining; it also states that tiny URL shorteners and highly camouflaged URLs may require deeper graph-based or vision-based modules (Altan et al., 25 Sep 2025). EPhishCADE’s gains are measured against a structure-based baseline and focus on campaign coherence rather than page-level binary classification, so its results should be interpreted in that problem setting (Kang et al., 28 Feb 2025). The calibrated multi-channel pipeline explicitly describes its $[\mathrm{CLS}]$4-email whole-system benchmark as a preliminary integrated result because URL and header channels are proxies and the operating point still needs recalibration (Ismail et al., 19 Jun 2026). PHISHREV shows that reasoning can reduce false positives without retraining, but its revision rule is deliberately simple and context-specific: on the reported test set, the ASP layer revised $[\mathrm{CLS}]$5 of $[\mathrm{CLS}]$6 classifier outputs, about $[\mathrm{CLS}]$7, and reduced false positives from $[\mathrm{CLS}]$8 to $[\mathrm{CLS}]$9 overall (Sen et al., 28 Apr 2026).

The forward-looking directions are similarly diverse. The email dual-path framework proposes dynamic URL reputation signals such as WHOIS and hosting metadata, larger transformers such as RoBERTa and DeBERTa, multilingual phishing detection, and online adaptation of the fusion weight $\rightarrow$00 (Altan et al., 25 Sep 2025). EPhishCADE points toward richer collaborative linkage without private data exposure (Kang et al., 28 Feb 2025). The large-agent framework highlights continued optimization of token budgets and escalation policies (Trad et al., 2024). Taken together, these works indicate that dual-path phishing detection is evolving toward modular, calibration-aware, privacy-sensitive systems in which each path is engineered for a specific operational role rather than treated as a redundant duplicate of the other.