A Hierarchical Attention Network for Explainable Phishing URL Detection on Nigerian Financial Platforms

Abstract

Phishing remains the major channel of cyber-fraud in Nigeria, where fraudulent uniform resource locators (URLs) are used to pretend to be legitimate banks, mobile money services, and digital payments channels in order to steal users' credentials, Bank Verification Number (BVN) and card details. Current detection solutions used by Nigerian financial organisations depend heavily on blacklists, heuristics, and traditional machine learning classifiers working as black boxes, which do not give any explanation of why a particular URL was classified as malicious and show poor generalization to emerging phishing schemes. In this paper, we propose a Hierarchical Attention Network (HAN) that views a URL as a two-level hierarchy of domain and path, where each of them is segmented into tokens and apply attention both at token and segment levels to detect phishing URLs and highlight the specific parts of a URL contributing to this classification. Our model is based on 164,548 Nigerian bank-related URLs extracted from the 822,010-row Kaggle Phishing and Legitimate URLs dataset with 80/20 stratified train/test split. The baseline is a flattened BiLSTM network without attention layers. The baseline gave 94.37% accuracy (phishing F1 score = 0.9421), while our HAN scored 94.05% accuracy (phishing F1 score = 0.9373) along with higher stability of validation accuracy curve and smaller false-positive rate, meaning that slight drop in accuracy is compensated by increased precision and interpretability. The visualisation of the attention weights showed that the model always gives the most weight to the structural anomalies like abnormal subdomain tokens, combined or hyphenated strings, and non-standard prefixes like 'secure' or 'mail', but not to brand names of the banks themselves.