arXiv subjects

Gideon Francis Oghie

Publications and source records attributed to Gideon Francis Oghie.

3 recordsLinked to original sources

arXiv2026

A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification

Phishing emails that impersonate Nigerian fintech providers can combine deceptive sender addresses, lookalike links, and locally familiar language. This study presents a Gmail browser extension that integrates sender-domain and URL checks with a bidirectional long short-term memory (BiLSTM) classifier. The extension compares visible sender addresses and links with profiles for eight fintech platforms, obtains a phishing probability from a locally hosted Flask service, and displays a legitimate, warning, or phishing verdict when an email is opened. The BiLSTM classifier was evaluated on 8,943 test messages from a cleaned dataset of 59,622 phishing and legitimate emails. The test confusion matrix recorded 4,308 true negatives, no false positives, one false negative, and 4,634 true positives. These counts correspond to 99.99% accuracy, 100.00% precision, 99.98% recall, and 99.99% F1 score. Tokenized sequence analysis identified 5.79% overlap between the training and test sets, which may inflate performance estimates for independent messages. A Gmail demonstration showed the integrated extension producing user-visible verdicts, although the complete system was not evaluated on a labeled test set. The findings establish the feasibility of the implemented prototype while leaving its end-to-end detection performance and generalization to unseen attacks open for further evaluation.

cs.CR↗

arXiv2026

SafeGuard: A Lightweight Client-Server Architecture for Real-Time Endpoint Threat Detection and Response

Endpoint devices remain a primary target for cyberattacks, yet commercial Endpoint Detection and Response (EDR) platforms are often too costly and operationally complex for small and resource-constrained organizations. This paper presents SafeGuard, a lightweight three-tier client-server architecture for real-time endpoint monitoring, threat reporting, and administrative response. The system comprises a Flutter-based endpoint agent extended with Kotlin for Android system access, a Node.js central server that authenticates devices and coordinates secure communication, and an administrative dashboard for live monitoring and remote actions such as device locking, application removal, and warning notification dispatch. Threat detection is implemented through signature-based comparison against a maintained threat database, prioritizing low computational overhead, explainability, and ease of deployment over generalized anomaly detection. Communication security is achieved using WebSocket over TLS (WSS), JSON Web Token (JWT) authentication, and HMAC-based message integrity verification. The system was evaluated through unit, integration, system, load, and preliminary security testing. Under a simulated deployment of 50 concurrent endpoints, average command-dispatch latency was approximately 1.5 seconds and remained below 2 seconds under load. Invalid authentication tokens were rejected, while manual SQL injection and replay attempts were unsuccessful in the evaluated scenarios. The results demonstrate that an open-source technology stack can provide real-time endpoint visibility and coordinated administrative response without commercial licensing costs. The contribution is architectural and empirical rather than algorithmic, with current limitations including reliance on static threat signatures, Android-focused implementation, and controlled-environment evaluation.

cs.CR↗

arXiv2026

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features

Phishing attacks remain a major cybersecurity threat, exploiting deceptive URLs to steal sensitive user information. Traditional blacklist and rule-based detection approaches are reactive and often fail to identify newly emerging phishing URLs. This paper proposes a lightweight hybrid framework for real-time phishing URL detection that combines blacklist-based screening with a Multi-Layer Perceptron (MLP) classifier operating solely on structural URL features. The framework extracts 16 URL-derived features capturing structural, domain-based, and security-related characteristics without requiring webpage content access, third-party APIs, or visual rendering, making it computationally efficient for real-time deployment. The system was trained and evaluated on the PhiUSIIL phishing dataset containing 235,795 labelled URLs. Experimental results show that the proposed MLP achieved 99.24% accuracy, 98.74% precision, 99.95% recall, 99.34% F1-score, and 99.65% ROC-AUC, outperforming Random Forest, Logistic Regression, XGBoost, LightGBM, and CatBoost under the same evaluation setting. The hybrid architecture achieved an average inference latency of 1.2 ms per URL and a peak throughput of 4,200 URLs per second under concurrent processing. A functional desktop application prototype, CyberGuard, further demonstrates deployment viability. The results indicate that the proposed framework provides an accurate and computationally efficient solution for real-time phishing URL detection in resource-constrained environments.

cs.CR↗