<![CDATA[Purpose – URL-based phishing remains a persistent cybersecurity threat because attackers continuously generate deceptive links that evade blacklist-based and supervised detection systems. This study aims to develop and evaluate an unsupervised phishing detection framework that learns legitimate URL patterns without requiring labeled phishing samples during training. Design/methods/approach – A hybrid Variational Autoencoder–Convolutional Neural Network (VAE-CNN) model was proposed and compared with a Convolutional Autoencoder (CAE) baseline. Both models were trained only on legitimate URLs from the PhiUSIIL dataset and evaluated using repeated holdout validation across five random seeds. The experiments included four latent dimensions, five percentile-based anomaly thresholds, and McNemar’s exact test. In addition, external validation was conducted using PhishTank phishing URLs combined with PhiUSIIL legitimate holdout samples. Findings – In the main PhiUSIIL benchmark, the best VAE-CNN configuration achieved an accuracy of 0.9458, precision of 0.9091, recall of 0.9907, and F1-score of 0.9482, outperforming the best CAE baseline with an F1-score of 0.8920. In external validation, VAE-CNN achieved an F1-score of 0.9494, compared with 0.8470 for CAE. McNemar’s test confirmed statistically significant paired-prediction differences across all evaluated comparisons. Research implications/limitations – The findings indicate that probabilistic latent modeling improves unsupervised phishing detection, although the study remains limited to character-level URL representations and benchmark-based evaluation. Originality/value – The proposed VAE-CNN provides a statistically validated unsupervised framework for URL-based phishing detection and demonstrates promising cross-source performance under the evaluated PhiUSIIL–PhishTank setting, particularly when labeled malicious URLs are limited, delayed, or rapidly outdated.]]>
