# AI-Driven Phishing Detection: Enhancing Cybersecurity with Reinforcement Learning
## 2 Background and Related Work
By conducting extensive experiments and benchmarking our RL model against traditional ML models such as learning SVMs, decision trees, and Random Forests, we aimed to demonstrate the superiority of RL in both accuracy and adaptability. Recent studies have explored the application of RL for phishing detection. We summarized the key contributions of related work in Table 1 below, in phishing detection in relation to AI and RL, which highlights the focus, approach, and limitations of each study. This table helps provide a clear overview of the current research landscape and positions our work in relation to existing literature. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Author(s)** & **Year** & **Focus** & **Approach** & **Limitations** \\ \hline \hline \multirow{2}{*}{[PERSON] \& Pais} & \multirow{2}{*}{2019} & Detecting phishing & ML (Random Forest and & \\  & & websites & PCA-RF) & & \\ \hline \hline \multirow{2}{*}{[PERSON], [PERSON], \& [PERSON] [25]} & \multirow{2}{*}{2024} & Real-time phishing & DL (CNN, RNN, BRNN, and Attention Networks) & \multirow{2}{*}{\begin{tabular}{c} High computational cost; dependency on \\ extensive training data; inability to detect \\ URL hijacking; complexity limits adoption \\ in low-resource environments. \\ \end{tabular} } \\  & & & & & \\ \hline \hline \multirow{2}{*}{[PERSON] [26]} & \multirow{2}{*}{2022} & Phishing attack and & Comprehensive analysis & \multirow{2}{*}{\
\begin{tabular}{c} Lacks implementation details for modern \\ threats; reliance on generic prevention \\ techniques; no real-world testing \\ or evaluation. \\ \end{tabular} } \\  & & prevention & & & \\ \hline \hline \multirow{2}{*}{[PERSON], [PERSON] \&} \multirow{2}{*}{2023} & Addressing & \multirow{2}{*}{Double DQN (DDQN)} & Significant training time; complex \\  & & unbalanced web & with ICMDP & implementation; requires computational \\  & & classification & & resources for real-time applications. \\ \hline \hline \multirow{2}{*}{[PERSON] \& Maple [29]} & \multirow{2}{*}{2023} & Intrusion detection in & \multirow{2}{*}{DR-based IDS} & Limited resilience to advanced AML \\  & & IoT systems & & techniques; challenges in scaling to highly \\ \cline{1-1}  & & & & diverse IoT networks; significant \\ \cline{1-1}  & & & & computational overhead. \\ \hline \hline
\begin{tabular}{c} [PERSON], [PERSON], [PERSON], \\ [PERSON], [PERSON], \& [PERSON] \\ [30, 31] \\ \end{tabular} & \multirow{2}{*}{2024} & Phishing behavior & Adversarial Domain & Limited generalizability to non-blockchain \\ \cline{1-1}  & & detection on & Adaptation (ADA) model & phishing; challenges in scaling to new, \\ \cline{1-1}  & & & unseen blockchain platforms. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of phishing and intrusion detection research. The research work in [32] proposed a DRL model to detect phishing websites dynamically. Their work demonstrated improved adaptability but required large training datasets and experienced slow convergence, limiting real-world deployment. [PERSON] et al. [33] and [PERSON] et al. [33] applied a Double DDQN to address unbalanced phishing datasets, achieving high detection rates but demanding extensive computational resources during training. In contrast, our work focuses on developing a lightweight DQN-based phishing detection system, optimized for real-time adaptability, reduced false positives, and lower computational requirements, making it more practical for real-world cybersecurity environments. By benchmarking against both traditional ML and advanced DL models, this research highlights the operational advantages of an RL-based approach for phishing threat hunting. In addition to reviewing the state-of-the-art research in phishing detection, it is critical to analyze the current tools that implement these detection approaches. This comparison serves two key purposes:  
1. To contextualize the practical limitations of existing solutions in real-world environments;
2. To highlight the specific gaps that our RL-based framework aims to address.