AI- Driven Chrome Extension for Real-Time Phishing URL Detection Using On-Device ONNX Runtime Inference

Abstract

One of the most prevalent forms of cybercrime is the phishing assault, in which a fraudulent website poses as a trustworthy one in order to deceive visitors into divulging personal information (such as login credentials, financial data, and bank account details). In order to safeguard users from phishing attacks, this research study suggests creating an AI-powered system that can detect malicious websites using the Google Chrome browser extension. For smart and real-time phishing detection, the suggested solution integrates heuristic-based URL analysis with machine learning approaches, as opposed to the traditional blacklist-based systems that struggle to handle the new generation of phishing URLs. The extension uses a trained ONNX-based machine learning model and feature extraction techniques to dynamically analyze suspicious URLs based on features like URL length, IP addresses, too many subdomains, special characters, and phishing keywords. The system also works with ONNX Runtime Web (WASM) to enable lightweight and fast inference that can be performed directly in the browser in an off-screen Chrome environment and offers an improved blacklist verifier that runs locally to better detect known phishing domains and enhance protection. The extension keeps track of all the browser tabs and analyzes URLs on the fly, alerting users and preventing access to suspicious ones. Experimental tests show that the system introduces a high rate of detecting a large variety of phishing URL categories, such as IP-based attacks, overly long phishing URLs, keyword-based phishing URLs, and misleading domain structure. The proposed solution is lightweight, private, and has an efficiency acceptable for real-time deployment without heavy reliance on external cloud services. Overall, this study is a valuable addition for enhancing the cybersecurity of browsers and integrates AI, heuristic methods with state-of-the-art browser extension technologies into a practical and effective phishing prevention framework.