An Explainable Agentic RAG Framework for Zero-Shot Phishing and Web Attack Detection
Abstract
Abstract Phishing and web attacks remain among the most damaging cyber threats in industrial and enterprise systems, yet existing detection frameworks struggle to keep pace with rapidly evolving attack strategies. Most current approaches, including recent self-supervised ensemble methods, depend heavily on large volumes of manually labelled data and static pre-trained models that cannot generalise to unseen attack patterns. To address these limitations, we propose XAR-Detect (eXplainable Agentic Retrieval-Augmented Detection), a framework that brings together agentic LLM-based reasoning, retrieval-augmented generation, and dual-layer explainability to enable zero-shot phishing and web attack detection without retraining. At the core of XAR-Detect, a DeBERTa-based encoder extracts rich contextual representations from raw email and HTTP request data, which are dynamically enriched by a RAG module that retrieves semantically matched threat signatures from a live knowledge base spanning PhishTank, VirusTotal, and CVE repositories. An autonomous reasoning agent jointly processes local features and retrieved evidence to reach detection decisions, while SHAP-driven global attribution and instance-level attention maps provide transparent, auditable justifications for every prediction. The framework is evaluated on three phishing corpora—Nazario, Enron, and Subhadeep—and the SR-BH web attack benchmark under balanced and severely imbalanced distributions to assess overall robustness…
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.