A Multi-Layer Phishing Defense Framework for Trusted Cloud Environments

Phishing attacks remain a persistent threat to the confidentiality and trust of cloud environments, enabling credential theft and unauthorized access to sensitive resources. This paper presents PhishDefender, a multi-layer phishing defense framework that enhances trustworthy cloud services through the integration of ensemble machine learning, policy enforcement, and threat intelligence validation. Built on the UCI Phishing Website dataset, the ensemble model combining Logistic Regression, Random Forest, Gradient Boosting, AdaBoost, XGBoost, Multilayer Perceptron and Deep Neural Network achieved 97.82% accuracy, 97.91% precision, 97.74% recall, 97.82% F1-score and a ROC-AUC of 0.988, with an average inference time of ≈ 1.05 seconds. These results demonstrate high separability between legitimate and phishing URLs while maintaining practical performance for deployment in real-time cloud applications. The framework further extends detection outcomes into actionable policy responses (Allow, Alert, Report, Block) verified against external threat feeds, forming a layered defense aligned with zero-trust architecture principles. Its lightweight and modular design enables deployment on standard or cloud-hosted infrastructure, offering a reproducible and scalable approach for organizations seeking to enhance trust, resilience, and compliance in distributed cloud ecosystems.