Multi Signal Phishing and Anomaly Detection Approach for Edge <scp>AI</scp> Cyber Threat Monitoring

ABSTRACT Phishing campaigns evolve with new threat vectors that necessitate unique detection techniques. This paper introduces a lightweight, client‐side edge Artificial Intelligence (AI) dashboard for real‐time multi‐signal phishing detection with user privacy and security in mind. The client‐centric architecture allows for operation in network restricted air gap environments, retaining sensitive data in a restricted perimeter. The system's modular design permits it to integrate into Development, Security and Operations (DevSecOps) processes. The cyber threat monitoring dashboard uses rule‐based heuristic classification for email phishing detection and XGBoost (Extreme Gradient Boosting) for network anomaly detection. MobileNet (Lightweight convolutional neural network architecture) is proposed as a future integration as a lightweight visual classifier. On the NSL‐KDD (Network Security Laboratory—Knowledge Discovery and Data Mining) intrusion detection benchmark, XGBoost outperformed Random Forest in Balanced Accuracy by 5.8%, demonstrating its ability to handle minority class, sophisticated attack types. The Proof of Concept (PoC) generates fast and accurate results with a front end that functions in real‐world environments.