A multilayered machine learning and user-centric security framework for android phishing prevention

Android devices face an escalating threat from sophisticated phishing attacks exploiting URL manipulation, deceptive SMS messages, malicious application installations, and anomalous network traffic patterns. Existing single-layer detection systems suffer from elevated false positive rates and lack integrated user education components, limiting their real-world effectiveness. This paper presents a comprehensive Multilayered Machine Learning and User-Centric Security Framework that integrates four parallel detection engines—URL Lexical Analysis (Random Forest), Natural Language Processing Content Analysis (Logistic Regression), Static Behavioral Analysis (Support Vector Machine), and Dynamic Network Traffic Analysis (Random Forest)—into a weighted ensemble risk scoring system with fixed validation-derived triage thresholds. The framework further incorporates a Reinforcement Learning (RL)-based User Awareness Module delivering personalized, spaced-repetition phishing education. Evaluated on four publicly available benchmark datasets (PhiUSIIL: 235,795 URLs; SMS Spam Collection: 5,574 messages; Drebin-215: 15,036 applications; CIC-AndMal2017: 202,500 network flows), the proposed system achieves an overall detection accuracy of 94.7%, F1-score of 0.9800, AUC-ROC of 0.9913, false positive rate (FPR) of 3.2%, and false negative rate (FNR) of 2.1%. The integrated RL-based user-awareness module produced a descriptive 16.8% improvement in phishing-recognition score (32 score points absolute) within an average of 14.3 adaptive sessions, corresponding to a 35.3% reduction in sessions required to reach the expert threshold compared with static training. The deployed framework achieves a mean end-to-end inference latency of 42.71 ms (P95 = 51.83 ms) on physical Android hardware and approximately 5% additional battery consumption per day under the defined representative workload, demonstrating the feasibility of near-real-time on-device phishing prevention without cloud offloading.