AI-Based Cyber Threat Detection System: A Hybrid Machine Learning and AI Reasoning Approach for Real-Time Malicious URL Detection

Phishing and malicious URLs remain a common cybersecurity problem because attackers can create new links faster than static blocklists can be updated. This paper presents CyberShield, a real-time URL detection system that combines a calibrated machine-learning ensemble with a separate AI reasoning layer. Random Forest and XGBoost use 11 structural URL features to produce a confidence score. For URLs that are not covered by the trusted-domain whitelist, Google Gemini provides an additional assessment and a plain-English explanation. The system is integrated with a Chrome extension, a FastAPI backend, a React dashboard, email alerts, and a human-reviewed learning process. The evaluated dataset contains 641,119 URLs and is divided into training, calibration, and test subsets. On the held-out test set, the ML ensemble achieved 94.32% accuracy, 91.45% precision, 91.47% recall, a 91.46% F1-score, and a 98.46% AUC-ROC. These metrics describe the ML ensemble, not a separate quantitative evaluation of the complete Gemini-assisted application. Functional tests also checked URL scanning, warning display, and fallback to ML results when the AI service was unavailable. The results show the potential of combining URL-based machine learning with AI explanations, although broader end-to-end testing is needed.