A Lightweight Agentic AI Framework with DeepSeek-R1 for Adaptive Phishing URL Detection

Abstract

Phishing URLs remain a major cybersecurity threat because their development is constantly changing and becoming more deceptive. This study presented an agentic adaptive AI framework that utilizes a large language model as a reasoning agent operating multiple external tools instead of performing a classification, to detect phishing URLs. An lightweight tabular classifier with just 9,662 trainable parameters delivers predictions very efficiently, and explains the relevance of features in terms of attack similarity based on SHAP-based feature attribution and episodic memory retrieval. The agent combines these outputs from the tools to generate structured explanations and security recommendations. Experiments demonstrate strong performance, with accuracy up to 95.6% and AUC values above 0.99.