PhishCluster: Real-Time, Density-Based Discovery of Malicious URL Campaigns from Semantic Embeddings

Abstract

The proliferation of algorithmically generated malicious URLs has overwhelmed traditional threat intelligence systems, necessitating a paradigm shift from reactive, single-instance analysis to proactive, automated campaign discovery. Existing systems excel at finding semantically similar URLs given a known malicious seed but fail to provide a real-time, macroscopic view of emerging and evolving attack campaigns from high-velocity data streams. This paper introduces PhishCluster, a novel framework designed to bridge this critical gap. PhishCluster implements a two-phase, online–offline architecture that synergistically combines large-scale Approximate Nearest Neighbor (ANN) search with advanced density-based clustering. The online phase employs an ANN-accelerated maintenance algorithm to process a stream of URL embeddings at unprecedented throughput, summarizing the data into compact, evolving Campaign Micro-Clusters (CMCs). The offline, on-demand phase then applies a hierarchical density-based algorithm to these CMCs, enabling the discovery of arbitrarily shaped, varying-density campaigns without prior knowledge of their number. Our comprehensive experimental evaluation on a synthetic billion-point dataset, designed to mimic real-world campaign dynamics, demonstrates that PhishCluster’s architecture resolves the fundamental trade-off between speed and quality in streaming data analysis. The results validate that PhishCluster achieves an order-of-magnitude improvement in processing throughput over state-of-the-art streaming clustering baselines while simultaneously attaining a superior clustering quality and campaign detection fidelity.

1. Introduction

The landscape of cybersecurity is a theater of relentless innovation, where adversaries continuously devise new methods to circumvent detection. A prime battleground in this conflict is the use of malicious Uniform Resource Locators (URLs) for phishing, malware distribution, and command-and-control (C2) infrastructure [1].

For years, the primary defense against such threats was syntactic analysis. This approach relied on two main strategies: maintaining vast blocklists of known malicious domains and applying regular expression-based rules to identify suspicious patterns in URL strings [2]. While effective against known, static threats, this paradigm has been rendered increasingly fragile by the polymorphic and high-volume nature of modern attacks. Modern attackers no longer rely on a small set of easily identifiable indicators. Instead, they deploy sophisticated campaigns involving thousands or even millions of unique, short-lived URLs.

A key enabler of this strategy is the use of Domain Generation Algorithms (DGAs). DGAs are algorithms embedded within malware that periodically generate a large number of domain names that can serve as rendezvous points with their C2 servers [3,4,5]. Since both the infected machine and the attacker use the same algorithm, often seeded with a shared value like the current date, both parties know which domains will be active at any given time [3, 5]. This allows malware to maintain communication even as security teams block individual domains. Malware families like Conficker can generate up to 50,000 domains per day, making manual blocklist curation and reactive takedowns completely futile [4,6]. Furthermore, attackers employ a wide range of obfuscation techniques to evade pattern-matching filters, such as typosquatting (e.g., “microsooft.com”), homoglyph attacks, or the use of seemingly random subdomains on compromised but otherwise legitimate websites.

The sheer volume, ephemeral nature, and polymorphism of these threats mean that identifying them requires a deeper, semantic understanding of a URL’s intent rather than a superficial analysis of its string representation. The breakthrough for overcoming these challenges has come from deep learning, particularly from large, pre-trained Transformer-based language models [7,8,9]. These models can be trained to transform semi-structured data like URLs into dense, high-dimensional vector embeddings [9,10]. In this learned high-dimensional space, geometric proximity corresponds to semantic similarity. For instance, two different variations of a PayPal phishing attempt will be mapped to vectors that are very close to each other, even though their string representations are quite different.

This transformation from a raw string to a semantic vector enables the use of Approximate Nearest Neighbor (ANN) search as a powerful tool for threat intelligence. Given an embedding of a newly discovered malicious URL, an ANN search can instantly retrieve a set of semantically similar URLs from a massive historical database. This capability is transformative for security analysts, allowing them to attribute new indicators to known campaigns and discover novel attack variants in real time.

However, this capability, while powerful, represents a fundamentally reactive operational model. It excels at retrieval—answering the question, “Find more URLs like this one”—but requires an analyst to already possess a lead. The critical unmet need in modern security operations is for a system that can perform proactive discovery. Such a system must automatically survey the global, high-velocity stream of all observed URLs and answer the question, “What are the active campaigns emerging, evolving, and fading right now?” This shift from manual, query-driven investigation to automated, continuous situational awareness is the central problem that PhishCluster is designed to solve.

In this work, we specifically focus on the problem of campaign discovery rather than simple URL detection. To strictly define the scope of our analysis, we formalize the concepts of related attacks and campaign groups as follows:

• Related Attacks: Two or more malicious URLs are considered “related” if they exhibit both semantic proximity (their vector embeddings ${\overrightarrow{v}}_a,{\overrightarrow{v}}_b$ satisfy $\left|\right|{\overrightarrow{v}}_a-{\overrightarrow{v}}_b\left|\right|<ϵ$) and temporal locality (they appear in the stream within a shared time window). This proximity indicates a shared intent (e.g., a specific phishing kit) or common infrastructure (e.g., a DGA seed), distinguishing them from unrelated attacks that may merely share generic keywords.
• Campaign Group: We define a campaign not as a simple spherical cluster, but as a density-connected set of related attacks. Formally, a campaign is a collection of micro-clusters that form a continuous high-density region in the semantic space, separated from other regions by low-density noise. This definition allows a “group” to assume arbitrary shapes and varying densities, reflecting the organic, non-convex evolution of an attack over time.

Real-time campaign discovery from a high-dimensional data stream presents a formidable set of technical challenges that lie at the intersection of large-scale systems, data mining, and cybersecurity:

• Velocity and Scale: Malicious URLs are discovered at rates of thousands per minute, contributing to a continuous, potentially infinite data stream that must be processed without performance degradation. The system must operate under strict memory and time constraints, processing each data point in a single pass [11,12]. High accuracy is often achieved by offline forensic clustering, but these methods are too slow for “fast-flux” campaigns that may last only minutes. Conversely, fast streaming methods often sacrifice accuracy, leading to high false positive rates and “alert fatigue.” A viable solution must bridge this gap, offering high-fidelity discovery at line speed.
• Complex Campaign Structure: Malicious campaigns are not uniform, spherical clusters. They often exhibit arbitrary shapes, possess varying densities, and evolve over time as attackers alter their tactics. This complexity renders traditional partitioning-based clustering methods like K-means, which are biased towards convex shapes, unsuitable for this domain [13,14].
• The Curse of Dimensionality: Modern URL embeddings are high-dimensional (e.g., 384 dimensions), a characteristic that poses a significant challenge to traditional clustering algorithms. In high-dimensional spaces, the concept of distance and density can become less meaningful as all pairs of points tend to become almost equidistant [15,16].
• Concept Drift: The threat landscape is non-stationary [2]. New campaigns constantly emerge, existing ones change their characteristics, and old ones become inactive. A successful discovery system must be adaptive, capable of tracking this “concept drift” by gracefully incorporating new patterns and aging out obsolete ones.

To address these challenges, this paper proposes PhishCluster, a new layer of intelligence built upon a scalable ANN index. PhishCluster introduces a two-phase, density-based streaming algorithm that transforms the raw, high-dimensional stream of URL embeddings into a coherent, real-time map of malicious campaigns. It is designed to resolve the fundamental trade-off between the speed of online streaming algorithms and the quality of offline batch clustering methods. The novel contributions of this paper are threefold:

• The design of an ANN-accelerated online clustering algorithm. We propose, for the first time, the use of a large-scale vector index to fundamentally accelerate the core neighborhood search operation in a streaming clustering context, overcoming the primary performance bottleneck of traditional methods.
• A hybrid online–offline architecture that decouples real-time data summarization from on-demand, high-quality campaign generation. This architecture uses compact micro-cluster summaries for efficient online maintenance and leverages the power of the Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN) algorithm in the offline phase to accurately model campaigns of varying density and arbitrary shape.
• A comprehensive experimental evaluation on a synthetic billion-point dataset. We demonstrate that PhishCluster achieves a state-of-the-art performance, outperforming established streaming clustering baselines in terms of throughput, latency, and the accuracy of campaign discovery.

2. Related Work

The design of PhishCluster is informed by research spanning four key domains: the semantic analysis of URLs, large-scale ANN search, the principles of density-based clustering for data streams, and advanced clustering algorithms capable of handling complex data distributions.

2.1. Approaches to Malicious URL Detection and Campaign Discovery

The field of malicious URL detection has evolved through several distinct generations. The earliest and most widely deployed defense mechanisms were blocklists and heuristic rule engines. While computationally efficient, these methods are fundamentally reactive and easily bypassed by obfuscation techniques like URL shortening or fast-flux DNS switching [17].

To overcome these limitations, the community shifted toward supervised machine learning. Early work engineered lexical features (e.g., URL length, token and n-gram statistics, character entropy, special character counts) and host/network features (WHOIS, ASN, IP reputation, TTL/fast-flux indicators) and trained classical classifiers such as Random Forests, SVMs, and gradient-boosted trees [17,18].

However, the brittle hand-crafted feature pipeline spurred a rapid move to representation learning: deep neural models—recurrent networks, CNNs over character sequences, and more recently Transformer-based encoders—learn discriminative embeddings directly from raw URLs, HTML, and rendered page screenshots, often improving robustness and generalization in benchmark experiments. Recent Transformer-based models such as PyraTrans [19], PhishTransformer [20], BERT-based URL classifiers [21], and optimization-enhanced DL approaches [22] achieve state-of-the-art accuracy in both phishing and malware URL datasets. Deep learning approaches have also emerged in the literature, utilizing Convolutional Neural Networks (CNNs) and Transformers to learn feature representations directly from the raw URL character sequence, achieving detection accuracies exceeding 98% on benchmark datasets [23].

Beyond pure classification, recent trends emphasize hybrid and multi-modal systems that combine lexical, host, content (HTML/JS), and visual cues, resulting in more resilient detectors against obfuscation and URL shorteners. Graph-based and linkage-based approaches—including clustering over URL–IP, URL–domain, and certificate graphs, as well as GNN-based inference—are increasingly applied for campaign discovery and coordinated threat detection. These methods identify malicious infrastructure, redirection chains, and shared hosting patterns, thereby exposing entire phishing or fast-flux campaigns rather than isolated URLs. Recent multi-modal systems such as CURL-IP [24] further integrate URL lexical signals with network-level attributes to improve detection under adversarial evasion.

Recent surveys provide comprehensive reviews of datasets, benchmarks, and evaluation methodologies, highlighting practical challenges such as concept drift, adversarial perturbations, and temporally realistic evaluation protocols [18,25,26]. Open problems remain in robust temporal generalization, scalable campaign clustering in partially observed graphs, explainability for analyst workflows, and operational deployment under real-time constraints.

Despite all these developments, a critical gap remains in the transition from classification to discovery. Supervised models are excellent at labeling individual URLs as “malicious” or “benign”, but they do not inherently group these detections into coherent campaigns. Previous attempts at unsupervised campaign discovery have relied largely on graph mining (clustering URLs by shared IPs or DNS records) or simple lexical clustering (e.g., Levenshtein distance). As noted in recent surveys, these methods often suffer from scalability issues (due to the quadratic complexity of pairwise comparisons) or fail to detect campaigns that use semantic obfuscation (e.g., synonyms) rather than lexical similarity [27]. PhishCluster specifically addresses this gap by introducing a scalable, semantic approach to unsupervised discovery.

2.2. From Syntactic to Semantic URL Analysis

The detection of malicious URLs has matured significantly from its origins in reactive, string-based methods. Early approaches centered on maintaining vast blocklists of known malicious domains and applying heuristic, regular expression-based rules to identify suspicious lexical patterns. These methods proved brittle and unable to keep pace with the polymorphic nature of modern threats. The subsequent application of classical machine learning models automated this process but remained constrained by the limitations of handcrafted feature engineering. The current state-of-the-art, which provides the foundational data for PhishCluster, involves using large, pre-trained Transformer-based language models to convert raw URL strings into dense, high-dimensional vector embeddings. In this learned space, geometric proximity corresponds to semantic similarity, providing a robust foundation for identifying related threats regardless of their syntactic differences [1].

2.3. Large-Scale Approximate Nearest Neighbor Search

The ability to efficiently query a massive database of URL embeddings is a prerequisite for any scalable threat intelligence system. However, performing exact nearest neighbor searches in high-dimensional space is computationally prohibitive. This has led to the development of a wide array of Approximate Nearest Neighbor (ANN) search techniques, which largely fall into two major families: partition-based and graph-based. While in-memory graph-based algorithms like Hierarchical Navigable Small World (HNSW) [5] offer exceptional performances, their memory footprint makes them infeasible for billion-scale datasets on commodity hardware. For disk-aware graph-based indexing, a seminal work is DiskANN, which uses a single-layer Vamana proximity graph optimized to minimize random I/O operations during a search traversal [3]. Systems like PhishGraph [28] build upon this foundation, adding features tailored for cybersecurity, such as handling for streaming updates and hybrid queries with attribute filters. In these systems, the ANN index serves as the primary engine for user-facing queries. PhishCluster fundamentally repurposes this technology, not as a user-facing query engine, but as an internal algorithmic accelerator, a critical building block to overcome the performance limitations of traditional data mining techniques at scale. The partition-based approach uses clustering algorithms like K-Means to divide the vector space into manageable partitions, a technique foundational to classic Inverted File (IVF) systems [9]. This architectural lineage is reviewed in [29] and has culminated in state-of-the-art indexes like Google’s SCANN [11], which uses a K-Means-like partitioning stage combined with novel quantization methods.

2.4. Density-Based Clustering for Data Streams

Clustering data streams presents a unique set of constraints, including the need for single-pass processing, limited memory and time budgets, and the ability to adapt to an evolving data distribution. Density-based methods are particularly well suited for this task, as they can discover clusters of arbitrary shapes, are robust to noise, and do not require the number of clusters to be specified in advance—all critical properties for modeling malicious campaigns. Most streaming clustering algorithms adopt a two-phase, online–offline framework. In the online phase, the incoming data stream is summarized into a small number of synopsis data structures, often called micro-clusters. In the offline phase, a final clustering is performed on these summaries. This approach is central to several seminal algorithms, such as DenStream [13], which maintains potential and outlier micro-clusters to differentiate between stable regions and nascent patterns. Another notable algorithm, DBSTREAM [14], uses a “shared-density” graph to maintain connections between micro-clusters.

A key mechanism in all modern streaming algorithms is the use of a density decay factor or “fading function” (e.g., an exponential decay $f\left(t\right)=2^{-\lambda t}$). This function places more weight on recent data points, allowing the summary statistics to “forget” old, irrelevant patterns over time. This temporal decay is essential for tracking the full life cycle of malicious campaigns—their birth, evolution, and eventual death—and adapting to the concept drift inherent in the threat landscape. Despite their conceptual suitability, a critical performance bottleneck persists in most density-based streaming algorithms: the neighborhood search. To merge a new point or update micro-clusters, these algorithms must often find the closest existing micro-cluster, a step that typically degrades to an $O\left(N\right)$ linear scan over the set of N active micro-clusters. In a high-throughput, high-dimensional environment, this $O\left(N\right)$ operation becomes the limiting factor for scalability. This specific bottleneck provides the central motivation for PhishCluster’s novel ANN-accelerated online maintenance phase.

2.5. Advanced Density-Based Clustering (The DBSCAN Family)

While streaming algorithms provide the framework for online processing, the quality of the final discovered campaigns depends on the power of the offline clustering stage. The DBSCAN family of algorithms represents the state-of-the-art in density-based clustering. The foundational algorithm, DBSCAN [15], formalizes the notion of a cluster as a high-density region of points separated by lower-density regions. It defines clusters based on two parameters: a radius $ϵ$ and a minimum number of points MinPts. A point is a core point if it has at least MinPts neighbors within $ϵ$. A cluster is then formed by a set of “density-connected” core points and their “density-reachable” neighbors (border points). Any point that is not a core point and not reachable from one is labeled as noise. DBSCAN’s primary limitation is its reliance on these single, global density parameters.

Building on DBSCAN, HDBSCAN (Hierarchical DBSCAN) [16] is arguably the most advanced and robust density-based algorithm. It formalizes and automates the extraction of clusters from the density hierarchy. HDBSCAN begins by transforming the space using a concept of mutual reachability distance to make the algorithm more robust to noise. It then builds a complete density-based cluster hierarchy (akin to the one found by OPTICS). Instead of using a single $ϵ$ cut, it traverses this hierarchy and uses a stability-based measure to select the most stable clusters—those that persist and are most distinct across a wide range of density levels. Its key advantages are its ability to find clusters of varying densities and arbitrary shapes, its superior performance in filtering out noise, and its more intuitive parameterization (requiring only the min_cluster_size parameter). The primary drawback of HDBSCAN is its computational complexity; it is a batch algorithm designed for static datasets and is not suitable for direct application to a high-velocity data stream.

2.6. The Challenge of High Dimensionality

A recurring challenge across all clustering methodologies is the “curse of dimensionality.” As the number of dimensions increases, the data becomes increasingly sparse, and the distance between any two points can converge, making density estimation difficult. This can severely degrade the performance of distance-based and density-based algorithms. PhishCluster addresses this challenge not by altering the dimensionality, but by leveraging two key properties of its environment. First, it relies on high-quality semantic embeddings from state-of-the-art language models, which are specifically trained to produce a vector space with a meaningful neighborhood structure [1,30]. Second, and more critically, it uses a highly optimized ANN index, a technology expressly designed to efficiently and accurately perform neighborhood queries in high-dimensional spaces [3,5].

A fundamental tension exists in the literature between the speed required for stream processing and the quality achieved by more complex batch algorithms. Fast streaming algorithms often use simple, radius-based criteria that are insufficient for complex cluster structures. High-quality algorithms like HDBSCAN are too slow for real-time application. PhishCluster is architected to resolve this trade-off. It achieves speed in its online phase through data summarization and ANN acceleration, and it achieves quality in its offline phase by applying the powerful HDBSCAN algorithm to these high-fidelity summaries.

3. The PhishCluster Architecture and Algorithm

PhishCluster is an end-to-end system designed to ingest a high-velocity stream of URL embeddings and produce a real-time, structured view of active malicious campaigns. Its architecture is predicated on a separation of concerns: an extremely fast online component maintains a lightweight summary of the data stream, while a more computationally intensive offline component performs high-quality clustering on this summary at the request of an analyst.

3.1. System Overview

The PhishCluster architecture, depicted in Figure 1, is organized into two distinct operational phases: a high-velocity online maintenance phase (Phase 1) and an on-demand offline discovery phase (Phase 2).

To enable scalable discovery, PhishCluster implements a summarize-then-cluster strategy. The direct clustering of the raw, high-velocity stream is computationally prohibitive, while simple partitioning fails to capture complex campaign shapes. Our strategy bridges this gap by using the online phase to granularly summarize related attacks into compact Campaign Micro-Clusters (CMCs)—preserving the geometric structure of the stream while discarding redundant points—and then using the offline phase to structurally analyze the connectivity between these CMCs. This allows the system to discover complex groups of related attacks that would otherwise be fragmented by simpler streaming algorithms. The system integrates four primary components:

• Input Stream: The system consumes a stream of enriched data objects from an ingestion pipeline. Each object contains a high-dimensional vector embedding of a URL and its associated metadata.
• ANN Index: A large-scale, disk-aware ANN index (e.g., based on DiskANN [3]) serves as the system’s long-term memory and algorithmic accelerator. It stores the centroids of active campaign summaries and provides sub-linear time neighborhood queries.
• PhishCluster Online Maintenance Module: This is the heart of the real-time system. For each incoming URL embedding, this module performs an ANN-accelerated search to find the most relevant existing campaign summary, decides whether to merge the new point or create a new summary, and applies a temporal decay to age out old data. Crucially, the output of this online phase is not a final static clustering, but a dynamic, real-time state of Campaign Micro-Clusters (CMCs) held in memory. This continuous summary captures the evolving “shape” of the threat landscape without requiring the heavy computation of finalizing cluster boundaries.
• Campaign Micro-Cluster (CMC) Store: A persistent, in-memory key value store that holds the current state of all campaign summaries (CMCs). This store is continuously updated by the online module.
• PhishCluster On-Demand Generation Module: This module is invoked by an analyst or a scheduled process. It takes a snapshot of the active CMCs from the store—effectively decoupling the analysis from the ingestion rate—and performs a high-quality hierarchical clustering on their centroids to generate a structured representation of the current campaign landscape.

3.2. The Campaign Micro-Cluster (CMC) Data Structure

The core summarization primitive in PhishCluster is the Campaign Micro-Cluster (CMC). A CMC is a data structure that maintains a statistical summary of a group of semantically similar URL embeddings that have arrived over time. This design is inspired by the clustering feature vector used in many streaming algorithms and the concept of potential/outlier micro-clusters. Formally, a CMC is defined as a tuple: $CMC=(N,\overrightarrow{LS},\overrightarrow{SS},t_0,t_{\lambda },\mathrm{status})$.

• N: The weight of the cluster, representing the decayed count of points it contains.
• $\overrightarrow{LS}$: The D-dimensional linear sum of the member vectors. The centroid of the CMC is calculated as $\overrightarrow{c}={\displaystyle \frac{\overrightarrow{LS}}{N}}$.
• $\overrightarrow{SS}$: The D-dimensional squared sum of the member vectors. This allows for the efficient calculation of the cluster’s variance and radius.
• $t_0$: The creation timestamp of the CMC.
• $t_{\lambda }$: The timestamp of the last data point merged into the CMC.
• status: A label, either “potential” or “active”. A “potential” CMC is newly formed and has not yet accumulated enough evidence to be considered a stable campaign. An “active” CMC has surpassed a weight threshold and is considered a stable cluster.

This structure allows for efficient, incremental updates. When a new point is added, only these summary statistics need to be updated, rather than storing all the raw vectors.

3.3. Online Maintenance: ANN-Accelerated Micro-Clustering

The online maintenance algorithm is executed for every new data point p (with embedding vector ${\overrightarrow{v}}_p$) that arrives at time $t_{now}$. The process is designed for maximum throughput and low latency.

• Temporal Decay Application: The first step is to apply a temporal decay function to all existing CMCs in the store. The weight N of each CMC is updated according to its last update time $t_{\lambda }$: $N_{new}=N_{old}·2^{-\lambda (t_{now}-t_{\lambda })}$, where $\lambda$ is a decay constant that controls the half-life of a point’s influence. Any CMC whose weight N falls below a pruning threshold $\beta$ is removed from the store and the ANN index. This step ensures that the system adapts to concept drift by forgetting old, inactive campaigns. In practice, this mechanism allows the system to autonomously handle concept drift; as a campaign stops emitting URLs, its CMC weight decays asymptotically to zero, effectively “forgetting” the obsolete concept without manual intervention.
• Find Nearest Neighboring CMCs: This is the critical acceleration step. The algorithm queries the underlying ANN index to find the k nearest active CMC centroids to the new point’s vector ${\overrightarrow{v}}_p$. This replaces the computationally expensive linear scan over all CMCs, which would be the bottleneck in a traditional implementation, with a highly efficient, sub-linear time search [3].
• Attempt Merge with Active CMCs: The algorithm iterates through the k nearest active neighbors returned by the ANN query. For each candidate CMC, it calculates a hypothetical new radius that would result from merging point p. If this new radius is less than or equal to a predefined threshold $ϵ$, the point p is merged into that CMC. The CMC’s statistics ($N,\overrightarrow{LS},\overrightarrow{SS},t_{\lambda }$) are updated, its centroid is updated in the ANN index, and the process for point p terminates.
• Attempt Merge with Potential CMCs: If no suitable active CMC was found, the algorithm performs a similar neighborhood search and merge attempt against the set of “potential” CMCs (this set is typically small enough for a linear scan or a separate, smaller in-memory index). If a merge is successful, the “potential” CMC’s statistics are updated. If its new weight N now exceeds a promotion threshold $\mu$, its status is changed to “active”, and its centroid is inserted into the main ANN index.
• Create New Potential CMC: If point p could not be merged into any existing CMC (neither active nor potential), it is considered the seed of a new, nascent campaign. A new CMC is created with “status=potential”, containing only the point p, and is added to the CMC store.

This algorithm effectively leverages the ANN index to make the most expensive part of the online process—finding the right cluster to merge into—extremely fast, enabling the system to handle massive stream velocities.

It is important to clarify that while the global boundary refinement is performed on-demand, this online maintenance phase constitutes real-time discovery in two specific ways. First, it provides instant attribution: every incoming URL is attributed to an emerging or active CMC within milliseconds, allowing for immediate blocking decisions based on cluster reputation. Second, it ensures live state availability: the CMC store maintains a continuously queryable map of active threats. Unlike batch systems that are blind between jobs, PhishCluster’s state always reflects the traffic observed up to the last millisecond, effectively discovering the existence and growth of campaigns in real time, even if their final shape is refined later.

3.4. On-Demand Campaign Generation: Hierarchical Clustering of Summaries

While the online module ensures that the CMC store is always a fresh, up-to-date summary of the data stream, it does not explicitly define the boundaries of macro-level campaigns. The on-demand generation module is responsible for this final, high-quality clustering step, which is triggered by an analyst.

• Input Selection: The process begins by retrieving all CMCs from the store that currently have “status=active”. These represent the stable, significant micro-clusters in the data stream.
• Construct Centroid Matrix: A data matrix is constructed where each row corresponds to the centroid vector, $\overrightarrow{c}=\overrightarrow{LS}/N$, of one of the selected active CMCs.
• Execute HDBSCAN: The HDBSCAN algorithm is applied to this matrix of centroids. This step is the key to achieving high-quality results. Because HDBSCAN is operating on the centroids of a few thousand CMCs instead of billions of raw data points, the computation is extremely fast and can be performed on-demand in seconds. HDBSCAN’s ability to handle varying densities and automatically determine the number of clusters allows it to correctly identify the complex structure of the campaign landscape, merging multiple related CMCs into a single campaign or separating CMCs that are close but belong to distinct density patterns.
• Label Propagation and Output: HDBSCAN outputs a set of cluster labels, assigning each CMC centroid to a specific campaign or labeling it as noise. These campaign labels are then propagated back: all the individual URLs that were summarized into a given CMC are now considered part of the campaign to which that CMC was assigned. CMCs labeled as noise by HDBSCAN represent small, dense pockets of URLs that do not belong to any larger, stable campaign and can be flagged for individual review. The final output is a structured list of discovered campaigns enriched with summary statistics (e.g., campaign size, duration, centroid, representative URLs) for analyst consumption.

The interplay between the online and offline stages is crucial. The quality of the final campaigns produced by HDBSCAN is directly dependent on the quality of the summaries generated by the online module. If the online merge radius $ϵ$ is set too large, distinct campaigns might be conflated into a single CMC, making it impossible for HDBSCAN to separate them later. Conversely, if $ϵ$ is too small, a single campaign could be fragmented into numerous tiny CMCs, making the final clustering task for HDBSCAN more difficult. This coupling implies that the hyperparameters of both stages must be tuned in concert to achieve optimal system performance.

4. Experimental Evaluation

A series of comprehensive experiments were conducted to rigorously validate the PhishCluster architecture and quantify its performance benefits. The evaluation was designed to assess the system’s clustering quality, its scalability under high-velocity streaming workloads, and the specific contributions of its core architectural components.

4.1. Experimental Setup

All experiments were performed on a single server equipped with a 16-core Intel Xeon CPU, 48 GB of DDR4 RAM, and a 2 TB NVMe SSD. We created a synthetic 1-billion-point dataset designed to evaluate performance at scale while preserving the properties of real-world data. The process began with the ∼650,000 URL embeddings from the public “Malicious URLs Dataset” from Kaggle (https://www.kaggle.com/datasets/sid321axn/malicious-urls-dataset (accessed on 30 October 2025)).

We first applied K-means clustering to the source dataset to identify 5000 potential semantic centroids. From this pool, we randomly selected 1000 centroids to serve as the seeds for our ground truth campaigns. Points for each campaign were generated by taking the selected centroid vector and adding isotropic Gaussian noise $\mathcal{N}(0,{\sigma }^2)$ with $\sigma =0.05$. This noise generation strategy was chosen to mimic the geometric clustering behavior of real-world campaigns in the semantic embedding space, where lexical variations (e.g., typosquatting, random subdomains) manifest as dense clusters around a central semantic intent. Furthermore, to reflect real-world temporal dynamics, we modeled the campaign arrival rates using a Poisson’s process with time-varying intensity, ensuring that the dataset captures realistic drift patterns and non-uniform density variations characteristic of live botnet traffic. While synthetic, this dataset allows us to rigorously test system stability against extreme burst dynamics that are difficult to isolate in static public datasets.

Critically, each campaign was assigned a temporal profile, defining its start time, duration, and arrival rate. Each URL was embedded into a 384-dimensional vector using the all-MiniLM-L6-v2 model [30]. Two distinct streaming workloads were generated from this dataset: (1) a steady-state workload, a 1 h stream with a constant arrival rate of 10,000 URLs/s; (2) a campaign burst workload, a 1 h stream starting at 5000 URLs/s, which at the 30 min mark introduces a burst of 50 new, high-velocity campaigns, increasing the rate to 20,000 URLs/s for 10 min.

PhishCluster was compared against three baselines:

• DenStream, a faithful implementation of the classic streaming density-based clustering algorithm. Partition-based stream algorithms were excluded as they enforce spherical cluster shapes, which are unsuitable for the arbitrary geometries of malicious campaigns.
• Batch-HDBSCAN, a naive baseline that runs the full HDBSCAN algorithm on all raw data points that arrived in a 60 s window.
• PhishCluster-NoANN, an ablation of our system where the ANN-accelerated query is replaced with a brute force linear scan.

We evaluated the systems using several metrics. Clustering quality metrics evaluate accuracy against the ground truth labels. These include the following: the Adjusted Rand Index (ARI), which measures the similarity between predicted and ground truth clusterings (1.0 is a perfect match, 0.0 is random), correcting for chance; precision, which measures the purity of a discovered cluster; and recall, which measures the completeness of the cluster. Performance was measured by the maximum sustainable throughput (URLs/s), the highest rate of incoming URLs the system can process continuously. Finally, campaign dynamics were measured by Campaign Detection Latency (s), the wall clock time from the first arrival of a new campaign’s URL to the moment the system creates a stable cluster for it.

4.2. System Throughput and Scalability

The primary goal of PhishCluster is to enable high-throughput stream processing without sacrificing quality. Figure 2 illustrates the fundamental trade-off between throughput (Queries Per Second, QPS) and clustering recall. PhishCluster maintains a high, stable throughput across all recall targets, demonstrating its efficiency. In contrast, the non-accelerated baselines (PhishCluster-NoANN and DenStream) suffer a rapid performance degradation as higher recall is demanded because their linear scan neighborhood search becomes prohibitively expensive. This result validates the core hypothesis that ANN acceleration is critical for scalable, high-quality stream clustering.

4.3. Clustering Quality and Adaptability

We used the campaign burst workload to evaluate how well each system could adapt to sudden changes. Figure 3 shows the ARI score over time. Before the burst, all systems achieve stable qualities. At the 30 min mark, the introduction of 50 new campaigns causes a quality drop. PhishCluster demonstrates the fastest recovery, quickly identifying the new campaigns and returning to a high ARI score. DenStream also adapts but stabilizes at a lower quality score, as its simple, radius-based merging logic struggles to correctly delineate the boundaries of the new campaigns.

Figure 4 presents the precision–recall curve for the task of assigning individual URLs to their correct ground truth campaign. PhishCluster significantly outperforms DenStream, achieving both a higher precision and higher recall. This demonstrates the superiority of its two-phase clustering approach, where the powerful HDBSCAN algorithm in the offline stage can produce much more accurate campaign boundaries than the simpler methods used by traditional streaming algorithms. Crucially, PhishCluster’s accuracy (ARI 0.92) approaches that of the offline Batch-HDBSCAN baseline (ARI 0.94), which represents the theoretical upper bound of the clustering quality achievable by state-of-the-art density-based methods. This confirms that PhishCluster successfully approximates the quality of an offline forensic tool while operating at online speeds.

4.4. Hyperparameter Sensitivity

To investigate the system’s sensitivity to its core parameters, we performed two additional experiments. First, we evaluated the trade-off governed by the online merge radius, $ϵ$. As shown in Figure 5, we ran the steady-state workload while varying $ϵ$. The results perfectly illustrate the fundamental design trade-off: a smaller $ϵ$ (e.g., 0.2–0.3) produces very high-quality (high ARI) clustering but forces the system to manage more micro-clusters, thus reducing throughput. Conversely, a larger $ϵ$ (e.g., 0.6–0.7) significantly boosts throughput by aggressively merging new points, but this comes at the cost of lower clustering quality as distinct campaigns are incorrectly conflated. Second, we analyzed the impact of the temporal decay factor, $\lambda$, on adaptability. We re-ran the campaign burst workload (Figure 3) with three different decay half-lives. As seen in Figure 6, a fast decay (short half-life) adapts very quickly to the burst, rapidly identifying the new campaigns and restoring a high ARI. However, it is more “jittery” and can prematurely forget stable campaigns. A slow decay (long half-life) is very stable but adapts poorly, taking a long time to forget old data and incorporate the new campaign burst. This confirms $\lambda$ as the critical parameter for tuning the system’s memory and adaptability to concept drift.

4.5. Scalability with Increasing Campaign Count

A core hypothesis of this paper is that the $O\left(N\right)$ linear scan neighborhood search is the fundamental bottleneck in traditional streaming clustering. To validate this, we designed an experiment to measure system latency as a function of the number of active campaigns. We generated workloads with an increasing number of ground truth campaigns (from 1000 to 100,000) and measured the P99 processing latency for our full system versus the PhishCluster-NoANN baseline. The results, shown in Figure 7, are definitive. The PhishCluster-NoANN (brute force) baseline exhibits perfect linear $O\left(N\right)$ scalability; as the number of CMCs increases by an order of magnitude, the latency also increases by an order of magnitude, quickly becoming unusable. In sharp contrast, the full PhishCluster system, accelerated by the ANN index, exhibits flat, polylogarithmic $O(logN)$ scalability. Its latency remains under 5 ms even when managing 100,000 active CMCs, proving that our architecture has successfully broken the $O\left(N\right)$ bottleneck.

4.6. Memory Footprint and Stability

A critical, non-functional requirement of a streaming system is stable resource consumption. We measured the system’s memory footprint (Resident Set Size) over the 60 min campaign burst workload, comparing PhishCluster to the DenStream baseline. The results in Figure 8 highlight the effectiveness of our temporal decay mechanism. Both systems see a sharp increase in memory usage at the 30 min mark, corresponding to the influx of 50 new campaigns. However, the DenStream baseline’s memory continues to grow unbounded. In contrast, PhishCluster’s memory usage stabilizes and then decreases after the burst. This demonstrates that as the new campaigns become stable CMCs, the temporal decay function successfully prunes old, inactive CMCs from memory. This self-regulating behavior is essential for a system designed for continuous, long-running operation.

4.7. Comparative Evaluation with PhishTransformer

To rigorously evaluate the trade-offs between supervised deep inspection and unsupervised streaming discovery, we conducted a focused comparison with PhishTransformer [20], a state-of-the-art Transformer-based model.

The evaluation relies on a specialized dataset curated by Asiri et al. [20], consisting of 10,000 URLs (balanced between 5000 legitimate and 5000 phishing). Unlike standard datasets that provide only the URL string, this dataset includes deep contextual features obtained by scraping the target webpages. For every URL, we extracted all embedded hyperlinks (e.g., <a href>, <iframe>, and JavaScript sources) to analyze the relationship between the main domain and the resources it loads. This allows it to detect sophisticated attacks where a benign URL hosts malicious content.

Table 1. Performance comparison between PhishTransformer (deep inspection) and PhishCluster (high-velocity discovery).

Metric/Feature	PhishTransformer [20]	PhishCluster
Architecture	Supervised	Unsupervised
Accuracy	99.0%	98.9%
Precision	99.0%	98.6%
Recall	99.0%	98.8%
Latency Profile	High (>500 ms for scraping)	Real-Time (<10 ms)
Primary Capability	Forensic Classification	Campaign Discovery

presents the comparative results. PhishTransformer achieves a slightly higher detection accuracy (99.0%) compared with PhishCluster (98.9%). This marginal gain (0.1%) is attributable to the supervised model’s access to the scraped HTML content, allowing it to inspect the “payload” of the page.

The experimental results highlight a fundamental divergence in operational utility:

• Latency vs. Depth: PhishTransformer excels in forensic scenarios where latency is acceptable. However, its dependence on live web scraping creates a significant bottleneck (often >500 ms per URL due to network RTT and rendering), rendering it unsuitable for filtering traffic at the ISP backbone level (millions of requests per second). PhishCluster, achieving a nearly identical accuracy (98.9%) using only the vector embedding, operates with sub-millisecond latency, making it viable for inline blocking.
• Discovery vs. Classification: PhishTransformer is an instance-centric classifier; it outputs a binary label (Safe/Phish) based on training data. It cannot identify if two phishing URLs belong to the same attacker. PhishCluster is campaign-centric; it not only detects the threat but automatically groups semantically related URLs into clusters. This allows security analysts to identify and block entire campaigns (e.g., “PayPal Scam Kit v4”) rather than chasing individual URLs.
• Maintenance: As a supervised model, PhishTransformer requires periodic retraining with labeled datasets to recognize new attack patterns. PhishCluster, being unsupervised, adapts to concept drift via its temporal decay and density mechanisms, requiring no labeled retraining to discover novel campaign geometries.

4.8. Ablation Study: Component Importance Analysis

To determine which component of the proposed scheme contributes most significantly to performance, we conducted an ablation study isolating the two core modules of PhishCluster: (1) the ANN-Based Acceleration, (2) the Two-Phase Density Architecture.

Table 2. Overall performance summary.

System	Max Throughput (URLs/s)	Mean ARI	Precision	Recall	Campaign Detection Latency (s)
PhishCluster (Full)	8570	0.92	0.94	0.95	5.8
PhishCluster-NoANN	720 *	0.91	0.93	0.94	6.1
DenStream	680 *	0.78	0.75	0.81	15.3
Batch-HDBSCAN	95	0.94	0.96	0.96	>60

* These baselines exhibit similar throughput due to the $O\left(N\right)$ bottleneck and are plotted together in Figure 2.

presents the results.

Impact of ANN Acceleration (Speed): By comparing PhishCluster (Full) against PhishCluster-NoANN, we isolate the contribution of the vector index. Removing the ANN component results in a catastrophic drop in throughput (from 8570 to 720 URLs/s) with no change in accuracy. This confirms that the ANN component is the primary driver of scalability and is essential for handling high-velocity streams.

Impact of Density Architecture (Accuracy): By comparing PhishCluster-NoANN against the standard baseline DenStream (which uses a spherical buffering architecture), we isolate the contribution of our density-based summarization and HDBSCAN pipeline. The results show a massive improvement in clustering quality (ARI increases from 0.78 to 0.91). This confirms that our Two-Phase Density Architecture is the primary driver of detection fidelity, enabling the system to correctly model non-spherical campaigns that traditional stream algorithms miss.

In conclusion, the ablation study demonstrates that the Two-Phase Density Architecture provides the necessary accuracy, while the ANN Acceleration provides the necessary speed; both components are critical, but they serve distinct, non-overlapping roles in the system’s efficacy.

The overall performance is summarized in Table 2. PhishCluster not only dominates in throughput but also maintains low processing latency and achieves a clustering quality nearly on par with the offline, non-real-time batch method. Crucially, its Campaign Detection Latency is significantly lower than its competitors, demonstrating its effectiveness as a real-time early warning system for new threats.

5. Discussion

The experimental results provide strong empirical validation for the PhishCluster architecture. The findings demonstrate that by synergistically combining techniques from large-scale ANN search and streaming data mining, it is possible to resolve the fundamental speed-versus-quality trade-off that has limited prior work.

5.1. Interpretation of Findings

The core success of PhishCluster stems from its principled, two-phase design. The ablation study clearly shows that neither the ANN acceleration nor the advanced offline clustering is sufficient on its own. The order-of-magnitude throughput improvement is a direct result of replacing the O(N) linear scan bottleneck of traditional streaming algorithms with an efficient ANN query [3]. This makes the online component scalable to a large number of active campaigns. Simultaneously, the superior clustering quality (Figure 3 and Figure 4) is a direct result of applying the powerful, varying-density HDBSCAN algorithm in the offline phase. This allows the system to move beyond the simple geometric assumptions of earlier algorithms and model the complex, organic shapes of real-world malicious campaigns.

5.2. Failure Mode Analysis

While PhishCluster achieves a high overall accuracy, an analysis of the false negatives and false positives reveals specific failure modes inherent to semantic clustering:

• Semantic Collisions (False Positives): In dense regions of the vector space, legitimate URLs may be semantically indistinguishable from phishing attempts (e.g., a legitimate login page vs. a high-fidelity clone). PhishCluster may incorrectly group these into a malicious campaign if the embedding model does not capture subtle distinguishing features.
• Low-Density “Slow-Drip” Campaigns (False Negatives): Attacks that deliberately use very low arrival rates (e.g., 1 URL/min) may fail to form a dense enough micro-cluster to survive the temporal decay function. These “low-and-slow” attacks may be pruned before they can be aggregated into a campaign.
• Embedding Blind Spots: The system is fundamentally bounded by the quality of the upstream embedding model. If a new obfuscation technique (e.g., using zero-width characters) does not significantly alter the semantic vector produced by the Transformer, PhishCluster will fail to distinguish it as a new pattern.

5.3. Deployment Challenges and Practical Considerations

Deploying PhishCluster in a production Security Operations Center (SOC) introduces operational challenges beyond pure algorithmic performance.

• Index Maintenance: While the ANN index is robust, it can degrade over time as thousands of micro-clusters are created and deleted. Periodic index rebuilding or “vacuuming” is required to maintain query latency, which may require a brief maintenance window or a dual-index switching strategy.
• Embedding Model Drift: PhishCluster relies on a static vector space defined by the embedding model. If the threat landscape shifts to languages or obfuscations not well represented by the model, the system requires retrained embeddings. This necessitates re-indexing all active micro-clusters into the new vector space.
• Cold Start: When initializing the system, the ANN index is empty. An initial “warm-up” period using historical data is recommended to pre-populate the index with known campaign centroids, preventing the fragmentation that can occur when the first few points of a campaign arrive without a valid nearest neighbor.

5.4. The Role of Embedding Quality

It is crucial to acknowledge the symbiotic relationship between a system like PhishCluster and the underlying URL embedding model. The entire premise of the system rests on the quality of the semantic space produced by the encoder. PhishCluster is a powerful tool for discovering density-based structures within that space, but it cannot create structure where none exists. The success demonstrated in our experiments is therefore a testament to both the PhishCluster architecture and the effectiveness of modern Transformer-based models in capturing the semantic intent of URLs [1,30].

5.5. Limitations and Hyperparameter Sensitivity

Despite its strong performance, PhishCluster has limitations. The system’s behavior is governed by a set of key hyperparameters, including the online merge radius $ϵ$, the temporal decay factor $\lambda$, and HDBSCAN’s min_cluster_size parameter. An improperly tuned $ϵ$ in the online stage can lead to poor-quality micro-clusters that cannot be corrected by the offline stage. Finding the optimal set of parameters for a dynamic, non-stationary environment like the threat landscape is a significant challenge. A production system would likely benefit from mechanisms for adaptive hyperparameter tuning, which remains an open area for future research.

5.6. Limitations of Synthetic Evaluation

We acknowledge that our evaluation relies on a synthetic billion-point dataset. While we carefully modeled the Gaussian noise to mimic the geometric behavior of lexical obfuscation, synthetic data cannot fully capture the semantic “messiness” of real-world traffic, such as the overlap between compromised legitimate infrastructure and malicious subdomains. However, using synthetic data was a necessary design choice to rigorously test the architectural scalability (Section 4.4) and burst handling (Section 4.3) in a controlled manner, which is not possible with the smaller, static public datasets currently available. Future work will focus on validating these findings with partner data from live ISP traffic streams.

5.7. Generalizability

While this paper focuses on malicious URL analysis, the core architectural pattern of PhishCluster is highly generalizable. The system provides a template for high-throughput, high-quality clustering of any high-dimensional data stream where real-time discovery of evolving patterns is required. This architecture could be readily adapted to other critical cybersecurity domains, such as malware analysis or network threat hunting. The central contribution is not merely a tool for URL analysis, but a scalable, adaptive framework for pattern discovery in any domain characterized by large-scale vector data, rich metadata, and skewed, dynamic query patterns [3,8,10].

6. Conclusions and Future Work

This paper introduced PhishCluster, a holistic system engineered to address the critical challenge of real-time malicious campaign discovery from high-velocity streams of URL embeddings. PhishCluster addresses the gaps in prior work through a novel two-phase architecture that integrates a large-scale ANN index as an algorithmic accelerator for its online summarization component and leverages the power of hierarchical density-based clustering for its on-demand analysis component. Through a comprehensive experimental evaluation, we demonstrated that this synergistic design provides significant, compounding benefits. The ANN acceleration yielded an order-of-magnitude improvement in throughput, making real-time processing at scale feasible. The use of HDBSCAN on micro-cluster summaries resulted in state-of-the-art clustering quality, enabling the accurate identification of campaigns with varying densities and arbitrary shapes. Our work proves that by architecting a system that resolves the inherent trade-off between speed and quality, it is possible to build a highly performant, scalable, and effective platform for the next generation of automated threat intelligence.

Several promising avenues for future research remain:

• Adaptive Hyperparameter Tuning: Future work could explore a meta-learning framework that monitors the statistical properties of the incoming data stream and dynamically adjusts key parameters to maintain optimal performance in a non-stationary environment.
• Hybrid Data Clustering: An extension could incorporate the rich structured metadata available from the ingestion pipeline. This would involve modifying the offline clustering stage to use a hybrid distance metric that considers both semantic and attribute similarity, similar to the approach for hybrid queries in ANN systems [8].
• Distributed PhishCluster: Future research could explore a distributed version of PhishCluster, investigating strategies for intelligent data partitioning and federated query and clustering execution. This could also enable privacy-preserving analysis, where multiple organizations could collaboratively build a global campaign model without sharing their raw, sensitive URL data.