arXiv:2604.25512v3 Announce Type: replace
Abstract: In phishing detection, machine learning classifiers act as a first line of defense, but the false positives they produce are triaged by human analysts. The excessive false alarms cause alert fatigue that erodes human oversight. We propose CoGReV, a hybrid framework that augments standard machine learning classifiers with a post-hoc non-monotonic reasoning layer implemented in Answer Set Programming. The layer applies a confidence-gated defeasible rule that revises a phishing prediction toward legitimate only when website metadata is present and the classifier's decision is low-confidence, deferring uncertain predictions to the reasoning layer while leaving out confident decisions to the classifiers. This gating acts as a function-allocation mechanism between the classifier and the reasoning layer. Unlike an ungated rule, which reduces false positives only by discarding genuine detections and degrades phishing recall by about nine percentage points, the proposed gated rule keeps recall within 0.7 percentage points of the no-revision baseline for all classifiers while revising only 0.27 percent of decisions. By lowering false alarms, without sacrificing detection, CoGReV reduces analysts alert fatigue and integrates new domain knowledge into the reasoning layer in $\mathcal{O}(n)$ time.
Abstract: In phishing detection, machine learning classifiers act as a first line of defense, but the false positives they produce are triaged by human analysts. The excessive false alarms cause alert fatigue that erodes human oversight. We propose CoGReV, a hybrid framework that augments standard machine learning classifiers with a post-hoc non-monotonic reasoning layer implemented in Answer Set Programming. The layer applies a confidence-gated defeasible rule that revises a phishing prediction toward legitimate only when website metadata is present and the classifier's decision is low-confidence, deferring uncertain predictions to the reasoning layer while leaving out confident decisions to the classifiers. This gating acts as a function-allocation mechanism between the classifier and the reasoning layer. Unlike an ungated rule, which reduces false positives only by discarding genuine detections and degrades phishing recall by about nine percentage points, the proposed gated rule keeps recall within 0.7 percentage points of the no-revision baseline for all classifiers while revising only 0.27 percent of decisions. By lowering false alarms, without sacrificing detection, CoGReV reduces analysts alert fatigue and integrates new domain knowledge into the reasoning layer in $\mathcal{O}(n)$ time.
This article has been indexed from cs.AI updates on arXiv.org
Read the original article: