HRIT: A Human-Readable Framework for Phishing URL Detection using Large Language Models

Phishing URL detection remains a persistent cybersecurity challenge due to rapidly evolving adversarial tactics and the inherent limitations of rule-based and traditional machine learning approaches. Although Large Language Models offer promising capabilities in contextual reasoning and natural-language explanation, their effective use for URL-based threat detection is constrained by a semantic mismatch between numeric security features and language-model reasoning. This paper introduces HRIT (Human-Readable Indicator Transformation), a lightweight and model-agnostic framework that transforms structured URL security features into semantically meaningful, human-readable indicators optimized for LLM inference. HRIT enables LLMs to reason about phishing intent using interpretable descriptors derived from statistically validated, dataset-driven, and industry-informed thresholds, without requiring model fine-tuning or retraining. We evaluate HRIT on a balanced phishing URL dataset containing 11,430 samples and compare its performance against a strong Random Forest baseline and multiple LLMs under zero-shot prompting. Experimental results show that HRIT improves detection sensitivity, improving recall and F1-score while maintaining low inference cost and latency. These findings demonstrate that effective phishing URL detection can be achieved through semantic feature transformation rather than complex prompting or model adaptation.