Knowledge-Grounded LLM-Driven Augmentation via Graph RAG for Phishing URL Detection

Integrating prior rule knowledge into generative data augmentation remains an open problem when detectors must generalize under distribution shift. URL-based phishing illustrates this problem at scale. Numerous detection rules have been proposed, yet adversaries continually mutate URL structures, eroding the effectiveness of static rule-based systems and causing the training distribution to drift away from deployment conditions. Although LLM-based augmentation can expand training diversity, unconstrained generation risks producing samples that are structurally plausible but phishing-inconsistent, limiting their utility for detector training. To address these challenges, this study proposes a knowledge-grounded augmentation framework that integrates a phishing rule knowledge graph with Graph Retrieval-Augmented Generation (Graph RAG) and performs LLM-driven URL augmentation, instantiated for phishing URL detection. The system reconstructs prior rule lists and association-rule information into a searchable graph structure and injects them, together with dataset-adjusted risk scores, into LLM prompts to generate structurally plausible phishing URL variants. After syntax validation and deduplication, the resulting samples are used to train a dual-branch detector that combines character-level and word-level URL representations. Experiments on five datasets show that the proposed system achieves consistently strong performance, with the best result of 99.81% accuracy and an F1-score of 0.9970 on DS1. Additional analyses confirm that the generated URLs preserve alignment with the original phishing distribution while providing structural diversity beyond simple replication.