Real-Time Phishing Campaign Detection for Healthcare Organizations: An Explainable AI Approach Using Semantic Clustering
Georgios Feretzakis, Dimitrios Karapiperis, Sarandis Mitropoulos · Studies in health technology and informatics · 2026
Healthcare organizations face escalating phishing threats that exploit medical terminology and patient trust. We present PhishCluster-Health, a healthcare-focused specialization of the PhishCluster framework that combines transformer-based semantic embeddings (all-MiniLM-L6-v2) with density-based streaming clustering for detecting coordinated phishing campaigns targeting healthcare infrastructure. The healthcare specialization contributes (i) a curated seed lexicon of medical and insurer brand terms, (ii) a domain-centric tokenizer that emphasizes brand-impersonation signals, and (iii) distance thresholds calibrated on a held-out healthcare subset. On an in-distribution benchmark of 10,011 URLs (1,511 malicious URLs across 127 healthcare-targeted campaigns and 8,500 benign URLs), PhishCluster-Health attains 100% campaign-level recall with Adjusted Rand Index (ARI) = 1.0 and Normalized Mutual Information (NMI) = 1.0 at 9.76 ms mean latency per URL. These figures reflect the benchmark distribution and require external validation; compromised-legitimate-domain and domain-generation-algorithm (DGA) scenarios are discussed as known limitations. A SHAP analysis of a complementary Random Forest classifier, used as an interpretability proxy, indicates that domain structural patterns account for 66.8% of feature importance.