TraceScope: Interactive Phishing URL Triage

Paper: 2604.21840 Authors: Research Team Categories: cs.CY, cs.AI

Problem

Security analysts face overwhelming phishing alerts:

• Thousands of URLs to investigate daily
• Limited time per investigation
• Complex indicators that are hard to compare
• Context switching between tools loses track

TraceScope Design

An interactive visual analytics system for phishing triage:

Key Features

1. Unified URL Visualization

   • Visual fingerprints of URL components
   • Pattern highlighting for suspicious elements
   • Comparative view across multiple URLs

2. Progressive Disclosure

   • Quick triage at overview level
   • Drill-down for suspicious items
   • Context preservation across investigation steps

3. Cognitive Load Reduction

   • Batch processing of similar URLs
   • Auto-grouping by threat patterns
   • Keyboard shortcuts for power users

Interface Components

• URL Component Map: Visual breakdown of URL structure
• Threat Timeline: Historical analysis of URL reputation
• Comparison Grid: Side-by-side indicator comparison
• Batch Actions: Apply decisions to groups

Performance

Metric	Baseline (Tool-based)	TraceScope
Investigation Time	5.2 min	2.1 min
Accuracy	87%	94%
Analyst Satisfaction	3.2/5	4.6/5

Takeaways

• Visual analytics can significantly speed up security operations
• Cognitive load reduction is key to handling alert fatigue
• Progressive disclosure balances speed and thoroughness
• Domain-specific UX design matters for security tools