SIRA: A Semantic LLM-Based Agent for Interpreting and Detecting Vishing Attacks

Voice phishing has evolved rapidly with the rise of large language models, allowing attackers to create persuasive, context-aware conversations at scale. Traditional machine learning systems struggle to detect these adaptive behaviors, as they rely primarily on superficial acoustic cues or static text classification. To overcome these limitations, this paper introduces SIRA, an LLM-based semantic agent designed to interpret, contextualize, and detect vishing attacks. Unlike previous approaches that treat acoustic and textual signals independently, SIRA combines three complementary layers: (i) semantic reasoning on call transcripts generated by speech-to-text conversion, (ii) evaluation of prosodic and behavioral anomalies, and (iii) generation of human-readable incident reports using structured prompts.We evaluate SIRA using a heterogeneous benchmark comprising real vishing conversations, deceptive speech corpora, and benign telephone interactions. The results show that SIRA systematically identifies manipulation patterns such as urgency, abuse of authority, and financial coercion. The agent achieves a 13.4% improvement in F1-score over the best conventional reference and reduces false positives by 18.7%, demonstrating its ability to maintain robust semantic reasoning under noisy or ambiguous conditions.Beyond detection, SIRA provides interpretable explanations that boost analyst confidence and accelerate decision-making. The study confirms that a single, carefully designed LLM agent can significantly strengthen telecommunications fraud defense, representing a promising step toward AI-assisted operational protection against modern vishing threats.