Aug 2026· Engineering, Technology & Applied Science Research· 0 citations· 19 references
TL;DR
External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed phishing detection model is reliable.
Abstract
Phishing attacks have become increasingly sophisticated, exploiting techniques such as URL manipulation, certificate authority abuse, and misleading hyperlinks to evade traditional security mechanisms. Although machine learning models have demonstrated high effectiveness in phishing detection, many rely on benchmark datasets that emphasize performance over real-world applicability and lack interpretability. This paper proposes an interpretable phishing detection model utilizing structured multi-feature representations and ensemble learning. The term "hybrid" in this study refers to the integration of multiple feature sources, including URL-based, domain-based, and behavioral features, rather than combining multiple classifiers. A Random Forest classifier was developed using the UCI Phishing Websites dataset (11,055 samples) which contains 30 structural features. The proposed model utilizes all three types of indicators: URL-based, domain-based, and webpage behavior indicators, and allows for fast feature importance analysis. The proposed model's experimental results demonstrated an accuracy of 96.9%, a recall of 97.9%, and an Area Under the Curve (AUC) of 0.99 when tested against unseen data. Feature importance analysis demonstrated that the presence or absence of Secure Sockets Layer (SSL) validation status and the structure of a hyperlink were key indicators of phishing. External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed model is reliable. Therefore, these results demonstrate that the proposed method provides a balance between model performance, interpretability, and the practicality of deployment.
A Phishing Website Detection System Using a Stacked Hybrid Model With Explainable AI, designed to accurately classify websites as phishing or legitimate while providing transparent decision explanations, is presented.
A. Mounika, D. Ramakrishna· International Journal for Re...· 0 citations
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
An Explainable Ensemble Artificial Intelligence Framework for Real Time Phishing Website Detection that addresses the primary weakness of existing systems and is deployed as a real-time desktop application.
F. J. Boniface· International Journal of Com...· 0 citations
Phishing attacks continue to pose a significant threat to individuals and organizations, driven by the increasing sophistication of cybercriminal techniques and the rapid expansion of digital services. Traditional detection approaches, such as blacklist-based and rule-based systems, are often ineffective against newly generated or obfuscated phishing URLs. This study proposes a machine learning (ML)-based framework intended for integration within penetration testing environments. The approach leverages multiple supervised learning algorithms, including Random Forest (RF), Support Vector Machine (SVM), and XGBoost, trained and evaluated using the PhiUSIIL Phishing URL Dataset, a large-scale benchmark dataset containing phishing and legitimate URL samples. A comprehensive preprocessing pipeline and feature engineering strategy are employed to enhance model performance. Experimental results demonstrate exceptionally high detection accuracy, with RF and XGBoost achieving near-perfect classification performance across key evaluation metrics, including accuracy, precision, recall, F1-score, and ROC-AUC. The proposed system is further designed for real-time deployment, enabling integration into penetration testing workflows for proactive security assessment. Despite promising results, limitations related to dataset characteristics and real-world generalization are acknowledged. Overall, this research highlights the effectiveness and practical applicability of ML-based approaches in strengthening phishing detection and advancing modern cybersecurity defences.
Ashwag Alotaibi, Mounir Frikha· International Journal of Adv...· 0 citations
Despite advances in machine learning-based phishing detection, existing Artificial Neural Network (ANN) models operate as black boxes with no interpretable explanation of feature interactions—a critical limitation for security analysts. Furthermore, most approaches deploy large feature sets without investigating whether a minimal subset achieves equivalent performance. This study develops a phishing detection system combining ANN with Logic Gate-Based Feature Interaction Modeling (LGFIM), a novel framework that characterizes ANN decisions through AND, OR, and XOR Boolean operations, addressing both accuracy and interpretability gaps. Using the PhiUSIIL dataset (235,795 instances), Pearson correlation identified URLSimilarityIndex (r=0.8604) and HasSocialNet (r=0.7843) as the two most discriminative features. An ANN (2-64-32-16-1, ReLU, Adam) trained on an 80/20 split achieved 99.63% accuracy, 100% recall, 99.68% F1-score, and 99.91% AUC-ROC with zero false negatives. The LGFIM analysis reveals the classification boundary follows a predominantly AND-type Boolean structure: the AND gate achieves 99.67% accuracy against true labels, while ANN predictions align with AND for 42.48% of samples and XOR for 57.52%, together accounting for 100% of all predictions. This is the first study to comprehensively characterize ANN phishing decisions through logic gate interaction patterns, providing a zero-cost interpretability layer for cybersecurity operations.
M. H. Rahman, Z. Abidin, M. A. Hariyadi· G-Tech· 0 citations
Phishing attacks are considered one of the highest risks to cybersecurity, as they exploit users by pretending to be a valid site and gaining access to sensitive data. Traditional methods of detection, including blacklist-based systems, cannot uncover newly created phishing sites (zero-day attacks), need regular updates to their databases, and can generally not offer real-time protection. The paper suggests implementing a hybrid phishing site detection system involving machine learning with rule-based analysis to improve the accuracy and reliability of detection. The model proposed employs feature extraction using URLs, such as lexical and structural features like URL length, frequency of special characters, use of IP addresses, and occurrence of suspicious keywords. Three supervised machine learning algorithms, Support Vector Machine (SVM), Random Forest (RF), and Logistic Regression, where RF was indicated to achieve the highest performance. Moreover, a rule-based system of brand impersonation detection is also implemented to make the system resistant to targeted phishing attacks. Experimental findings prove that the hybrid methodology enhances classification accuracy and lowers false negatives compared to conventional ones. The proposed hybrid model represents an accuracy of 96%, with a recall of 94% and F1 of 95% ; it can be deployed in real-time and gives interpretable results by using confidence scoring. The solution suggested is a feasible and effective method of phishing detection and can be expanded to more sophisticated intelligent cybersecurity systems.
Muna Rashid Hameed· Iraqi Journal for Computers...· 0 citations