Machine learning approaches for phishing detection and cybersecurity awareness in digital infrastructure

Abstract

Phishing remains a dominant socio-technical threat to digital infrastructure, serving as an entry vector for credential-theft, ransomware, and supply-chain incidents. The machine learning literature on phishing-URL detection remains fragmented across heterogeneous datasets, inconsistent leakage controls, and explanation pipelines seldom cross-validated by independent attribution methods. An end-to-end, leakage-controlled machine learning framework was developed over a balanced corpus of 11,430 instances and 87 engineered URL-lexical, HTML-content, and external-reputation features, with all preprocessing transforms fit on the training partition only. Eleven heterogeneous classifiers were benchmarked; the best classical model (LightGBM) was repurposed as a deterministic feature extractor whose out-of-fold posterior probabilities augmented the input to a hybrid CNN-BiLSTM. Statistical significance was assessed via Wilcoxon signed-rank tests with Holm-Bonferroni correction on 10-fold cross-validation F 1 scores, and two explainable-AI methods (Tree SHAP and Permutation Importance) were applied alongside ablation studies. LightGBM attained F 1 = 0.9699 and AUC = 0.9943, significantly outperforming every other classifier ( p ≤ 0.002) except XGBoost ( p = 0.375). The CNN-BiLSTM hybrid attained F 1 = 0.9652 and recall = 0.9703. SHAP and Permutation Importance agreed on 11 of 15 top-ranked features, separating external-reputation indicators (Google indexing, page rank, domain age, web traffic) from URL-lexical complexity indicators (length, dots, hyphens, phishing hints). Strict leakage control confirms that the attainable performance is intrinsically high rather than artifactual. The convergent dual-method explanations translate into six candidate cybersecurity-awareness guidelines for end-user training, connecting technical detection to the human factors that shape enterprise security posture.