Phishing URL Detection Using TF-IDF Character N-Gram and Complement Naive Bayes

Abstract

Phishing attacks represent a continuously growing cyber threat that exploits social engineering to deceive users, causing significant financial and informational harm worldwide. As phishing URLs are carefully crafted to mimic legitimate websites, they often bypass traditional rule-based or blacklist methods, which can only detect a small fraction of new threats. This study aims to develop an efficient and accurate phishing URL detection system using purely lexical analysis. The methodology employs a dataset of URLs from Kaggle and GitHub, which undergoes validation, normalization, and deduplication. Character-level TF-IDF with an n-gram range of (3,6) was specifically chosen for its superior ability to capture structural anomalies and obfuscation patterns without requiring semantic understanding or access to web page content. Furthermore, Complement Naive Bayes (CNB) was selected for its robust performance on imbalanced datasets, effectively addressing the skewed class distributions typical of web security data. To ensure reliable risk assessment, the model was calibrated using isotonic regression and evaluated through 5-fold stratified cross-validation. The results demonstrate an accuracy of 94.25%, an F1-Score of 0.9263, and an ROC-AUC of 0.9862. These findings are significant as they outperform heavier deep learning architectures while maintaining a much lower computational footprint. This efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.