Phishing Website Detection Using A Stacked Hybrid Model With Explainable AI

Abstract

Phishing attacks have become a critical cybersecurity challenge due to the increasing use of fraudulent websites and malicious URLs to deceive users and obtain sensitive information. Conventional phishing detection approaches such as blacklist-based filtering and static rule-based techniques often fail to recognize newly generated phishing websites because they depend on previously identified threats. To overcome these limitations, this work presents a Phishing Website Detection System Using a Stacked Hybrid Model With Explainable AI, designed to accurately classify websites as phishing or legitimate while providing transparent decision explanations. The proposed framework utilizes a stacking ensemble architecture that combines multiple learning models, including Artificial Neural Network (ANN), Bagging K-Nearest Neighbors (KNN), and Support Vector Machine (SVM), to identify complex patterns from URL-based and website-related characteristics. Logistic Regression is incorporated as a meta-level classifier to combine the predictions of individual models and generate the final classification result. The system uses extracted lexical, structural, and security-related website features to improve detection reliability and enhance model generalization. Furthermore, Explainable Artificial Intelligence (XAI) is integrated through SHAP to analyze the contribution of individual features and provide meaningful explanations behind each prediction. This improves the transparency of the detection process by showing the factors that influence phishing and legitimate classifications. A useroriented detection interface is also developed, allowing users to submit website URLs and receive immediate classification results along with feature-based explanations. Performance assessment of the developed hybrid model is carried out using a publicly available phishing website dataset. Experimental results evaluated using Accuracy, Precision, Recall, and F1-score indicates that the stacked hybrid model provides reliable and consistent identification of phishing websites.