A Hybrid Machine Learning and Rule-Based Approach for Phishing Website Detection Using URL Features

Abstract

Phishing attacks are considered one of the highest risks to cybersecurity, as they exploit users by pretending to be a valid site and gaining access to sensitive data. Traditional methods of detection, including blacklist-based systems, cannot uncover newly created phishing sites (zero-day attacks), need regular updates to their databases, and can generally not offer real-time protection. The paper suggests implementing a hybrid phishing site detection system involving machine learning with rule-based analysis to improve the accuracy and reliability of detection. The model proposed employs feature extraction using URLs, such as lexical and structural features like URL length, frequency of special characters, use of IP addresses, and occurrence of suspicious keywords. Three supervised machine learning algorithms, Support Vector Machine (SVM), Random Forest (RF), and Logistic Regression, where RF was indicated to achieve the highest performance. Moreover, a rule-based system of brand impersonation detection is also implemented to make the system resistant to targeted phishing attacks. Experimental findings prove that the hybrid methodology enhances classification accuracy and lowers false negatives compared to conventional ones. The proposed hybrid model represents an accuracy of 96%, with a recall of 94% and F1 of 95% ; it can be deployed in real-time and gives interpretable results by using confidence scoring. The solution suggested is a feasible and effective method of phishing detection and can be expanded to more sophisticated intelligent cybersecurity systems.