Jul 2026· Computer and Decision Making: An International Journal· Vol 3, pp. 859-875· 2 citations
TL;DR
Results demonstrate the promise of the unified, interpretable approach in advancingadaptive and trustworthy generalized phishing detection systems and integrate interpretability into model decisions using Explainable AI, particularly SHapley Additive exPlanations.
Abstract
Phishing remains one of the most pervasive cybersecurity threats, exploiting humanand technical vulnerabilities and targeting users through deceptive Emails,URLs, and SMS messages. Artificial Intelligence (AI) and Machine Learning (ML)techniques have been widely used to improve phishing detection accuracy. However,most existing studies have focused on specific data types, thereby limitingthe scope of their applicability, and lacking a generalized framework integratingheterogeneous data sources within phishing context. In this study, we propose ageneralized phishing detection framework that leverages classical machine learning(Random Forest and Logistic Regression) and deep learning (ConvolutionalNeural Network) to identify phishing attempts across heterogeneous textual data,such as Emails, URLs, and SMS messages. Moreover, we integrate interpretabilityinto model decisions using Explainable AI, particularly SHapley Additive exPlanations(SHAP), to enhance transparency and trustworthiness. The framework isevaluated based on both predictive performance and inference efficiency. Experimentalresults show that Random Forest achieves the highest accuracy (93%)and F1-score (85%), highlighting the efficiency of the classifier on tabular data forthe binary classification task at hand, while SHAP local and global explanationsreveal semantically relevant features influencing model decisions, where wordssuch as “admin” and “login” are identified as strong phishing indicators. These resultsdemonstrate the promise of our unified, interpretable approach in advancingadaptive and trustworthy generalized phishing detection systems.
Phishing attacks have become increasingly sophisticated, exploiting techniques such as URL manipulation, certificate authority abuse, and misleading hyperlinks to evade traditional security mechanisms. Although machine learning models have demonstrated high effectiveness in phishing detection, many rely on benchmark datasets that emphasize performance over real-world applicability and lack interpretability. This paper proposes an interpretable phishing detection model utilizing structured multi-feature representations and ensemble learning. The term "hybrid" in this study refers to the integration of multiple feature sources, including URL-based, domain-based, and behavioral features, rather than combining multiple classifiers. A Random Forest classifier was developed using the UCI Phishing Websites dataset (11,055 samples) which contains 30 structural features. The proposed model utilizes all three types of indicators: URL-based, domain-based, and webpage behavior indicators, and allows for fast feature importance analysis. The proposed model's experimental results demonstrated an accuracy of 96.9%, a recall of 97.9%, and an Area Under the Curve (AUC) of 0.99 when tested against unseen data. Feature importance analysis demonstrated that the presence or absence of Secure Sockets Layer (SSL) validation status and the structure of a hyperlink were key indicators of phishing. External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed model is reliable. Therefore, these results demonstrate that the proposed method provides a balance between model performance, interpretability, and the practicality of deployment.
In the technology era, Phishing has continued to be a great challenge within the cybersecurity and web security landscape. This involves exploiting human trust on any online services and subtle technical flaws. This is to gather credentials, financial data, and sensitive information across diverse online platforms and various users. Traditional defenses like static blacklists, signature-based filters and simple detection rules are limited by slow update cycles and an inability to capture subtle syntactic and behavioral cues. To address these shortcomings, we propose a hybrid detection framework that fuses classical supervised machine-learning classifiers (e.g., Logistic Regression, SVM, Random Forest, XGBoost) with sequence-aware deep learning (LSTM) to jointly model lexical, structural, syntactic, and behavioral features extracted from URLs and webpage metadata. This combined approach leverages the interpretability and stability of ML models alongside the pattern-learning strength of LSTMs to detect both known and zero-day phishing attempts, produce calibrated confidence scores and deliver comprehensive reports via a real-time web interface resulting in a robust, transparent, and operationally useful solution for strengthening web security.
M. Yaswanth, Pathan Basheer Khan, Dhulipalla Naga Harish et al.· 2026 7th International Confe...· 0 citations
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
K. Shrinivas, B. Karthick, M. MuthukaruppanKN et al.· International Conference on...· 0 citations
Phishing attacks remain a major cybersecurity threat, with the Anti-Phishing Working Group
(APWG) recording 989,123 attacks in the fourth quarter of 2024 alone. Existing anti-phishing
solutions are constrained by high false positive rates, reliance on static blacklists that cannot
detect new phishing sites, and a lack of explainability in classification decisions. This study
developed and evaluated an Explainable Ensemble Artificial Intelligence Framework for Real
Time Phishing Website Detection. The proposed framework combined three base classifiers
operating in parallel — a character-level 1D Convolutional Neural Network (CNN), a Random
Forest (RF), and an Extreme Gradient Boost (XGBoost) — whose outputs were combined by a
Logistic Regression meta-learner using a five-fold Out-of-Fold cross-validation strategy. Twenty
URL features were extracted across Lexical, Character-based, Domain-based, and Binary
categories. The framework was trained and evaluated on a stratified sample of 50,000 URLs from
the Kaggle Phishing Site URLs dataset, split 70/15/15 for training, validation, and testing.
SHapley Additive exPlanations (SHAP) were integrated to provide feature-level justification for
every classification decision. The proposed ensemble achieved 97.48% accuracy, 98.43%
precision, 96.51% recall, 97.46% F1-Score, and AUC-ROC of 0.9956, outperforming all
individual base classifiers. The false positive rate of 2.43% directly addresses the primary
weakness of existing systems. Suspicious Keywords Score, Special Character Ratio, and Domain
Entropy Score were identified as the three most discriminating features. The framework was
deployed as a real-time desktop application, correctly classifying a phishing URL at 99.7%
confidence.
F. J. Boniface· International Journal of Com...· 0 citations
A hybrid phishing detection framework that integrates three complementary techniques: DistilBERT for semantic analysis of URL text, Graph Neural Networks for modelling structural relationships among URL components, and LightGBM for efficient metadata-based feature classification is proposed.
Ms. I. Shalini, Ms. G. Sujini· International Journal for Re...· 0 citations
The multi-modal approach improves accuracy, reduces mistakes, and adapts better to new phishing methods, and performs better than single-method systems and has strong potential for future improvement.
R. Paper, Wong Ki Hurn, T. Yan et al.· International Journal of Eme...· 0 citations