Adaptive Phishing URL Detection Using Hybrid Fuzzy C-Means Clustering and XGBOOST

Abstract

Phishing attacks continue to evolve in sophistication, rendering static detection methods increasingly ineffective. Existing URL-based approaches suffer from limited adaptability to emerging phishing patterns, mislabeled training data, and insufficient validation protocols. This paper proposes a hybrid phishing URL detection system that integrates Fuzzy C-Means (FCM) clustering with XGBoost classification, enhanced by a novel Micro Adaptive Feature Extractor (MAFE). The system employs a multi-stage pipeline: feature engineering generating 36 statistical and interaction features, MAFE producing 15 adaptive features through class-aware dynamic weighting, micro-pattern detection, and entropy analysis, and FCM with K=2 clusters providing soft membership features to XGBoost. A two-pass confidence-based mislabel detection protocol identifies and removes 2.66% suspected labeling errors from the training data. The system is evaluated on the large-scale DEPHIDES dataset of 5,202,841 URLs using a proper three-way split: 60% training, 10% validation, and 30% test. The classification threshold is optimized exclusively on the validation set, ensuring unbiased test evaluation. The proposed system achieves 97.86% accuracy and 99.84% AUC on the raw test set, improving to 98.98% accuracy after verified mislabel removal. Comparative evaluation demonstrates that the system outperforms Random Forest 95.91%, LightGBM 96.31%, CatBoost 95.75%, and standalone XGBoost 96.59% trained on identical data with the same evaluation protocol. The system processes URLs at 6,528 URLs/second, with 95% confidence intervals of 97.77%–97.96% for accuracy. A sensitivity analysis confirms robustness to the MAFE adaptation rate parameter, with accuracy varying by only 0.06% across α ∈ [0.05, 0.30].