An Explainable Hybrid Model for Real-Time Phishing Detection Using Multi-Source Features

Abstract

Phishing attacks have become increasingly sophisticated, exploiting techniques such as URL manipulation, certificate authority abuse, and misleading hyperlinks to evade traditional security mechanisms. Although machine learning models have demonstrated high effectiveness in phishing detection, many rely on benchmark datasets that emphasize performance over real-world applicability and lack interpretability. This paper proposes an interpretable phishing detection model utilizing structured multi-feature representations and ensemble learning. The term "hybrid" in this study refers to the integration of multiple feature sources, including URL-based, domain-based, and behavioral features, rather than combining multiple classifiers. A Random Forest classifier was developed using the UCI Phishing Websites dataset (11,055 samples) which contains 30 structural features. The proposed model utilizes all three types of indicators: URL-based, domain-based, and webpage behavior indicators, and allows for fast feature importance analysis. The proposed model's experimental results demonstrated an accuracy of 96.9%, a recall of 97.9%, and an Area Under the Curve (AUC) of 0.99 when tested against unseen data. Feature importance analysis demonstrated that the presence or absence of Secure Sockets Layer (SSL) validation status and the structure of a hyperlink were key indicators of phishing. External validation against ten official Iraqi university websites resulted in correct classification with no false positives, demonstrating that the proposed model is reliable. Therefore, these results demonstrate that the proposed method provides a balance between model performance, interpretability, and the practicality of deployment.