SHAP-HSE: An Explainable Hybrid Stacking Ensemble Model for HTML Phishing Detection

Abstract

Phishing webpages remain one of the serious cybersecurity threats because they imitate legitimate websites and steal sensitive user information through malicious HTML structures, scripts, and obfuscated content. Traditional phishing detection methods, such as blacklist-based and heuristic approaches, have limited ability to detect sophisticated zero-day phishing attacks. Recent machine learning and deep learning models improve detection performance. However, existing approaches provide limited explainability, insufficient content analysis, and do not employ robust hybrid ensemble models. This paper proposes SHAP-HSE, an explainable hybrid stacking ensemble model for HTML phishing detection using the CIC-Trap4Phish 2025 dataset. It includes three phases: 1) data preprocessing, 2) SHAP-HSE model construction, and 3) performance evaluation. During preprocessing, missing values are analyzed, leakage features are removed, data are normalized, and important features are selected using SHAP to improve data quality. The model construction phase combines ExtraTrees, XGBoost, CatBoost, and LightGBM through a Logistic Regression meta-learner. Experimental results show that SHAP-HSE achieves an accuracy of 94.8%, an F1-score of 0.9472, a precision of 0.9618, and a recall of 0.933. These results confirm that the proposed model provides reliable classification and detects complex HTML phishing webpages in an accurate manner.