An Explainable Machine Learning Framework for Phishing Website Detection Using URL and Network Features

Abstract

Phishing websites represent a pervasive cyber threat engineered to harvest credentials through deceptive web infrastructure. While machine learning enables proactive detection beyond signature blacklists, operational deployment is hindered by model opacity and the latency of external domain inspection. This paper presents an explainable machine learning framework for phishing website detection using 111 structured URL lexical, path, query, and network resolver features on a benchmark corpus of 58,645 URLs. Evaluating five classification architectures across 11,729 held-out test instances with 5-fold cross-validation on the training set, XGBoost achieves superior discrimination, yielding 94.82% accuracy and 95.05% F1-score (5-seed mean: 94.74% ± 0.08% accuracy, 94.98% ± 0.08% F1-score), statistically outperforming Random Forest (p < 0.001, McNemar's test). Tree-based Shapley Additive Explanations (TreeSHAP) applied strictly to training data ensure train-only attribution, revealing high ranking stability under retraining and identifying directory length, domain registration age, and delimiters as primary discriminators. Feature reduction demonstrates that a compact top-20 subset preserves full test performance while lowering model inference latency to 1.67 ms per 1,000 queries. Furthermore, an uncertainty-gated cascade resolves 64.3% of URLs in-memory with 97.78% accuracy using zero-network lexical parsing, establishing an operationally viable tiered triage architecture that eliminates nearly two-thirds of external resolver lookups.