Adversarial Robustness in URL-Based Phishing Detection: Problem-Space Evaluation and Robust Feature Engineering

Abstract

Machine learning has become a widely adopted approach for URL-based phishing detection, with many studies reporting F1 scores exceeding 0.95 on benchmark datasets. However, recent adversarial machine learning research has questioned the robustness of these models, suggesting that small input perturbations can severely degrade detection performance. In this study, we argue that a substantial part of this reported vulnerability stems from the way adversarial attacks are evaluated. Specifically, many existing studies assess attacks in the feature space, where feature values are modified directly without ensuring that the resulting samples correspond to valid, functional URLs. To investigate this issue, we conduct a two-stage empirical study using both a benchmark feature dataset and a dataset of real phishing URLs. Crucially, to avoid confounding the attack space with dataset differences, we additionally evaluate both feature-space and problem-space attacks on the same real-URL dataset, using an identical model and manipulable-feature budget. Our experiments reveal a striking contrast between these evaluation settings. While feature-space attacks reduce the detection rate of a Random Forest classifier on the benchmark dataset from 0.96 to 0.36, analogous manipulations performed on real URLs have almost no effect on detection performance, as the most informative signals originate from host-related attributes that are difficult for attackers to manipulate. Building on this observation, we propose a set of robust features that capture stable domain characteristics, including lexical word validity, homoglyph disguises, brand impersonation, subdomain depth, character entropy, and transport-related signals. Incorporating these features substantially improves robustness under adversarial conditions, maintaining phishing detection rates between 0.24 and 0.76 where the lexical-only baseline deteriorates to zero under a non-adaptive attacker, while also increasing the clean-data F1 score from 0.985 to 0.994. We further evaluate an adaptive attacker that explicitly targets the proposed features; although the proposed representation raises the attacker’s cost and helps under moderate attacks, host-derived features remain the only strictly attack-invariant component, so we position the proposed features as a complement to host-based signals rather than a standalone defense. Additional analyses, including model comparison, hyperparameter sensitivity analysis, feature ablation, SHAP-based interpretation, multi-seed confidence intervals, a domain-disjoint evaluation, and host-only evaluation, consistently support the proposed approach. The findings demonstrate that problem-space evaluation provides a more realistic assessment of adversarial robustness than conventional feature-space testing and show that robust feature engineering offers a practical strategy for developing phishing detection systems that remain effective under realistic adversarial conditions.