Exploring feature engineering and explainable AI for phishing website detection: a systematic literature review

Due to the onset of the pandemic in previous years, industries have shifted to the use of digitalized services. Since most transactions were done online, people have become more susceptible to phishing attacks. With this, a steady rise in phishing attacks has been observed. Though cybersecurity awareness can help counter phishing attacks, improvement of existing phishing detection approaches remains desirable. Evolution of phishing websites is inevitable as phishers persist in bypassing current phishing detection approaches. This study then suggests a phishing detection model that makes use of URL-based features to detect phishing websites. Models were developed using two well-known classifiers, XGBoost and Random Forest. XGBoost classifier demonstrated the most promising performance with an accuracy of 96.51% and a kappa of 0.930.

Phishing is an attempt by an individual or a group of person to steal personal information such as password, banking account and credit card information, etc. Most of these phishing web pages look similar to the real web pages in terms of website interface and uniform resource locator (URL) address. Many techniques have been proposed to detect phishing websites, such as Blacklist-based technique, Heuristic-based technique, etc. However, these techniques are still inefficient. While Blacklist-based techniques cannot detect the phishing sites that are not in the blacklist database, the weights of the heuristic in the heuristic-based approach significantly depend on the statistics from the training dataset. Therefore, a new phishing detection approach in which either the new phishing websites can be detected or the weights of the heuristic are derived objectively is necessary. In this paper, an efficient approach for detecting phishing websites based on the single-layer neural network is proposed. Specifically, the proposed technique calculates the value of heuristics objectively. Then, the weights of heuristic are generated by a single-layer neural network. The proposed technique is evaluated with a dataset of 11,660 phishing sites and 10,000 legitimate sites. The results show that the technique can detect over 98% phishing sites.

A phishing attack is a threat based on fraudulent communication, usually by e-mail, where the cybercriminals, impersonating a trusted person or organization, try to lure and coax a target. Phishing detection approaches that obtain highly representational features from the text of these e-mails are a suitable strategy to counter these threats since these features can be used to train machine learning algorithms, thus generating models able to classify mail samples as phishing or legitimate messages. This paper proposes a multi-stage approach to detect phishing e-mail attacks using natural language processing and machine learning. The proposed multi-stage approach consists of feature engineering within natural language processing, lemmatization, feature selection, feature extraction, improved learning techniques for resampling and cross-validation, and the configuration of hyperparameters. We present two methods of the proposed approach, the first one exploiting the Chi-Square statistics and the Mutual Information to improve the dimensionality reduction, while the second method associates Principal Component Analysis (PCA) and Latent Semantic Analysis (LSA). Both methods handle the problems of the “curse of dimensionality”, the sparsity, and the amount of information that must be obtained from the context in the Vector Space Model (VSM) representation. These methods yield reduced feature sets that, combined with the XGBoost and Random Forest machine learning algorithms, lead to an F1-measure of 100% success rate, for validation tests with the SpamAssassin Public Corpus and the Nazario Phishing Corpus datasets. Even considering just the text in e-mail bodies, the proposed multi-stage phishing detection approach outperforms state-of-the-art schemes for an accredited data set, requiring a much smaller number of features and presenting lower computational cost.

Phishing attacks are considered to be one of the most widespread cybersecurity threats, and attackers are becoming more successful by using advances in the field of artificial intelligence and natural language generation, in order to deceive consumers via email, SMS, and web. The existing rule-based and heuristic methods of detection cannot keep up with these dynamic and context-sensitive attacks, hence a high false-negative rate. The given work carries out a critical evaluation of the methods of artificial intelligence (AI), natural language processing (NLP)-based phishing detection, and concentrates on the deep learning, explainable artificial intelligence (XAI) methods. It was selected using IEEE Xplore, Scopus, Web of Science, ACM Digital Library, and ScienceDirect according to the PRISMA guidelines and 45 primary studies published between 2017 and 2025. This paper discusses preprocessing techniques, feature extraction techniques, machine learning, deep learning architectures, hybrid detection models, and explainability mechanisms of phishing detection. The findings indicate that hybrid systems incorporating convolutional neural networks, recurrent models, and transformer-based embeddings are able to perform better than traditional classifiers and are able to achieve over 95% accuracy when using various communication channels. Nevertheless, the majority of high-performing models remain opaque and, therefore, cannot be used in controlled cases. This research reveals the following gaps in research: poor cross-platform generalization, inadequate semantic resistance to paraphrased phishing messages, and a lack of explainability incorporation. The article gives a systematic overview of the current methodologies and gives future research directions in explainable, scalable, and adaptable phishing detection systems.

With increasing technology developments, there is a massive number of websites with varying purposes. But a particular type exists within this large collection, the so-called phishing sites which aim to deceive their users. The main challenge in detecting phishing websites is discovering the techniques that have been used. Where phishers are continually improving their strategies and creating web pages that can protect themselves against many forms of detection methods. Therefore, it is very necessary to develop reliable, active and contemporary methods of phishing detection to combat the adaptive techniques used by phishers. In this paper, different phishing detection approaches are reviewed by classifying them into three main groups. Then, the proposed model is presented in two stages. In the first stage, different machine learning algorithms are applied to validate the chosen dataset and applying features selection methods on it. Thus, the best accuracy was achieved by utilizing only 20 features out of 48 features combined with Random Forest is 98.11%. While in the second stage, the same dataset is applied to various fuzzy logic algorithms. As well the experimental results from the application of Fuzzy logic algorithms were incredible. Where in applying the FURIA algorithm with only five features the accuracy rate was 99.98%. Finally, comparison and discussion of the results between applying machine learning algorithms and fuzzy logic algorithms is done. Where the performance of using fuzzy logic algorithms exceeds the use of machine learning algorithms.

Phishing websites are still a major threat in today's Internet ecosystem. Despite numerous previous efforts, similarity-based detection methods do not offer sufficient protection for the trusted websites, in particular against unseen phishing pages. This paper contributes VisualPhishNet, a new similarity-based phishing detection framework, based on a triplet Convolutional Neural Network (CNN). VisualPhishNet learns profiles for websites in order to detect phishing websites by a similarity metric that can generalize to pages with new visual appearances. We furthermore present VisualPhish, the largest dataset to date that facilitates visual phishing detection in an ecologically valid manner. We show that our method outperforms previous visual similarity phishing detection approaches by a large margin while being robust against a range of evasion attacks.

Phishing website attack, as one of the most persistent forms of cyber threats, evolves and remains a major cyber threat. Various detection methods (e.g., lookup systems, fraud cue-based methods) have been proposed to identify phishing websites. The limitations of lookup systems (e.g., failing to address newly created attacks) and the fraud cue-based methods (e.g., relying on feature engineering) motivated the development of deep representation-based methods capable of learning deep fraud cues for enhanced anti-phishing capacity. Focusing mostly on URLs, these methods fail to analyze other two important modalities of website content: textual information and visual design. Moreover, the interpretability of these deep learning based methods is limited, reducing model trustworthiness and preventing relevant and actionable intelligence. We propose a multi-modal hierarchical attention model (MMHAM) which jointly learns the deep fraud cues from the three major modalities of website content for phishing website detection. Specifically, MMHAM features an innovative shared dictionary learning approach for aligning representations from different modalities in the attention mechanism. In evaluation experiments, the proposed MMHAM not only learned improved deep cues for enhanced phishing detection, but provided a hierarchical interpretability system from which we could develop phishing threat intelligence to inform phishing websites detection at different levels.

Phishing websites are a problem for cybersecurity because they pretend to be real online services to get sensitive information from users like login details and financial information. The people who make these phishing websites can. Shut them down quickly which makes it hard for traditional methods to detect them. To solve this problem this paper talks about a system that uses machine learning to detect phishing websites by looking at the website address and domain. This way the system can detect phishing websites without having to look at the webpage. The system uses a set of data with 11,055 website addresses and 31 special features to test how well it works. These features look at things like the structure of the website address, who registered the domain and things that might indicate phishing. The system uses two kinds of classifiers Logistic Regression and Random Forest to test how well it can detect phishing websites. The system also uses an ensemble model that combines the results from both classifiers to make the predictions more reliable. The results show that thisensemble model is really good at detecting phishing websites and can balance being precise and catching all the phishing websites. The system is also good at telling the difference between fake websites. The people who made the system also created a user interface that can analyze website addresses in time which makes it more useful and practical. The system is a solution for detecting phishing websites in the real world and can be used in many different situations. Phishing websites are a problem but this system can help solve it. The system uses machine learning and a special ensemble model to detect phishing websites. It is really good, at it. Phishing websites will continue to be a problem. With this system we can detect them more easily. Keywords: Phishing Website Detection, Machine Learning, URL-Based Feature Extraction, Cybersecurity, URL Classification, Random Forest Classifier, Logistic Regression, XGBoost Algorithm, Fusion Model, Soft Voting Ensemble, Attack Type Identification, Credential Phishing, Financial Fraud Detection, ROC Curve Analysis, AUC PerformanceMetric

Abstract—Phishing attacks have evolved beyond deceptive URLs to include malicious emails, QR codes, images, and text, posing serious cybersecurity threats. This research presents a multi-modal phishing detection framework that leverages Princi- pal Component Analysis (PCA) for dimensionality reduction and ensemble learning models—Random Forest and XGBoost—for accurate classification of fraudulent content. The system analyzes diverse inputs, including URLs, QR codes, and textual data, stored and processed through serialized .pkl datasets. Imple- mented using Python and Flask, the framework integrates Ex- plainable AI techniques (SHAP, LIME) for model transparency. Experimental results demonstrate high accuracy, efficiency, and interpretability, offering a scalable solution for detecting phishing threats across multiple digital communication channels. Index Terms—Key words: Phishing Detection, PCA, Random Forest, XGBoost, Explainable AI, QR Code Security, Cyberse- curity, .pkl Datasets.

Due to their damage to Internet security, malware and phishing website detection has been the Internet security topics that are of great interests. Compared with malware attacks, phishing website fraud is a relatively new Internet crime. However, they share some common properties: 1) both malware samples and phishing websites are created at a rate of thousands per day driven by economic benefits; and 2) phishing websites represented by the term frequencies of the webpage content share similar characteristics with malware samples represented by the instruction frequencies of the program. Over the past few years, many clustering techniques have been employed for automatic malware and phishing website detection. In these techniques, the detection process is generally divided into two steps: 1) feature extraction, where representative features are extracted to capture the characteristics of the file samples or the websites; and 2) categorization, where intelligent techniques are used to automatically group the file samples or websites into different classes based on computational analysis of the feature representations. However, few have been applied in real industry products. In this paper, we develop an automatic categorization system to automatically group phishing websites or malware samples using a cluster ensemble by aggregating the clustering solutions that are generated by different base clustering algorithms. We propose a principled cluster ensemble framework to combine individual clustering solutions that are based on the consensus partition, which can not only be applied for malware categorization, but also for phishing website clustering. In addition, the domain knowledge in the form of sample-level/website-level constraints can be naturally incorporated into the ensemble framework. The case studies on large and real daily phishing websites and malware collection from the Kingsoft Internet Security Laboratory demonstrate the effectiveness and efficiency of our proposed method.

The rapid proliferation of artificial intelligence (AI) technologies across various industries and decision-making processes has undeniably transformed the way of approaching complex problems and tasks. AI systems have proven their prowess in areas such as healthcare, finance, and autonomous systems, revolutionizing how decisions are made. Nevertheless, this proliferation of AI has raised critical concerns regarding the transparency, accountability, and fairness of these systems, as many of the state-of-the-art AI models often resemble complex black boxes. These intricate models, particularly deep learning neural networks, harbor non-linear relationships that are difficult for human users to decipher, thereby raising concerns about bias, fairness, and overall trustworthiness in AI-driven decisions. The urgency of this issue is underscored by the realization that AI should not merely be accurate; it should also be interpretable. Explainable AI (XAI) has emerged as a vital field of research, emphasizing the development of models and techniques that render AI systems comprehensible and transparent in their decision-making processes. This paper investigates into the relevance and significance of XAI across various domains, including healthcare, finance, and autonomous systems, where the ability to understand the rationale behind AI decisions is paramount. In healthcare, where AI assists in diagnosis and treatment, the interpretability of AI models is crucial for clinicians to make informed decisions. In finance, applications like credit scoring and investment analysis demand transparent AI to ensure fairness and accountability. In the realm of autonomous systems, transparency is indispensable to guarantee safety and compliance with regulations. Moreover, government agencies in areas such as law enforcement and social services require interpretable AI to maintain ethical standards and accountability. This paper also highlights the diverse array of research efforts in the XAI domain, spanning from model-specific interpretability methods to more general approaches aimed at unveiling complex AI models. Interpretable models like decision trees and rule-based systems have gained attention for their inherent transparency, while integrating explanation layers into deep neural networks strives to balance accuracy with interpretability. The study emphasizes the significance of this burgeoning field in bridging the gap between AI's advanced capabilities and human users' need for comprehensible AI systems. It seeks to contribute to this field by exploring the design, development, and practical applications of interpretable AI models and techniques, with the ultimate goal of enhancing the trust and understanding of AI-driven decisions.

The increasing availability of big data and computational power has facilitated unprecedented progress in Artificial Intelligence (AI) and Machine Learning (ML). However, complex model architectures have resulted in high-performing yet uninterpretable ‘black boxes’. This prevents users from verifying that the reasoning process aligns with expectations and intentions. This thesis posits that the sole focus on predictive performance is an unsustainable trajectory, since a model can make right predictions for the wrong reasons. The research field of Explainable AI (XAI) addresses the black-box nature of AI by generating explanations that present (aspects of) a model's behaviour in human-understandable terms. This thesis supports the transition from oversight to insight, and shows that explainability can give users more insight into every part of the machine learning pipeline: from the training data to the prediction model and the resulting explanations. When relying on explanations for judging a model's reasoning process, it is important that the explanations are truthful, relevant and understandable. Part I of this thesis reflects upon explanation quality and identifies 12 desirable properties, including compactness, completeness and correctness. Additionally, it provides an extensive collection of quantitative XAI evaluation methods, and analyses their availabilities in open-source toolkits. As alternative to common post-model explainability that reverse-engineers an already trained prediction model, Part II of this thesis presents in-model explainability for interpretable computer vision. These image classifiers learn prototypical parts, which are used in an interpretable decision tree or scoring sheet. The models are explainable by design since their reasoning depends on the extent to which an image patch “looks like” a learned part-prototype. Part III of this thesis shows that ML can also explain characteristics of a dataset. Because of a model's ability to analyse large amounts of data in little time, extracting hidden patterns can contribute to the validation and potential discovery of domain knowledge, and allows to detect sources of bias and shortcuts early on. Concluding, neither the prediction model nor the data nor the explanation method should be handled as a black box. The way forward? AI with a human touch: developing powerful models that learn interpretable features, and using these meaningful features in a decision process that users can understand, validate and adapt. This in-model explainability, such as the part-prototype models from Part II, opens up the opportunity to ‘re-educate’ models with our desired norms, values and reasoning. Enabling human decision-makers to detect and correct undesired model behaviour will contribute towards an effective but also reliable and responsible usage of AI.

The number of phishing sites is increasing and becoming a problem. General phishing sites often have very short lives. Phishers are thought to construct phishing sites using tools such as phishing kits. Phishing sites constructed using the same tools have similar website structures. We propose a new method based on the similarity of website structure information defined by the types and sizes of web resources that make up these websites. Our method can detect phishing sites that is not registered with blocklists or do not have similar URL strings with targeting legitimate sites. In addition, our method can identify phishing sites that differed in appearance but have similar website structures. Our method is particularly effective for detecting phishing sites constructed by the same phishers or using the same tools, as our method identifies structural similarity between websites. We conducted an evaluation to confirm the correctness of our assumption using phishing sites constructed using phishing kits and the PhishTank dataset. We found a large number of phishing sites that were structurally similar to phishing sites constructed using phishing kits. We applied our method to web access logs provided by ordinary Japanese citizens, and detected some unknown phishing sites. We have also examined the possibility of improving our method based on the importance of web resources, determined using the number of occurrences in web access logs.

As a new form of malicious software, phishing websites appear frequently in recent years, which cause great harm to online financial services and data security. In this paper, we design and implement an intelligent model for detecting phishing websites. In this model, we extract 10 different types of features such as title, keyword and link text information to represent the website. Heterogeneous classifiers are then built based on these different features. We propose a principled ensemble classification algorithm to combine the predicted results from different phishing detection classifiers. Hierarchical clustering technique has been employed for automatic phishing categorization. Case studies on large and real daily phishing websites collected from King soft Internet Security Lab demonstrate that our proposed model outperforms other commonly used anti-phishing methods and tools in phishing website detection.

This study aimed to develop a robust machine learning-based phishing detection system using algorithms such as K-nearest neighbour (KNN), artificial neural network (ANN), and random forest (RF). It utilised datasets from Ariyadasa et al. (2021) and UNB (2016) to discern patterns distinguishing legitimate from phishing websites. Furthermore, an objective was to integrate the optimal model into a Django-based web application, facilitating real-time phishing detection. A comprehensive literature review on phishing detection techniques was also undertaken. Datasets chosen underwent rigorous pre-processing to address missing values and imbalance. Feature selection was achieved manually and automatically using mutual information classification. Three machine learning algorithms, RF, KNN, and ANN, were explored. Their hyper-parameters were optimised using GridSearchCV. Performance results highlighted RF's accuracy at 99.78%, KNN's at 99.67%, and ANN's at 99.11%. While RF and KNN models perfectly identified legitimate websites, ANN showcased an impeccable detection of phishing websites. The RF model, with the highest accuracy, was integrated into a Django application, providing a user interface for real-time phishing detection. All models exhibited high accuracy rates, demonstrating their efficacy in phishing detection. While RF was integrated into the web application for this study, the choice between models depends on specific user or business requirements and priorities. Feedback mechanisms within the Django application further promise refinement in future recommendations. The study provides a foundational step toward enhancing web safety through effective phishing detection.