AI-Based Detection of Phishing Websites Using URL and Webpage Features

Abstract

Phishing Web pages are another one of the most prevalent and revenue-generating types of attack, and the constantly changing structural properties of phishing Web pages have sustained the research interest in machine-learning methods that can detect a phishing Web page from URL and webpage features without relying on continually updated blacklists. A supervised machine learning methodology was used for phishing detection in this study, which is based on structural and behavioral webpage features. A dataset with 10,000 legitimate and phishing websites was created based on the publicly available cybersecurity datasets and features from URLs  and webpage structures were extracted such as the length of the URLs , number of special characters, presence of ip-addresses, age of the domain, presence of https, number of external links, redirection behaviour, form-related features. The dataset was split into training and testing sets in an 80:20 ratio, and four algorithms, namely Logistic Regression, Random Forest, Gradient Boosting and Support Vector Machine were trained independently and evaluated by accuracy, precision, recall, F1-score, ROC-AUC and false-positive rate. Afterwards, feature importance analysis was performed to identify the most significant features contributing to detection performance. Random Forest and Gradient Boosting overall classification performance was the highest followed by Support Vector Machine, while Logistic Regression had the lowest (but still reasonably good) performance among the four algorithms; ensemble methods had the lowest false-positive rates. The feature importance analysis for the ensemble models showed that HTTPS status, domain age, IP address in URL, URL length and form-related features were the most important features to predict the phishing status. The results confirm the practical and effective utility of ensemble machine-learning techniques, alongside a small number of easy-to-explain URL and webpage features, for the detection of phishing websites, and have implications for the design of lightweight, real-time anti-phishing systems.