URL Phishing Detection Using Machine Learning: A Feature-Based Classification Approach

Phishing remains a serious and evolving threat, and URL-based detection offers a fast and early line of defence that does not depend on downloading the page. This paper presented a complete machine learning approach: a formal problem definition, a modular system architecture, a documented set of lexical, host-based and keyword features, a comparison of eight classifier families and a rigorous evaluation protocol with stratified cross-validation, imbalance handling and metrics that include the false-positive rate and latency. The discussion of deployment, drift, adversarial behaviour and privacy shows that a useful detector is not only an accurate model but also a maintained, monitored and responsibly used system. Combining URL analysis with complementary signals and regular retraining is the most promising path towards a durable defence against phishing. Four practical lessons follow from the study. First, URL-only features are cheap and informative, but they must be combined, because no single feature is decisive. Second, evaluation must report the false-positive rate and use leakage-free, preferably time-based, splits. Third, the decision threshold should reflect the real cost of each type of error. Fourth, a detector is a living system that needs monitoring, retraining and layered support from other defences.

[1]     Anti-Phishing Working Group, “Phishing activity trends report,”APWG, Lexington, MA, USA. [Online]. Available: https://apwg.org [2]     J. Ma, L. K. Saul, S. Savage, and G. M. Voelker, “Beyond blacklists: Learning to detect malicious web sites from suspicious URLs,” in Proc. 15th ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2009, pp. 1245–1254. [3]     D. Sahoo, C. Liu, and S. C. H. Hoi, “Malicious URL detection using machine learning: A survey,” arXiv:1701.07179, 2017. [4]     T. Berners-Lee, R. Fielding, and L. Masinter, “Uniform resource identifier (URI): Generic syntax,” IETF, RFC 3986, Jan. 2005. [5]     PhishTank, “Join the fight against phishing.” [Online]. Available: https://www.phishtank.com [6]     OpenPhish, “Phishing intelligence.” [Online]. Available: https://openphish.com [7]     S. Garera, N. Provos, M. Chew, and A. D. Rubin, “A framework for detection and measurement of phishing attacks,” in Proc. ACM Workshop Rapid Malcode, 2007, pp. 1–8. [8]     Y. Zhang, J. Hong, and L. Cranor, “CANTINA: A content-based approach to detecting phishing web sites,” in Proc. 16th Int. Conf. World Wide Web, 2007, pp. 639–648. [9]     R. M. Mohammad, F. Thabtah, and L. McCluskey, “Intelligent rule-based phishing websites classification,” IET Inf. Secur., vol. 8, no. 3,pp. 153–160, 2014. [10]  A. Blum, B. Wardman, T. Solorio, and G. Warner, “Lexical feature based phishing URL detection using online learning,” in Proc. 3rd ACM Workshop Artif. Intell. Secur., 2010, pp. 54–60.