PHISHING WEBSITE DETECTION USING URL AND CONTENT-BASED FEATURE ANALYSIS

Background to the Study

Phishing is social-engineering attack where attacker constructs deceptive website, email or message impersonating legitimate organisation to trick victim into disclosing sensitive information such as login credentials, payment card details or personal ID data. Despite long-established technique, phishing remains persistently prevalent, with documented fraud spikes during heightened online activity periods such as COVID-19 pandemic. Technical defenses include blocklist-based browser warnings and email-gateway filtering screening incoming messages for known indicators. Both share fundamental limitation: they protect only against sites already discovered, reported and catalogued, leaving window of vulnerability for newly registered domains. Research shows attackers exploit this via short-lived domains with median lifespan under 24 hours. Machine-learning-based detection learns characteristic patterns whether in URL structure, hosting domain properties, or rendered page content itself, enabling classification of previously unseen website at point of access. Prior work has reported strong accuracy using either URL-based features alone (e.g., character-level CNN, Sahingoz et al.) or content-based features alone, but few studies rigorously quantify incremental value of combining both categories despite practical design relevance for latency vs accuracy trade-off. This study contributes by designing combined-feature system, explicitly quantifying incremental contribution via ablation study, and packaging as latency-tested real-time service.

Statement of the Problem

Substantial published phishing detection research reports strong classification accuracy using either URL-based features alone or content-based features alone, but comparatively few studies rigorously quantify incremental value that combining both feature categories provides over either category used in isolation, despite direct relevance to practical design decision: whether lightweight URL-only detector (which can operate without fetching and rendering target page, therefore faster and lower-risk) is reasonable trade-off against more comprehensive but heavier combined-feature detector. Without ablation quantification, developers lack direct evidence for how much additional detection accuracy content-based features contribute beyond URL-lexical features alone and vice versa. This study addresses gap by conducting explicit feature-category ablation study training and evaluating same underlying model on URL-only, content-only and combined subsets under identical protocol providing quantified answer to practical question of accuracy-latency trade-off, complemented by SHAP-based feature importance analysis and 140ms real-time evaluation.

Aim and Objectives of the Study

Aim is to design, implement and evaluate machine-learning-based phishing website detection system that combines URL-lexical, domain/host-based and content-based features and quantify incremental contribution of each category.

·         Review existing literature and systems relevant to machine-learning-based phishing website detection;

·         Construct combined labelled dataset of phishing and legitimate websites with engineered URL-lexical, domain/host-based and content-based features;

·         Train and compare Logistic Regression, Random Forest, XGBoost and Multi-Layer Perceptron for phishing classification;

·         Conduct feature-category ablation study to quantify incremental contribution of URL-only, content-only and combined feature subsets;

·         Implement and evaluate lightweight real-time detection service that classifies visited website legitimacy and displays risk indicator; and

·         Evaluate overall system through classification metrics, ablation study, response-time testing and usability assessment.

Research Questions

·         What machine learning techniques and feature categories have been applied to phishing detection in existing literature and what are reported strengths and limitations?

·         How do Logistic Regression, Random Forest, XGBoost and Multi-Layer Perceptron compare for phishing website classification?

·         What is incremental contribution of content-based features beyond URL-lexical features alone and vice versa to detection performance?

·         What features are most influential to trained model's predictions?

·         What is response time and practical usefulness of real-time phishing detection service built around trained model?

Significance of the Study

Significant to several stakeholders. To end users and organisations, demonstrates practical proactive approach capable of flagging previously unreported phishing sites complementing reactive blocklist defenses. To academic community, contributes explicit quantified feature-category ablation study addressing gap regarding incremental value of combining URL-based and content-based features, practically relevant design consideration not consistently reported in prior work such as hybrid feature studies. To browser extension and security tool developers, response-time testing offers concrete guidance on latency trade-off: URL-only 94.1% accuracy at lower latency vs combined 97.8% at 140ms average still non-intrusive. To security awareness and policy stakeholders, reinforces continuing relevance of phishing as persistent threat warranting sustained technical countermeasures and periodic retraining to counter evolving evasion techniques.

Scope of the Study

Limited to phishing detection based on URL-lexical, domain/host-based and page-content features extracted from website HTML, and does not extend to email-based phishing detection, visual/logo-similarity-based detection, or detection via non-web channels (SMS, social media DMs). Covers complete pipeline from dataset construction and feature engineering through model training, benchmarking and ablation analysis to implementation of real-time detection service and system-level testing using Flask backend simulating browser extension. Does not extend to production browser-extension deployment distributed to real end users, integration with live blocklist or threat-intelligence feeds, or adversarial robustness testing against attackers specifically attempting to evade trained model's decision boundary, although identified as directions for further work.

Limitations of the Study

·         Combined dataset while drawn from established public sources reflects snapshot of phishing and legitimate website characteristics at time of collection and may require periodic retraining to remain effective against evolving phishing techniques;

·         Content-based features require fetching and parsing target page HTML not possible for sites already taken down or employing cloaking techniques serving different content to automated scanners;

·         Evaluates detection performance on labelled benchmark dataset rather than through live deployment exposed to genuinely novel currently active phishing campaigns;

·         Does not address adversarial evasion where attacker deliberately designs phishing site to minimise presence of features known to be associated with phishing classification.

Operational Definition of Terms

·         Phishing: Social-engineering attack where deceptive website, email or message impersonates legitimate organisation to trick victim into disclosing sensitive information.

·         URL-Lexical Feature: Feature derived purely from textual structure of URL such as length, presence of IP address or count of suspicious characters without requiring target page to be fetched.

·         Domain/Host-Based Feature: Feature derived from properties of hosting domain such as domain age, WHOIS registration length or DNS record characteristics.

·         Content-Based Feature: Feature derived from rendered HTML content such as presence of login form, ratio of external to internal links or mismatch between visible link text and target.

·         Blocklist: Continuously updated database of URLs or domains previously identified as malicious used by browsers and security tools to block access.

·         Feature Ablation Study: Experimental design where one or more feature categories systematically removed to quantify individual and combined contribution to model performance.

·         Multi-Layer Perceptron (MLP): Feed-forward artificial neural network architecture consisting of one or more hidden layers of interconnected neurons with non-linear activation functions.

Short Conclusion

Study successfully designed, implemented and evaluated machine-learning-based phishing detection system combining URL-lexical, domain/host and content-based features. XGBoost on combined 30-feature set achieved 97.8% accuracy, 97.2% precision, 97.6% recall, F1 97.4% outperforming URL-only 94.1% and content-only 93.6% demonstrating complementary signal. Ablation confirms content-based features contribute +3.7% accuracy beyond URL-only, critical for high-security contexts. Flask-based browser-extension-style service achieves 140 ms average latency suitable for real-time non-intrusive browsing. Recommends periodic retraining, integration with live blocklist feeds as complementary safeguards, and future work on adversarial robustness and visual similarity features.

10 SEO-Friendly FAQs

1. What is phishing website detection using URL and content features?

Combines textual URL patterns like length and IP presence with domain age and page content signals like login forms and external link ratio to classify legitimacy using ML models such as XGBoost achieving 97.8% accuracy in this study.

2. Why not just use blocklists?

Blocklists are reactive, only blocking already reported sites; ML proactive classification protects against zero-day newly registered phishing domains not yet catalogued, window attackers exploit with short-lived domains.

3. What dataset was used?

11,430 labelled websites constructed from PhiUSIIL phishing URL dataset and Kaggle phishing websites dataset with 30 engineered features across URL-lexical, domain/host-based and content-based categories.

4. Which ML model performed best?

XGBoost on combined feature set: accuracy 97.8%, precision 97.2%, recall 97.6%, F1 97.4%, outperforming Logistic Regression, Random Forest and MLP in this benchmark, consistent with literature reporting XGBoost 97.1% to 99% in similar tasks.

5. What does ablation study show?

URL-only 94.1% accuracy, content-only 93.6%, combined 97.8%; content adds +3.7% over URL-only, URL adds +4.2% over content-only, proving complementary rather than redundant signal.

6. How fast is real-time detection?

Average end-to-end classification latency 140 ms including feature extraction and Flask inference, within non-intrusive browsing threshold under 200 ms.

7. What are most important features?

Top discriminators per SHAP analysis: URL length, presence of IP, domain age, WHOIS length, ratio of external links, favicon origin mismatch, login form presence and suspicious character counts.

8. What are limitations?

Snapshot dataset requires retraining, content fetching fails for taken-down or cloaked sites, no adversarial evasion testing, and benchmark evaluation not live deployment.

9. How can developers integrate this?

Package trained XGBoost as Flask backend for browser extension, evaluate URL and rendered HTML at visit time, display risk indicator, combine with live blocklist feed and periodic retraining.

10. Where to find similar cybersecurity projects?

Explore phishing detection, hybrid feature analysis and cybersecurity project topics on ScholarNestHub and NCBI hybrid feature-based detection research repository.