Applied Science and Biotechnology Journal for Advanced Research

1. Introduction

1.1 Background and Motivation

The rapid expansion of digital services, cloud computing, online banking, and electronic commerce has fundamentally transformed modern communication and financial transactions. However, this digital transformation has also increased the exposure of individuals and organizations to various cyber threats, among which phishing remains one of the most persistent and financially damaging attack vectors [1], [2]. Phishing attacks exploit social engineering techniques by creating deceptive websites that closely resemble legitimate online platforms, encouraging users to reveal confidential information such as usernames, passwords, financial credentials, and personal identification details. The increasing sophistication of phishing campaigns, combined with the widespread availability of phishing-as-a-service toolkits, has made traditional blacklist-based detection methods increasingly ineffective against newly generated malicious websites [1], [2].

Machine learning has emerged as an effective solution for phishing website detection because it enables automated identification of malicious websites by learning discriminative patterns from historical data [1], [3]. URL-based detection techniques are particularly attractive because they can identify suspicious websites before the webpage is fully rendered, thereby reducing computational overhead and improving response time. Numerous studies have demonstrated that lexical URL features, domain characteristics, and webpage structural information can effectively distinguish phishing websites from legitimate ones [1], [3]. Nevertheless, many existing machine learning approaches employ a large number of handcrafted features, increasing computational complexity while reducing model interpretability. Furthermore, the lack of standardized benchmark datasets has historically made fair comparison among different phishing detection approaches difficult, motivating recent efforts toward establishing reproducible evaluation frameworks [3].

Another important challenge is the lack of explainability in phishing detection models. Modern ensemble learning algorithms, including Random Forest, XGBoost, LightGBM, and CatBoost, achieve excellent classification performance but often operate as black-box models.

1.2 Main Contributions

The primary contributions of this work are summarized as follows:

1. Consensus Feature Selection Framework: We propose a consensus feature selection strategy that combines Recursive Feature Elimination (RFE), Mutual Information (MI), and SHAP explainability. Features selected by multiple independent methods are retained, reducing the original URL feature set from 22 to 10 highly informative features.
2. Lightweight Phishing Detection Model: The proposed framework demonstrates that high phishing detection performance can be maintained using a compact feature set, improving computational efficiency without sacrificing predictive accuracy.
3. Performance-Weighted Consensus Ensemble: We introduce a validation-based probability weighting strategy that combines multiple ensemble classifiers into a unified prediction framework, providing robust performance while remaining computationally efficient.
4. Comprehensive Experimental Evaluation: The proposed approach is extensively evaluated using five-fold cross-validation, SHAP explainability, feature ablation analysis, runtime comparison, calibration assessment, ROC analysis, and Precision–Recall analysis, providing a thorough assessment of model performance and reliability.

1.3 Organization of the Paper

The remainder of this paper is organized as follows. Section 2 reviews the existing literature on phishing website detection, feature selection techniques, ensemble learning methods, and explainable artificial intelligence (XAI) approaches. Section 3 presents the proposed methodology, including data preprocessing, the Consensus Feature Selection (CFS) framework, the Performance-Weighted Consensus Ensemble (PWCE), and the overall phishing detection workflow. Section 4 describes the experimental setup, including the dataset, evaluation metrics, implementation environment, and performance assessment criteria. Section 5 presents the experimental results and discussion, covering feature selection analysis, model comparison, cross-validation, runtime evaluation, explainability using SHAP, feature ablation studies, and comprehensive performance analysis.

Traditional supervised learning algorithms including Decision Trees, Random Forests, Support Vector Machines (SVM), Gradient Boosting, XGBoost, LightGBM, and CatBoost have demonstrated excellent performance across various phishing datasets.

Aburrous et al. proposed one of the earliest intelligent phishing detection systems using fuzzy rule-based classification combined with machine learning techniques to improve website classification accuracy [10]. Sahingoz et al. compared multiple machine learning classifiers using natural language processing and URL lexical features, reporting that ensemble tree-based algorithms consistently outperform conventional classifiers in phishing detection tasks [11].

Recent studies have increasingly adopted gradient boosting algorithms such as XGBoost and LightGBM due to their high predictive performance, computational efficiency, and ability to model nonlinear relationships among phishing indicators. Nevertheless, these approaches frequently employ high-dimensional feature spaces that increase model complexity while offering limited interpretability.

2.3 Deep Learning Approaches

Deep learning techniques have recently emerged as powerful alternatives for phishing detection by automatically extracting hierarchical feature representations from URLs, webpage content, and visual information.

Le et al. introduced URLNet, which combines character-level and word-level embeddings using convolutional neural networks (CNNs) to learn URL representations directly from raw strings without handcrafted features [7]. Similarly, recurrent neural networks (RNNs), Long Short-Term Memory (LSTM) networks, and Transformer-based architectures have been investigated for sequential URL modeling and webpage analysis.

Although deep learning models often achieve competitive detection performance, they typically require large computational resources, substantial training data, and specialized hardware. Furthermore, their black-box nature limits interpretability, making them less suitable for practical cybersecurity applications requiring transparent decision-making.

Although individual feature selection methods have demonstrated promising performance, relying on a single selection criterion may introduce bias. Consequently, integrating multiple independent feature selection strategies provides a more robust mechanism for identifying consistently informative phishing indicators. This observation motivates the consensus feature selection framework proposed in this work, which combines RFE, Mutual Information, and SHAP-based explainability to construct a compact yet highly discriminative URL feature subset.

Recent studies have increasingly adopted gradient boosting algorithms such as XGBoost and LightGBM due to their high predictive performance, computational efficiency, and ability to model nonlinear relationships among phishing indicators [15], [16].

3. Proposed Methodology

3.1 Proposed Methodology

This study proposes an explainable lightweight phishing website detection framework that integrates Consensus Feature Selection (CFS) with a Performance-Weighted Consensus Ensemble (PWCE) to improve phishing website detection while reducing computational complexity. The overall architecture of the proposed framework is illustrated in Figure 1. The framework consists of five sequential stages: (i) data preprocessing, (ii) URL feature extraction, (iii) consensus feature selection, (iv) ensemble model construction, and (v) explainable performance evaluation.

Mutual Information (MI), and SHapley Additive exPlanations (SHAP). Instead of relying on a single feature selection criterion, the proposed framework adopts a consensus voting strategy in which features selected by at least two independent methods are retained. This Consensus Feature Selection (CFS) mechanism improves feature robustness by minimizing the bias associated with individual selection techniques.

The resulting lightweight feature subset is subsequently used to train multiple ensemble learning algorithms, including Random Forest, XGBoost, LightGBM, and CatBoost. The probabilistic outputs of these classifiers are further combined using the proposed Performance-Weighted Consensus Ensemble (PWCE) strategy. Unlike conventional majority voting, PWCE assigns validation performance-based weights to each classifier, allowing stronger models to contribute proportionally more to the final prediction.

Finally, the proposed framework is evaluated using multiple performance metrics, including Accuracy, Precision, Recall, F1-score, and ROC-AUC. To further investigate robustness and interpretability, five-fold cross-validation, SHAP explainability, feature ablation analysis, calibration assessment, runtime evaluation, and learning curve analysis are performed.

The proposed methodology aims to achieve three primary objectives:

• reduce feature dimensionality while preserving predictive performance,
• improve model interpretability through explainable artificial intelligence,
• maintain high phishing detection accuracy with reduced computational complexity suitable for real-time deployment.

3.2 Data Preprocessing

The PhiUSIIL phishing URL dataset contains both categorical and numerical attributes describing lexical URL characteristics and webpage properties. Prior to model development, the dataset was subjected to several preprocessing operations to ensure data quality and consistency.

Using this strategy, the original twenty-two URL features were reduced to a compact subset of ten consensus features while maintaining nearly identical predictive performance.

3.4 Performance-Weighted Consensus Ensemble (PWCE)

Following the Consensus Feature Selection (CFS) stage, the selected feature subset is used to construct the proposed Performance-Weighted Consensus Ensemble (PWCE) for phishing website detection. The objective of PWCE is to combine the strengths of multiple ensemble learning algorithms while assigning higher influence to classifiers that demonstrate superior validation performance.

Unlike conventional majority voting, where each classifier contributes equally to the final prediction, the proposed PWCE employs validation-performance-based weighting. Four ensemble classifiers- Random Forest (RF), XGBoost (XGB), LightGBM (LGB), and CatBoost (CB) are independently trained using the consensus-selected feature subset. Each classifier estimates the posterior probability that a given URL belongs to the legitimate class.

For an instance x, the prediction can be expressed as

Positive SHAP values indicate that a feature increases the probability of classifying a website as legitimate, whereas negative values indicate greater similarity to phishing behavior.

In this study, SHAP serves two complementary purposes.

First, global SHAP feature importance is employed as one component of the proposed Consensus Feature Selection framework. Features consistently receiving high SHAP importance are considered more informative during the voting process.

Second, SHAP summary plots provide visual explanations of feature influence across the entire dataset, enabling identification of the most discriminative phishing indicators. Experimental analysis demonstrates that URLSimilarityIndex, IsHTTPS, and lexical URL characteristics consistently contribute most to the final classification decisions, confirming the effectiveness of the proposed consensus feature selection strategy.

By integrating SHAP into both feature selection and model interpretation, the proposed framework improves transparency without sacrificing predictive performance.

3.6 Computational Complexity Analysis

The computational complexity of the proposed framework is determined by four sequential stages: feature selection, ensemble model training, prediction, and explainability.

The Consensus Feature Selection stage combines Recursive Feature Elimination (RFE), Mutual Information (MI), and SHAP analysis. Mutual Information is computed independently for each feature, resulting in approximately

0 (nm)

where

• n represents the number of samples,
• m denotes the number of features.

Input:

 Dataset D

Output:

  Predicted label ŷ

Step-1. Load dataset D

Step-2. Remove irrelevant attributes

Step-3. Extract URL features

Step-4. Apply Recursive Feature Elimination (RFE)

Step-5. Compute Mutual Information scores

Step-6. Compute SHAP feature importance

Step-7. Perform Consensus Voting

Step-8. Select features with Vote ≥ 2

Step-9. Train Random Forest

Step-10. Train XGBoost

Step-11. Train LightGBM

Step-12. Train CatBoost

Step-13. Compute validation ROC-AUC for each classifier

Step-14. Normalize classifier weights

Step-15. Compute weighted ensemble probability

Step-16. Predict phishing / legitimate label

Step-17. Generate SHAP explanations

Step-18. Evaluate using:

  Accuracy

  Precision

  Recall

  F1-score

  ROC-AUC

Return predicted class.

4. Experimental Setup

4.1 Experimental Environment

The proposed phishing website detection framework was implemented using the Python programming language within the Google Colaboratory (Google Colab) cloud computing environment.

The dataset is relatively balanced, reducing the likelihood of severe class imbalance during classifier training.

Table 2 summarizes the dataset characteristics.

Table 2: Dataset Statistics

4.3 Data Preprocessing

Prior to model training, several preprocessing operations were performed to improve data quality and eliminate irrelevant information.

Initially, non-predictive attributes, including FILENAME, URL, Domain, TLD, and Title, were removed because they function primarily as identifiers rather than discriminative phishing indicators.

The dataset was subsequently examined for missing values and duplicate observations. No missing values or duplicate records were identified, eliminating the need for additional cleaning procedures.

Because the proposed framework primarily employs tree-based ensemble learning algorithms, feature normalization was not performed. Tree-based classifiers partition the feature space using decision rules rather than distance-based computations and are therefore insensitive to feature scaling.

Finally, the dataset was divided using stratified sampling, ensuring that the class distribution remained consistent across training and testing subsets.

4.4 Consensus Feature Selection

To reduce computational complexity while preserving classification performance, the proposed Consensus Feature Selection (CFS) framework was applied.

Three independent feature evaluation techniques were employed:

ROC-AUC

The Receiver Operating Characteristic Area Under the Curve (ROC-AUC) evaluates the classifier's ability to distinguish between phishing and legitimate websites across different decision thresholds. Higher ROC-AUC values indicate better discrimination capability.

4.7 Experimental Protocol

To ensure reliable and unbiased performance evaluation, the following experimental protocol was adopted.

1. The dataset was divided using stratified sampling to preserve class distribution.
2. Consensus Feature Selection was applied using RFE, Mutual Information, and SHAP.
3. Machine learning classifiers were trained using the selected feature subset.
4. Hyperparameters were maintained at commonly adopted values to ensure fair comparison rather than extensive model-specific optimization.
5. Performance was evaluated using Accuracy, Precision, Recall, F1-score, and ROC-AUC.
6. Model robustness was further assessed through five-fold stratified cross-validation.
7. Explainability was investigated using SHAP feature importance and SHAP summary plots.
8. Additional analyses included runtime comparison, calibration analysis, learning curves, confusion matrices, ROC curves, Precision–Recall curves, and feature ablation studies.

5. Results and Discussion

5.1 Performance Comparison of Machine Learning Models

The proposed framework was initially evaluated using six widely adopted machine learning classifiers, namely Decision Tree, Random Forest,

Figure 5: Five-fold cross-validation accuracy comparison.

5.3 ROC and Precision-Recall Analysis

Receiver Operating Characteristic (ROC) analysis was performed to evaluate the discriminative capability of the classifiers over different classification thresholds.

As illustrated in Figure 6, all evaluated models achieved ROC-AUC values exceeding 0.9997, indicating near-perfect separation between phishing and legitimate websites.

Similarly, the Precision–Recall curves presented in Figure 7 confirm the excellent performance of all ensemble classifiers, with Average Precision (AP) values approaching 1.0. Since phishing detection is essentially a binary classification problem where false positives and false negatives are equally important, the Precision–Recall curves further validate the robustness of the proposed framework.

Although the ROC and Precision–Recall curves are visually similar because of the extremely high classification accuracy, these results demonstrate the consistency of the evaluated models under different decision thresholds.

Figure 6: ROC Curve Comparison

Figure 9 shows that both the training accuracy and validation accuracy rapidly converge as the number of training samples increases.

The narrow gap between the two curves indicates excellent generalization capability, while the nearly constant validation accuracy confirms that increasing the training dataset further is unlikely to produce significant improvements.

These observations demonstrate that the proposed consensus feature selection strategy effectively captures the discriminative characteristics required for phishing website detection.

Figure 9: Learning Curve

5.6 Explainability Analysis Using SHAP

To improve the transparency of the phishing detection framework, SHAP analysis was performed on the final model.

Figure 10 illustrates the global feature importance obtained from SHAP values.

The results indicate that URLSimilarityIndex is the most influential feature, contributing more than half of the overall model importance. IsHTTPS is identified as the second most influential predictor, followed by NoOfOtherSpecialCharsInURL, DegitRatioInURL, and NoOfDegitsInURL.

These findings indicate that lexical URL characteristics dominate the phishing detection process and validate the effectiveness of the proposed consensus feature selection framework.

Figure 11: Feature Ablation Study

5.8 Discussion

The experimental results demonstrate that the proposed framework successfully achieves three important objectives.

First, the Consensus Feature Selection framework reduces the original URL feature space from 22 features to only 10 features, corresponding to a 54.5% reduction in dimensionality while maintaining near-perfect classification performance.

Second, the proposed Performance-Weighted Consensus Ensemble consistently achieves high predictive accuracy and robustness across multiple evaluation metrics, five-fold cross-validation, and ROC analysis. The use of validation-performance-based weighting enables effective integration of multiple ensemble learners while avoiding the equal-weight assumption commonly adopted in traditional voting schemes.

Third, SHAP-based explainability provides meaningful insights into the prediction process by identifying the URL characteristics that contribute most strongly to phishing detection. The feature ablation study further confirms the importance of URLSimilarityIndex and IsHTTPS, demonstrating that the selected consensus features capture the essential lexical properties required for accurate phishing detection.

Overall, the proposed framework offers an effective balance between classification performance, computational efficiency, and interpretability, making it suitable for practical deployment in real-time phishing detection systems.

6. Conclusion and Future Work

6.1. Conclusion

This paper presented an explainable and lightweight phishing website detection framework that combines

6.2 Future Work

Several promising research directions emerge from this study.

Future work will investigate the integration of multi-modal phishing indicators, including webpage HTML structure, visual appearance, JavaScript behavior, DNS information, and SSL certificate characteristics, to construct more comprehensive phishing detection models.

Another important direction involves incorporating online and incremental learning techniques that enable the framework to adapt continuously to newly emerging phishing attacks without requiring complete retraining.

The proposed Consensus Feature Selection framework may also be extended by incorporating additional feature ranking techniques, such as ReliefF, Boruta, permutation importance, or evolutionary optimization algorithms, to further improve feature robustness.

Future studies may additionally investigate graph neural networks, transformer-based architectures, and large language model (LLM)-assisted cybersecurity systems for phishing detection while preserving model explainability through advanced XAI techniques.

Finally, deploying the proposed framework within browser extensions, email security gateways, cloud security platforms, or enterprise intrusion detection systems would provide valuable insight into its real-world performance under practical operational conditions.

References

1. L. Tang, & Q. H. Mahmoud. (2021). A survey of machine learning-based solutions for phishing website detection. Machine Learning and Knowledge Extraction, 3(3), 672–694.

2. A. Almomani, et al. (2023). A systematic literature review on phishing website detection techniques. Journal of King Saud University – Computer and Information Sciences, 35(2), 590–611.

3. A. Hannousse, & S. Yahiouche. (2021). Towards benchmark datasets for machine learning based website phishing detection: An experimental study. Engineering Applications of Artificial Intelligence, 104, 104347.

15. Chen, T., & Guestrin, C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 785–794.

16. Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye, Q., & Liu, T. Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems (NeurIPS 2017).