Phishing URL Detection in the Era of Machine Learning: A Comprehensive Analytical Review
Abstract
The rapid expansion of internet usage and the exponential growth of digital data have significantly increased the global attack surface, leading to a rise in sophisticated cyber threats. Among these, phishing has emerged as one of the most widespread and persistent forms of cyberattacks. Phishing involves the use of social engineering and deceptive techniques to trick users into revealing sensitive information such as login credentials, financial data, and personal details, often resulting in severe security breaches. This paper reviews the application of machine learning (ML) techniques for phishing URL detection, which offer automated and scalable solutions to identify malicious activities. It explores various feature extraction approaches, including lexical, host-based, and content-based features, that help differentiate between legitimate and phishing URLs. The study also discusses key challenges in ML-based detection systems, such as imbalanced datasets, evolving attack patterns, feature selection complexity, and the need for real-time detection with low false positive rates. Furthermore, an experimental evaluation is conducted using the UCI Phishing Websites Dataset to compare the performance of multiple models, including Random Forest, XGBoost, LSTM, CNN, and a CNN-LSTM hybrid. Results show that Random Forest achieves the highest accuracy of 97.38%, demonstrating its effectiveness and reliability in phishing detection.
References
1. Utami MD, Hilman MH, Yazid S. Enhancing phishing detection: Integrating XGBoost with feature selection techniques. SSRN. 2025. doi: 10.2139/ssrn.5087049
2. Kajjam V, Shivakumar K. Preventing data leakage risks from DDoS and phishing attacks using random forest algorithm. In: Proc. ICIMIA; 2025. doi: 10.1109/ICIMIA67127.2025.11200859
3. Venkatesh GK, Anitha R. Botnets: A study and analysis. Adv Intell Syst Comput. 2014;246:203–214.doi: 10.1007/978-81-322-1680-3_23
4. Anti-Phishing Working Group (APWG). APWG phishing activity trends report, 1st quarter 2025. 2025.
5. AAG IT Services. Phishing statistics 2025. 2025.
6. Damiani J. Google data reveals 350% surge in phishing websites during coronavirus pandemic. Forbes. 2020. Available from: https://www.forbes.com/sites/jessedamiani/2020/03/26/google-data-reveals- 350-surge-in-phishing-websites-during-coronavirus-pandemic/
7. Fortinet. Types of phishing attacks. Available from: https://www.fortinet.com/resources/cyberglossary/types-of-phishing-attacks
8. Preeti, Sharma P. Enhancing phishing URL detection through comprehensive feature selection: A comparative analysis across diverse datasets. Indones J Electr Eng Comput Sci. 2024;36(2):1182–1188. doi: 10.11591/ijeecs.v36.i2.pp1182-1188
9. Bahnsen AC, Torres EG, Camacho S, Raudys A. Classifying phishing URLs using recurrent neural networks. In: Proc. APWG eCrime; 2018. p. 1–8. doi:10.1109/eCrime.2018.8376209
10. Alshingiti Z, Alaqel R, Al-Muhtadi J, Haq QEU, Saleem K, Faheem MH. A deep learning-based phishing detection system using CNN, LSTM, and LSTM–CNN. Electronics. 2023;12(1):1–18. doi: 10.3390/electronics12010232
11. Guptta SD, Shahriar KT, Alqahtani H, Alsalman D, Sarker IH. Modeling hybrid feature-based phishing websites detection using machine learning techniques. Ann Data Sci. 2024;11(1):217–242. doi: 10.1007/s40745-022-00379-8
12. Ujah-Ogbuagu BC, Akande ON, Ogbuju E. A hybrid deep learning technique for spoofing website URL detection in real-time applications. J Electr Syst Inf Technol. 2024;11:7. doi: 10.1186/s43067- 023-00128-8
13. Yoon JH, Buu SJ, Kim HJ. Phishing webpage detection via multi-modal integration of HTML DOM graphs and URL features based on graph convolutional and transformer networks. Electronics. 2024;13:3344. doi: 10.3390/electronics13163344
14. Shakir SS, Khanli LM, Emami H. Convolutional graph network-based feature extraction to detect phishing attacks. Future Internet. 2025;17:331. doi: 10.3390/fi17080331
15. Li W, Manickam S, Chong YW, Leng W, Nanda P. A state-of-the-art review on phishing website detection techniques. IEEE Access. 2022;10:36429–36451. doi: 10.1109/ACCESS.2022.3151903
16. Tanimu J, Shiaeles S. Phishing detection using machine learning algorithm. In: Proc. IEEE CSR Workshops; 2022. doi: 10.1109/CSR54599.2022.9850316
17. Tang L, Mahmoud QH. A deep learning-based framework for phishing website detection. IEEE Access. 2021. doi: 10.1109/ACCESS.2021.3137636
18. Divakaran DM, Oest A. Phishing detection leveraging machine learning and deep learning: A review. In: Proc. IEEE/ACM Workshop ICS; 2022. doi: 10.1109/MSEC.2022.3175225
19. Patil RR, Kaur G, Jain H, Tiwari A, Joshi S, Rao K, et al. Machine learning approach for phishing website detection: A literature survey. J Discrete Math Sci Cryptogr. 2022;25(3):817–827. doi: 10.1080/09720529.2021.2016224
