XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection

Tejas Kalal; Rızwan Alam; Amisha Khune; Govind Kalal

doi:10.35377/saucis...1797317

EN

XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection

Abstract

Phishing remains a critical cybersecurity threat, requiring detection frameworks that combine accuracy and interpretability. This study presents a complete machine learning and deep learning framework for phishing URL detection, developed using a newly created dataset of 50,406 labeled instances. The dataset incorporates 30 lexical and network infrastructure features. Multiple models, including Random Forest (RF), XGBoost, and a 1D Convolutional Neural Network (CNN), were evaluated. Random Forest achieved the highest accuracy of 95.76%, followed by CNN 1D (95.17%) and XGBoost (94.48%), both of which delivered competitive performance. To address model transparency, SHAP and LIME were applied, providing feature-level explanations of predictions. The proposed framework integrates dataset contribution, predictive performance, and explainable AI, offering a practical foundation for real-world phishing defense.

Keywords

Ethical Statement

Since no animal, human, or sensitive information was used in this research, ethical approval did not apply. Ethical approval was therefore not requested or required.

References

Anti-Phishing Working Group (APWG), “Phishing activity trends report, 4th quarter 2024,” [Online]. Available: https://docs.apwg.org/reports/apwg trends report q4 2024.pdf, 2025, accessed: Apr. 4, 2026.
K. Kaur and A. K. Jain, “A survey on phishing attack taxonomy, detection techniques, datasets, and security measures,” J. Appl. Security Res., vol. 20, no. 4, pp. 506–557, 2025, doi: 10.1080/19361610.2025.2508726.
J.-H. Yoon, S.-J. Buu, and H.-J. Kim, “Phishing webpage detection via multi-modal integration of HTML DOM graphs and URL features based on graph convolutional and transformer networks,” Electronics, vol. 13, no. 16, p. 3344, 2024, doi: 10.3390/electronics13163344.
M. A. Tamal, M. K. Islam, T. Bhuiyan, A. Sattar, and N. U. Prince, “Unveiling suspicious phishing attacks: enhancing detection with an optimal feature vectorization algorithm and supervised machine learning,” Front. Comput. Sci., vol. 6, p. 1428013, 2024, doi: 10.3389/fcomp.2024.1428013.
N. Nagy et al., “Phishing URLs detection using sequential and parallel ML techniques: Comparative analysis,” Sensors, vol. 23, no. 7, p. 3467, 2023, doi: 10.3390/s23073467.
A. Hannousse and S. Yahiouche, “Towards benchmark datasets for machine learning based website phishing detection: An experimental study,” Eng. Appl. Artif. Intell., vol. 104, p. 104347, 2021, doi: 10.1016/j.engappai.2021.104347.
R. Alam, A. Khune, T. V. Kalal, and A. Nautiyal, “E2Phish: Explainable ensemble machine learning model for enhanced phishing URL detection,” in 2024 IEEE 8th International Conference on Information and Communication Technology (CICT), 2024, pp. 1–6, doi: 10.1109/CICT64037.2024.10899721.
P. L. Indrasiri, M. N. Halgamuge, and A. Mohammad, “Robust ensemble machine learning model for filtering phishing URLs: Expandable random gradient stacked voting classifier (ERG-SVC),” IEEE Access, vol. 9, pp. 150 142–150 161, 2021, doi: 10.1109/ACCESS.2021.3124628.

O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning based phishing detection from URLs,” Expert Syst. Appl., vol. 117, pp. 345–357, 2019, doi: 10.1016/j.eswa.2018.09.029.
L. R. Kalabarige, R. S. Rao, A. Abraham, and L. A. Gabralla, “Multilayer stacked ensemble learning model to detect phishing websites,” IEEE Access, vol. 10, pp. 79 543–79 552, 2022, doi: 10.1109/ACCESS.2022.3194672.
S. Adi, Y. Pristyanto, and A. Sunyoto, “The best features selection method and relevance variable for web phishing classification,” in 2019 International Conference on Information and Communications Technology (ICOIACT), 2019, pp. 578–583, doi: 10.1109/ICOIACT46704.2019.8938566.
M. Babagoli, M. P. Aghababa, and V. Solouk, “Heuristic nonlinear regression strategy for detecting phishing websites,” Soft Comput., vol. 23, no. 12, pp. 4315–4327, 2019, doi: 10.1007/s00500-018-3084-2.
M. Al-Sarem, F. Saeed, A. Alsaeedi, W. Boulila, and T. Al-Hadhrami, “Ensemble methods for instance-based arabic language authorship attribution,” IEEE Access, vol. 8, pp. 17 331–17 345, 2020, doi: 10.1109/ACCESS.2020.2964952.
M. Othman and H. Hassan, “An empirical study towards an automatic phishing attack detection using ensemble stacking model,” Future Comput. Informatics J., vol. 7, no. 1, pp. 1–12, 2022.
M. R. Chinguwo and R. Dhanalakshmi, “Detecting cloud based phishing attacks using stacking ensemble machine learning technique,” Int. J. Res. Appl. Sci. Eng. Technol., vol. 11, no. 3, pp. 360–367, 2023, doi: 10.22214/ijraset.2023.49422.
S. Aslam, H. Aslam, A. Manzoor, H. Chen, and A. Rasool, “AntiPhishStack: LSTM-based stacked generalization model for optimized phishing URL detection,” Symmetry, vol. 16, no. 2, p. 248, 2024, doi: 10.3390/sym16020248.
M. Al-Sarem et al., “An optimized stacking ensemble model for phishing websites detection,” Electronics, vol. 10, no. 11, p. 1285, 2021, doi: 10.3390/elec- tronics10111285.
A. D. Kulkarni and L. L. Brown, III, “Phishing websites detection using machine learning,” Int. J. Adv. Comput. Sci. Appl., vol. 10, no. 7, pp. 8–13, 2019, doi: 10.14569/IJACSA.2019.0100702.
N. Abdelhamid, “Website Phishing,” UCI Machine Learning Repository, 2014, [Dataset], doi: 10.24432/C5B301.
F. Greco, G. Desolda, and A. Esposito, “Explaining phishing attacks: An XAI approach to enhance user awareness and trust,” in Proc. Italian Conf. Cybersecurity (ITASEC 2023), ser. CEUR Workshop Proceedings, vol. 3488, 2023, pp. 1–16. [Online]. Available: https://ceur-ws.org/Vol-3488/paper22.pdf
A. Schwartz, SpamAssassin. Cologne, Germany: O’Reilly Germany, 2005.
H. Nori, S. Jenkins, P. Koch, and R. Caruana, “InterpretML: A unified framework for machine learning interpretability,” arXiv preprint arXiv:1909.09223, 2019, doi: 10.48550/arXiv.1909.09223.
S. Poddar, D. Chowdhury, A. D. Dwivedi, and R. R. Mukkamala, “Data driven based malicious URL detection using explainable AI,” in 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2022, pp. 1266–1272, doi: 10.1109/Trust- Com56396.2022.00176.
M. C. Calzarossa, P. G. Stefano, and R. Zieni, “Explaining explainable AI, with applications to phishing detection,” Available at SSRN 4790045, 2024, doi: 10.2139/ssrn.4790045.
A. K. Jain and B. B. Gupta, “A machine learning based approach for phishing detection using hyperlinks information,” J. Ambient Intell. Humanized Comput., vol. 10, no. 5, pp. 2015–2028, 2019.
M. R. Islam, M. M. Islam, M. S. Afrin, A. Antara, N. Tabassum, and A. Amin, “PhishGuard: A convolutional neural network-based model for detecting phishing URLs with explainability analysis,” in 2024 3rd International Conference on Artificial Intelligence for Internet of Things (AIIoT), 2024, pp. 1–6, doi: 10.1109/AIIoT58432.2024.10574688.
B. Biswas, A. Mukhopadhyay, A. Kumar, and D. Delen, “A hybrid framework using explainable AI (XAI) in cyber-risk management for defence and recovery against phishing attacks,” Decis. Support Syst., vol. 177, p. 114102, 2024, doi: 10.1016/j.dss.2023.114102.
E. A. Aldakheel, M. Zakariah, G. A. Gashgari, F. A. Almarshad, and A. I. Alzahrani, “A deep learning-based innovative technique for phishing detection in modern security with uniform resource locators,” Sensors, vol. 23, no. 9, p. 4403, 2023, doi: 10.3390/s23094403. 1449
N. Aslam et al., “Interpretable machine learning models for malicious domains detection using explainable artificial intelligence (XAI),” Sustainability, vol. 14, no. 12, p. 7375, 2022, doi: 10.3390/su14127375.
C. Marques, S. Malta, and J. P. Magalh˜aes, “DNS dataset for malicious domains detection,” Data Brief, vol. 38, p. 107342, 2021, doi: 10.1016/j.dib.2021.107342.
A. Aljofey et al., “An effective detection approach for phishing websites using URL and HTML features,” Sci. Rep., vol. 12, no. 1, p. 8842, 2022, doi: 10.1038/s41598-022-10841-5.
A. Ozcan, C. Catal, E. Donmez, and B. Senturk, “A hybrid DNN–LSTM model for detecting phishing URLs,” Neural Comput. Appl., vol. 35, no. 7, pp. 4957–4973, 2023, doi: 10.1007/s00521-021-06401-z.
M. S´anchez-Paniagua, E. Fidalgo, E. Alegre, and R. Alaiz-Rodr´ıguez, “Phishing websites detection using a novel multipurpose dataset and web technologies features,” Expert Syst. Appl., vol. 207, p. 118010, 2022, doi: 10.1016/j.eswa.2022.118010.
S. S. Shafin, “An explainable feature selection framework for web phishing detection with machine learning,” Data Sci. Manag., vol. 8, no. 2, pp. 127–136, 2025, doi: 10.1016/j.dsm.2024.08.004.
S. Kim, J. Park, H. Ahn, and Y. Lee, “Detection of Korean phishing messages using biased discriminant analysis under extreme class imbalance problem,” Information, vol. 15, no. 5, p. 265, 2024, doi: 10.3390/info15050265.
A. Joshi, L. Lloyd, P. Westin, and S. Seethapathy, “Using lexical features for malicious URL detection–a machine learning approach,” arXiv preprint arXiv:1910.06277, 2019, doi: 10.48550/arXiv.1910.06277.
R. Hranick`y, A. Hor´ak, J. Poliˇsensk`y, O. Ondry´aˇs, K. Jeˇr´abek, and O. Ryˇsav`y, “Spotting the hook: Leveraging domain data for advanced phishing detection,” in 2024 20th International Conference on Network and Service Management (CNSM). IEEE, 2024, pp. 1–7.
H. Jeon and S. Oh, “Hybrid-recursive feature elimination for efficient feature selection,” Appl. Sci., vol. 10, no. 9, p. 3211, 2020, doi: 10.3390/app10093211.
A. Janecek, “Efficient feature reduction and classification methods: Applications in drug discovery and email categorization,” Ph.D. dissertation, Universit¨at Wien, Vienna, Austria, 2009, doi: 10.25365/thesis.8205.

Details

Primary Language

English

Subjects

Cybersecurity and Privacy (Other)

Journal Section

Research Article

Authors

Tejas Kalal ^*
0009-0005-4527-7948
India

Rızwan Alam
0000-0002-5019-0389
India

Amisha Khune
0009-0006-2951-7902
India

Govind Kalal
0009-0001-4412-8538
India

Early Pub Date

October 27, 2026

Publication Date

October 30, 2026

Submission Date

October 7, 2025

Acceptance Date

July 7, 2026

Published in Issue

Year 2026 Volume: 9 Number: 5

DOI

https://doi.org/10.35377/saucis...1797317

IZ

https://izlik.org/JA33CY66JE

Cite

RIS / Bibtex

APA

Kalal, T., Alam, R., Khune, A., & Kalal, G. (2026). XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection. Sakarya University Journal of Computer and Information Sciences, 9(5), 1436-1450. https://doi.org/10.35377/saucis...1797317

AMA

1.Kalal T, Alam R, Khune A, Kalal G. XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection. SAUCIS. 2026;9(5):1436-1450. doi:10.35377/saucis.1797317

Chicago

Kalal, Tejas, Rızwan Alam, Amisha Khune, and Govind Kalal. 2026. “XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection”. Sakarya University Journal of Computer and Information Sciences 9 (5): 1436-50. https://doi.org/10.35377/saucis. 1797317.

EndNote

Kalal T, Alam R, Khune A, Kalal G (October 1, 2026) XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection. Sakarya University Journal of Computer and Information Sciences 9 5 1436–1450.

IEEE

[1]T. Kalal, R. Alam, A. Khune, and G. Kalal, “XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection”, SAUCIS, vol. 9, no. 5, pp. 1436–1450, Oct. 2026, doi: 10.35377/saucis...1797317.

ISNAD

Kalal, Tejas - Alam, Rızwan - Khune, Amisha - Kalal, Govind. “XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection”. Sakarya University Journal of Computer and Information Sciences 9/5 (October 1, 2026): 1436-1450. https://doi.org/10.35377/saucis. 1797317.

JAMA

1.Kalal T, Alam R, Khune A, Kalal G. XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection. SAUCIS. 2026;9:1436–1450.

MLA

Kalal, Tejas, et al. “XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection”. Sakarya University Journal of Computer and Information Sciences, vol. 9, no. 5, Oct. 2026, pp. 1436-50, doi:10.35377/saucis. 1797317.

Vancouver

1.Tejas Kalal, Rızwan Alam, Amisha Khune, Govind Kalal. XPhish: An Interpretable Machine and Deep Learning Framework for Phishing URL Detection. SAUCIS. 2026 Oct. 1;9(5):1436-50. doi:10.35377/saucis. 1797317