FRAMEWORK FOR ROBUST DETECTION OF PHISHING URLs USING SEMANTIC AND STRUCTURAL ANALYSIS
Keywords:
Phishing URL Detection; MiniLM Semantic Embeddings; Structural Metadata Features; XGBoost; Explainable AI; Hybrid Feature-Fusion FrameworkAbstract
Phishing attacks have grown increasingly sophisticated, deploying deceptive and obfuscated URLs that routinely evade conventional detection methods. This study addresses the critical gap between structural-only and semantic-only phishing detection by proposing a hybrid feature-fusion framework that integrates MiniLM transformer-based semantic embeddings with handcrafted structural URL metadata, classified using an Extreme Gradient Boosting (XGBoost) model. The framework was evaluated on a large-scale dataset of 507,196 cleaned URLs drawn from over 549,000 publicly available labeled records. Stratified 5-fold cross-validation and independent test set evaluation were applied across three model variants. The hybrid model outperformed both baseline approaches, achieving an accuracy of 93.57%, an F1-score of 0.857, a ROC-AUC of 0.9768, and an average precision of 0.9405. SHapley Additive exPlanations (SHAP) analysis confirmed that structural features such as slash count, digit frequency, and host length, together with specific MiniLM embedding dimensions, jointly drive robust predictions. These results demonstrate that combining semantic and structural information produces a detection system that is both highly accurate and interpretable, offering a reliable, transparent, and practically deployable solution for cybersecurity practitioners combating modern phishing threats.
References
APWG. (2025). Phishing activity trends report. Retrieved December 21, 2025, from https://docs.apwg.org/reports/apwg_trends_report_q1_2025.pdf
Aldakheel, E. A., Zakariah, M., Gashgari, G. A., Almarshad, F. A., & Alzahrani, A. I. A. (2023). A deep learning-based innovative technique for phishing detection in modern security with uniform resource locators. Sensors, 23(9), 4403.
Chen, T., & Guestrin, C. (2016). XGBoost: A scalable tree boosting system. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 785–794.
D, Prof. D. (2025). A hybrid framework for real-time phishing detection using URL, content, and DOM features with interpretable ML. International Journal for Research in Applied Science and Engineering Technology, 13(5), 3256–3261.
Das Guptta, S., Shahriar, K. T., Alqahtani, H., Alsalman, D., & Sarker, I. H. (2024). Modeling hybrid feature-based phishing websites detection using machine learning techniques. Annals of Data Science, 11(1), 217–242.
FBI. (2025). FBI releases annual internet crime report. Retrieved December 21, 2025, from https://www.fbi.gov/
Huynh, T. T., Nguyen, H. T., & Tran, N. H. (2025). A semantic-aware approach to phishing URL detection. Engineering, Technology and Applied Science Research, 15(6), 29866–29871.
Kavya, S., & Sumathi, D. (2024). Staying ahead of phishers: A review of recent advances and emerging methodologies in phishing detection. Artificial Intelligence Review, 58(2), 50.
Kehkashan, T., Abdelhaq, M., Al-Shamayleh, A. S., Huda, N., Yaseen, I. A., Ahmed, A. I. A., & Akhunzada, A. (2025). Explainable phishing website detection for secure and sustainable cyber infrastructure. Scientific Reports, 15(1), 41751.
Khonji, M., Iraqi, Y., & Jones, A. (2013). Phishing detection: A literature survey. IEEE Communications Surveys & Tutorials, 15(4), 2091–2121.
Kytidou, E., Tsikriki, T., Drosatos, G., & Rantos, K. (2025). Machine learning techniques for phishing detection: A review of methods, challenges, and future directions. Intelligent Decision Technologies, 19(6), 4356–4379.
Lundberg, S., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. arXiv. https://doi.org/10.48550/ARXIV.1705.07874
Naqvi, B., Perova, K., Farooq, A., Makhdoom, I., Oyedeji, S., & Porras, J. (2023). Mitigation strategies against the phishing attacks: A systematic literature review. Computers & Security, 132, 103387.
Nauman, M., Usman Akhtar, H. M., Gorbani, H., Hadi Ul Hassan, M., & Fayyaz, M. A. B. (2025). Transparent and trustworthy cybersecurity: An XAI-integrated big data framework for phishing attack detection. Frontiers in Big Data, 8, 1688091.
Ojewumi, T. O., Ogunleye, G. O., Oguntunde, B. O., Folorunsho, O., Fashoto, S. G., & Ogbu, N. (2022). Performance evaluation of machine learning tools for detection of phishing attacks on web pages. Scientific African, 16, e01165.
Reyes-Dorta, N., Caballero-Gil, P., & Rosa-Remedios, C. (2024). Detection of malicious URLs using machine learning. Wireless Networks, 30(9), 7543–7560.
Reynaud, S., & Roxin, A. (2025). Review of eXplainable artificial intelligence for cybersecurity systems. Discover Artificial Intelligence, 5(1), 78.
Sahingoz, O. K., Buber, E., Demir, O., & Diri, B. (2019). Machine learning based phishing detection from URLs. Expert Systems with Applications, 117, 345–357.
Ucci, D., Aniello, L., & Baldoni, R. (2019). Survey of machine learning techniques for malware analysis. Computers & Security, 81, 123–147.
Wang, W., Wei, F., Dong, L., Bao, H., Yang, N., & Zhou, M. (2020). MiniLM: Deep self-attention distillation for task-agnostic compression of pre-trained transformers. arXiv. https://doi.org/10.48550/ARXIV.2002.10957
Yoon, J.-H., Buu, S.-J., & Kim, H.-J. (2024). Phishing webpage detection via multi-modal integration of HTML DOM graphs and URL features based on graph convolutional and transformer networks. Electronics, 13(16), 3344.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Clenie Tuyisenge, Jonathan Ngugi, Irénée Mungwarakarama
This work is licensed under a Creative Commons Attribution 4.0 International License.
