Modern Phishing URL Detection Using Feature Selection and Comparative Classification Models

Abstract

Phishing URLs remain a critical cybersecurity threat because attackers increasingly exploit domain similarity, webpage imitation, and structural manipulation to deceive users and bypass conventional blacklist-based detection. This study proposes an engineering-oriented phishing URL detection pipeline using feature selection and comparative classification models implemented in RapidMiner. The PhiUSIIL Phishing URL Dataset was used, and after preprocessing, 234,903 URL records were retained, consisting of 134,834 legitimate URLs and 100,069 phishing URLs. Non-predictive attributes were removed, invalid target labels were filtered, missing predictor values were handled, and the target label was transformed into a binominal class, where phishing was treated as the positive class. Information Gain was applied to identify the most discriminative attributes, and the top-20 features were used for model comparison. Five classification models were evaluated using stratified 10-fold cross-validation: Decision Tree, Random Forest, Naive Bayes, Logistic Regression, and Gradient Boosted Trees. The results show that all models achieved accuracy above 99.95%, indicating strong class separability within the selected-feature scenario. Random Forest produced the most balanced performance, achieving 100.00% accuracy, 100.00% precision, 100.00% recall, 100.00% F1-score, and AUC of 1.000, with only three phishing URLs misclassified as legitimate. The findings demonstrate that selected URL similarity and webpage structural features can support efficient and interpretable phishing detection. However, the near-perfect performance should be interpreted as strong internal validation, and future work should include external dataset validation and ablation testing of dominant features.