Phishing Website Detection Using A Stacked Hybrid Model With Explainable AI

Abstract

Phishing attacks have become a critical cybersecurity challenge due to the increasing use of fraudulent websites and malicious URLs to deceive users and obtain sensitive information. Conventional phishing detection approaches such as blacklist-based filtering and static rule-based techniques often fail to recognize newly generated phishing websites because they depend on previously identified threats. To overcome these limitations, this work presents a Phishing Website Detection System Using a Stacked Hybrid Model With Explainable AI, designed to accurately classify websites as phishing or legitimate while providing transparent decision explanations. The proposed framework utilizes a stacking ensemble architecture that combines multiple learning models, including Artificial Neural Network (ANN), Bagging K-Nearest Neighbors (KNN), and Support Vector Machine (SVM), to identify complex patterns from URL-based and website-related characteristics. Logistic Regression is incorporated as a meta-level classifier to combine the predictions of individual models and generate the final classification result. The system uses extracted lexical, structural, and security-related website features to improve detection reliability and enhance model generalization. Furthermore, Explainable Artificial Intelligence (XAI) is integrated through SHAP to analyze the contribution of individual features and provide meaningful explanations behind each prediction. This improves the transparency of the detection process by showing the factors that influence phishing and legitimate classifications. A user-oriented detection interface is also developed, allowing users to submit website URLs and receive immediate classification results along with feature-based explanations. Performance assessment of the developed hybrid model is carried out using a publicly available phishing website dataset. Experimental results evaluated using Accuracy, Precision, Recall, and F1-score indicates that the stacked hybrid model provides reliable and consistent identification of phishing websites.

Introduction

This study proposes a Stacked Hybrid Phishing Website Detection Framework with Explainable Artificial Intelligence (XAI) to improve the accuracy, transparency, and reliability of phishing website detection. Phishing attacks have become increasingly sophisticated, making traditional detection methods based on blacklists, signatures, and predefined rules ineffective against newly created malicious websites. While machine learning and deep learning techniques have improved phishing detection, individual models often struggle to generalize across evolving attack patterns.

The proposed framework combines Artificial Neural Network (ANN), Bagging K-Nearest Neighbors (KNN), and Support Vector Machine (SVM) as base classifiers in a stacking ensemble, with Logistic Regression serving as the meta-classifier to produce the final prediction. To enhance interpretability, the system integrates SHAP (SHapley Additive exPlanations), which identifies the most influential features behind each prediction, allowing users and security analysts to understand why a website is classified as phishing or legitimate. A real-time interface further enables users to submit URLs and receive instant predictions along with explanatory insights.

The literature review highlights the evolution of phishing detection from traditional machine learning models to deep learning, hybrid learning, and ensemble techniques. Previous studies demonstrated the effectiveness of URL feature analysis, neural networks, and hybrid models but often focused primarily on improving prediction accuracy while neglecting model interpretability. Recent research emphasizes the importance of Explainable AI in increasing trust and transparency in cybersecurity applications.

The proposed methodology consists of six major stages: dataset collection, data preprocessing, exploratory data analysis, model training, stacking ensemble learning, and SHAP-based explainability. The framework uses a balanced dataset of 10,000 website samples (5,000 legitimate and 5,000 phishing websites), ensuring equal representation of both classes. Data preprocessing includes handling missing values, removing duplicates, correcting inconsistencies, and standardizing numerical features using StandardScaler to improve model performance. Exploratory data analysis is then conducted to examine feature distributions and dataset characteristics before training the classification models.

Conclusion

The proposed machine learning-based phishing website detection framework was successfully developed to identify malicious and legitimate websites using URL-based feature analysis and intelligent classification techniques. The architecture combines Artificial Neural Network, Bagging K-Nearest Neighbors, Support Vector Machine, and Logistic Regression within a stacking ensemble framework. This integration enhances the reliability and effectiveness of phishing website classification. The complete workflow includes dataset preparation, preprocessing, exploratory analysis, model construction, performance assessment, and explainable prediction analysis. Experimental evaluation showed that the implemented machine learning models are capable of identifying hidden patterns within URL characteristics and effectively distinguishing phishing websites from legitimate websites. Among all evaluated approaches, the stacking ensemble consistently produced the strongest predictive performance with an accuracy of 98.05%, precision of 97.71%, recall of 98.40%, and F1-score of 98.05%. The results obtained from confusion matrix analysis confirm that the Hybrid approach produces fewer false classifications compared with individual machine learning models. This indicates that combining multiple learning approaches improves classification reliability and enhances phishing detection performance. One of the primary contributions of this research is the incorporation of Explainable Artificial Intelligence (XAI) through the SHAP interpretation technique. SHAP enables detailed interpretation of the trained model by measuring how individual URL-based features influence the final prediction, thereby improving the transparency of the classification process. Features such as suspicious redirects, domain-related characteristics, insecure forms, and abnormal URL structures were observed as significant contributors toward phishing classification. The proposed framework not only provides accurate phishing detection but also improves transparency and trust by explaining why a particular website is classified as malicious or legitimate. The combination of machine learning-based classification and explainable prediction analysis makes the developed system suitable for real-world cybersecurity applications such as browser protection, automated threat detection, and online security monitoring. Overall, the proposed phishing detection framework demonstrates that intelligent machine learning techniques combined with explainability methods can provide an efficient, reliable, and interpretable solution for detecting modern phishing attacks.

References

[1] S. Abu-Nimeh, D. Nappa, X. Wang, and S. Nair, “A Comparison of Machine Learning Techniques for Phishing Detection,” eCrime Researchers Summit, 2007. [2] M. Abutaha, M. Ababneh, K. Mahmoud, and S. A.-H. Baddar, “URL Phishing Detection Using Machine Learning Techniques Based on URLs Lexical Analysis,” ICICS, 2021. [3] V. Shahrivari, M. M. Darabi, and M. Izadi, “Phishing Detection Using Machine Learning Techniques,” arXiv, 2020. [4] S. Dadvandipour and A. G. Ganie, “Analyzing and Predicting Spear Phishing Using Machine Learning Methods,” 2020. [5] I. D. Aiyanyo, H. Samuel, and H. Lim, “A Systematic Review of Defensive and Offensive Cybersecurity with Machine Learning,” Applied Sciences, 2020. [6] I. H. Sarker, “Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective,” SN Computer Science, 2021. [7] S. Mughaid et al., “An Intelligent Cyber Security Phishing Detection System Using Deep Learning Techniques,” Cluster Computing, 2022. [8] F. S. Alsubaei et al., “Enhancing Phishing Detection: A Novel Hybrid Deep Learning Framework for Cybercrime Forensics,” IEEE Access, 2024. [9] A. Ozcan et al., “A Hybrid DNN-LSTM Model for Detecting Phishing URLs,” Neural Computing and Applications, 2023. [10] A. Newaz et al., “A Sophisticated Framework for the Accurate Detection of Phishing Websites,” arXiv, 2024. [11] A. Karim et al., “Phishing Detection System Through Hybrid Machine Learning Based on URL,” IEEE Access, 2023. [12] R. G. M. Helali, “Phishing Detection Using Hybrid Machine Learning Techniques,” 2024. [13] E. Kocyigit et al., “Enhanced Feature Selection Using Genetic Algorithm for Machine-Learning-Based Phishing URL Detection,” Applied Sciences, 2024. [14] N. T. Singh et al., “An Innovative URL-Based System Approach with ML Based Prevention,” IEEE IC2PCT, 2024. [15] A. Raza et al., “Novel Class Probability Features for Optimizing Network Attack Detection with Machine Learning,” IEEE Access, 2023. [16] S. Tiwari, Phishing Dataset for Machine Learning, Kaggle.

Copyright

Copyright © 2026 Adigarla Venkata Naga Mounika, Dr. T. Siva Ramakrishna. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.