EXPLAINABLE MACHINE LEARNING FOR PHISHING URL DETECTION USING SHAP INTERPRETATION

Abstract

Phishing attacks delivered through malicious URLs represent an increasingly prevalent cyber threat capable of causing significant harm to users. Although machine-learning–based phishing detection has been widely explored, most existing models still operate as black boxes, making their classification decisions difficult to interpret. This study proposes an Explainable Machine Learning framework for phishing URL detection by integrating five algorithms—XGBoost, Random Forest, Gradient Boosting, Decision Tree, and K-Nearest Neighbors—augmented with SHAP (SHapley Additive Explanations) for interpretability. The dataset includes structural URL features such as character length, special symbol counts, number of subdomains, and string entropy. Model performance was evaluated using accuracy, precision, recall, F1-score, and confusion matrix to enable comparative assessment among algorithms. The results show that XGBoost achieves the best performance, obtaining 97.8% accuracy, an F1-score of 0.976, and stable predictions across all classes. Random Forest ranks second with 96.4% accuracy, followed by Gradient Boosting at 95.7%. Meanwhile, Decision Tree and KNN exhibit lower performance due to their higher sensitivity to data variation. SHAP analysis reveals that the most influential features in phishing prediction include URL length, special character frequency, entropy levels, and the number of subdomains. These findings demonstrate that integrating XAI not only enhances model transparency but also ensures that phishing detection systems remain accurate, interpretable, and accountable.