Ensemble-Based Detection of Phishing URLs Using Machine Learning: A Cybersecurity Approach

Abstract

Phishing websites are among the most frequently used tactics by cybercriminals to trick people into revealing sensitive information, including usernames, passwords, banking details, and other personal data. As attackers continuously modify website structures and Uniform Resource Locators (URLs), conventional blacklist and signature-based detection techniques often fail to identify newly emerging phishing websites. This research introduces an ensemble machine learning method designed to identify phishing URLs more accurately and consistently. The proposed framework analyses lexical, host-based, and content-related characteristics extracted from URLs to distinguish phishing websites from legitimate ones. A balanced dataset of more than 11,000 phishing and legitimate URLs was utilized to train and assess the performance of various supervised machine learning models. Before model training, the collected data were pre-processed through feature selection, data cleaning, and normalization to improve classification performance. The performance of multiple classification models was evaluated using key metrics such as accuracy, precision, recall, and F1-score. Among all the models tested, the Gradient Boosting classifier delivered the strongest overall performance. It achieved an accuracy of 97.4%, along with a precision of 98.6% and an impressive recall of 99.4%, making it the most effective model in the comparison. To demonstrate the practical usability of the proposed model, it was integrated into a Flask-based web application capable of analysing URLs in real time and providing immediate predictions. Experimental findings indicate that the proposed approach can accurately identify phishing websites while maintaining computational efficiency. The developed system offers a practical and scalable solution for strengthening web security and reducing the risks associated with phishing attacks. The study also demonstrates that ensemble learning techniques can significantly improve phishing URL detection and can be extended to support future intelligent cybersecurity applications.