A deep learning mechanism to detect phishing URLs using the permutation importance method and SMOTE-Tomek link

In contemporary times, the proliferation of phishing attacks presents a substantial and growing challenge to cybersecurity. This fraudulent tactic is designed to deceive unsuspecting individuals, enticing them to access malicious websites and disclose sensitive personal information such as usernames, passwords, and financial details. As a result, malevolent actors exploit this data for illicit purposes. As the sophistication and maliciousness of phishing continue to evolve, researchers are earnestly developing multiple anti-phishing solutions in the literature. Among these solutions, those based on machine learning and deep learning models have gained substantial attention in recent years. This study proposes an intelligent mechanism to detect phishing URLs. The proposed system is based on the permutation importance method to select the most relevant URL features and the SMOTE-Tomek link method to solve the problem of an unbalanced dataset. In addition, the XGBoost classifier and four deep learning models—CNN, LSTM, and two hybrid models (CNN-LSTM and LSTM-CNN)—are employed to classify URLs as phishing or legitimate and to compare their performance. The experimental results demonstrate the successful functioning of the proposed phishing detection mechanism. It is observed that the proposed mechanism achieved an accuracy ranging from 93.36 to 97.05% without feature selection and data balance across two variants of datasets and different classifiers. It also achieved an accuracy ranging from 94.12 to 97.82% with feature selection and data balance. Finally, our phishing detection mechanism is implemented as a web application to enhance its usability for web users.