Enhancing Phishing Website Detection Using an XGBoost-Based Stacking Ensemble of Machine Learning Classifiers

Abstract

Phishing websites remain a significant cybersecurity threat because they imitate legitimate online services to obtain users’ credentials and other sensitive information. Machine-learning techniques provide an effective approach for detecting phishing websites by identifying patterns associated with malicious URLs, while ensemble learning can combine the strengths of multiple classifiers to improve detection performance. This study evaluates three machine-learning classifiers, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Random Forest (RF) and proposes an XGBoost-based stacking ensemble that integrates their predictions for phishing website detection. A PhishTank-derived dataset was subjected to data cleaning, feature extraction and selection, and normalization were required before being divided into 70% training and 30% testing subsets. The models were evaluated using accuracy, precision, recall, F1-score, and Receiver Operating Characteristic Area Under the Curve (ROC-AUC). The results showed that SVM achieved 91.70% accuracy, 90.49% precision, 91.70% recall, 90.86% F1-score, and 0.98 ROC-AUC, while KNN achieved 91.55% accuracy, 91.48% precision, 91.55% recall, 91.51% F1-score, and 0.94 ROC-AUC. Random Forest produced the best performance among the individual classifiers, achieving 93.53% accuracy, 93.86% precision, 93.53% recall, 93.67% F1-score, and 0.96 ROC-AUC. The proposed XGBoost stacking ensemble achieved the highest overall performance, with 96.36% accuracy, 96.39% precision, 96.36% recall, 96.36% F1-score, and 0.99 ROC-AUC. These results demonstrate that integrating SVM, KNN, and RF through an XGBoost-based stacking approach can improve phishing website detection compared with the individual classifiers evaluated in this study.