A CROSS-DATASET GENERALIZATION AND EXPLAINABILITY STUDY OF MACHINE LEARNING PHISHING WEBSITE DETECTORS (CAN PHISHING DETECTORS BE TRUSTED IN THE WILD?)

Abstract

It is widely reported that machine learning-based phishing website detectors are able to detect phishing sites with 95–99% accuracy; however, the vast majority of these results are achieved by training and testing a detector using only one phishing website benchmark set. This paper empirically explores whether such models can be applied to unseen phishing data. On two open-source benchmark datasets (the UCI Phishing Websites Dataset and the PhiUSIIL Phishing URL Dataset), we train Random Forest and XGBoost classifiers with five feature-aligned, dataset-agnostic features: IP-address usage, URL length, iframe usage, redirection behaviour, and hyphenated domain names. For both models, the same-dataset (baseline) evaluation results in an accuracy of 76-78%. But if this model is tested on the other dataset, the accuracy drops to 40–48%, and the ROC-AUC is under 0.5, with the Matthews Correlation Coefficient (MCC) becoming negative in both cross-dataset evaluations, meaning that the model fails to outperform random guessing. In addition, SHAP (SHapley Additive exPlanations) analysis indicates that the most influential feature varies across datasets: URL length is most influential on the UCI dataset, while iframe usage is most influential on PhiUSIIL. To validate results, the analysis was performed using a 5-fold cross-validated approach. The results show that high single-dataset accuracy does not necessarily mean high real-world accuracy, as well as that the importance of features is not fixed across data sources. The implications for the design of more generalizable phishing detection systems are discussed, and directions for future work are outlined.