Machine-Learning Classification Model and Tools for Real-time URL Phishing Detection

Machine-Learning Classification Model and Tools for Real-time URL Phishing Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Machine-Learning Classification Model and Tools for Real-time URL Phishing Detection Ramzi Saifan, Hani Ahmad, Talal A. Edwan This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7666636/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Phishing attacks are considered a significant cybersecurity concern, employing deceptive tactics to entice individuals into engaging with counterfeit websites. These malicious pages are skillfully designed replicas of legitimate platforms, aiming to collect sensitive data like usernames, passwords, banking credentials, and other personal details. This study focuses on phishing via Uniform Resource Locators (URLs) and investigates the potential of machine learning to identify such deceptive websites based on their behavior and URL attributes. To accomplish this, the work introduces and demonstrates two key tools; one for dataset creation and the other for URL classification. Machine learning has already shown its effectiveness in identifying phishing attacks from URLs, though there are still some obstacles to be overcome, such as the need for vast quantities of high-quality training data and the requirement to keep up with the constantly changing tactics employed by phishing attackers. The integration of the proposed tools in a web browser plugin is supposed to enable real-time URL analysis within web browsers, enhancing the system's effectiveness against phishing attacks and hence improving user experience. Using a self-collected dataset of 46,000 URLs, several machine learning algorithms were trained and tested including support vector machine (SVM), XGBoost, decision tree, and random forest algorithms. Among these, XGBoost model achieved an impressive classification accuracy of 96%, F1-Score of 96.7%, Recall of 96.6% and Precision 96.9% after assessing various permutations of hyperparameter values using the grid search procedure. This success underscores the potency of machine learning techniques in bolstering cyber defenses and mitigating the impact of phishing attacks. Phishing cybersecurity machine learning URL analysis fraud detection phishing classification behavioral attributes Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7666636","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":542468072,"identity":"ca888a6e-8694-45c3-b4f1-0c2e088d4b4c","order_by":0,"name":"Ramzi Saifan","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA2ElEQVRIie3RvQrCMBSG4a8E7BJxrSB6Cy1CFRSv5QRBNxEEFwc76SK49jIUwTlS0EXc3ZTeQMcugqmIbqZugnmnDHnIzwFMpl+N2kAJUq0KgBXkIj2gHHxFoIibiYxoawT2NblQZ1DfHV0k4whsrjmmInndIeqOfHl0rfAUwVrIz8QBhyNSJraKsOJMkZB0xI5ToqnYBIrc8hH46mKRWEERKxdh3G8SHUQo98Pd4tTn+rfY8/ic0kQsw2h9Scetqqf7MbAXlo/5c08n3pWeW2u5hclkMv1Ld90fRMWxZLPCAAAAAElFTkSuQmCC","orcid":"","institution":"University of Jordan","correspondingAuthor":true,"prefix":"","firstName":"Ramzi","middleName":"","lastName":"Saifan","suffix":""},{"id":542468074,"identity":"c1d50a4e-75ad-44f7-aa52-742e55aa7807","order_by":1,"name":"Hani Ahmad","email":"","orcid":"","institution":"Princess Sumaya University for Technology","correspondingAuthor":false,"prefix":"","firstName":"Hani","middleName":"","lastName":"Ahmad","suffix":""},{"id":542468075,"identity":"9ba1349f-7754-47a9-aa46-2ec5909c2ed1","order_by":2,"name":"Talal A. Edwan","email":"","orcid":"","institution":"University of Jordan","correspondingAuthor":false,"prefix":"","firstName":"Talal","middleName":"A.","lastName":"Edwan","suffix":""}],"badges":[],"createdAt":"2025-09-21 06:53:19","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7666636/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7666636/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":95638763,"identity":"6382da80-8cfb-400e-b97d-d196254af2db","added_by":"auto","created_at":"2025-11-11 13:03:44","extension":"docx","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1330584,"visible":true,"origin":"","legend":"","description":"","filename":"paperv11.docx","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/f35a6284f6b1a3ee92498c99.docx"},{"id":95657945,"identity":"9acbb7c4-12fe-4fcb-a335-09194ca1cdd3","added_by":"auto","created_at":"2025-11-11 16:22:31","extension":"json","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":5540,"visible":true,"origin":"","legend":"","description":"","filename":"fdff63e7669047e788e8a99dd193bdbf.json","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/a2e1998854a3344c667fe10e.json"},{"id":95638767,"identity":"ba2dfb67-a05d-45a3-8298-1e857f3a9f76","added_by":"auto","created_at":"2025-11-11 13:03:44","extension":"xml","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":116765,"visible":true,"origin":"","legend":"","description":"","filename":"fdff63e7669047e788e8a99dd193bdbf1enriched.xml","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/5d6ce853d152f97492e61222.xml"},{"id":95638764,"identity":"a9c9e263-0236-4214-b4c3-4b5a1ef1eb1a","added_by":"auto","created_at":"2025-11-11 13:03:44","extension":"jpeg","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1074,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/de3aaeacbad75e37f51b503f.jpeg"},{"id":95657880,"identity":"66162e31-2cbf-486b-94da-c6b08ecd2156","added_by":"auto","created_at":"2025-11-11 16:22:19","extension":"emf","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":96664,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage2.emf","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/2133eda94e3d878ad507b660.emf"},{"id":95638765,"identity":"058cf9c2-8c91-45fd-afd0-6e7f08e550e2","added_by":"auto","created_at":"2025-11-11 13:03:44","extension":"png","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":44542,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/6400013151d826a0166856f3.png"},{"id":95657436,"identity":"6724de87-8bd7-465f-937c-ff44cdbba1e2","added_by":"auto","created_at":"2025-11-11 16:20:52","extension":"png","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":22423,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/2ece29be13bdbf154f80f7ca.png"},{"id":95656892,"identity":"59e0801b-877f-4a59-bda5-dc1287a7e799","added_by":"auto","created_at":"2025-11-11 16:19:40","extension":"png","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20070,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/6d20dccf01537dafb71db8b1.png"},{"id":95658188,"identity":"11b04f72-003b-44f5-96ef-503fa3556814","added_by":"auto","created_at":"2025-11-11 16:23:35","extension":"png","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20669,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/3ceddd1207c0b0fb32faf5ed.png"},{"id":95638769,"identity":"20e8c534-9ade-41dc-be87-40e8da0317e4","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":511489,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/4aedde3177befccf776cd976.png"},{"id":95638772,"identity":"3c7cd5c2-bf20-44ab-951d-acfa3023b5d7","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":526931,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/299fc1a981f7482b0413e3b3.png"},{"id":95638773,"identity":"833112db-4134-43dc-b375-42b283ed05ae","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":68311,"visible":true,"origin":"","legend":"","description":"","filename":"floatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/5ab6ca303db93bdd1169e22c.png"},{"id":95638775,"identity":"69746d30-1c49-4efb-b7d7-f8132393e842","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"jpeg","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":20542,"visible":true,"origin":"","legend":"","description":"","filename":"groupimage1.jpeg","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/ace2e01b12f47600960e8546.jpeg"},{"id":95638780,"identity":"286e545c-cd2d-4047-acae-0f1a875fefac","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":935,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/7b270a4c812470e8e0dbb0fb.png"},{"id":95658020,"identity":"9333b27c-ce76-4255-9aba-9959acc808db","added_by":"auto","created_at":"2025-11-11 16:22:42","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":23742,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/e8acee98bc493ae2fb560e94.png"},{"id":95657029,"identity":"456ce8fb-9618-48d7-a567-7f4d460b3aaf","added_by":"auto","created_at":"2025-11-11 16:19:58","extension":"png","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":12948,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/cb8fccd352eb83fa5b49c348.png"},{"id":95657470,"identity":"30ec7c7d-e4c5-4ad8-b9ca-b835716ad57d","added_by":"auto","created_at":"2025-11-11 16:20:55","extension":"png","order_by":16,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6733,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/17a3942bacde2a2cf225e2e9.png"},{"id":95638786,"identity":"bb0f5077-16d0-451c-80f6-015b3474e18f","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":17,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6707,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/00ce8ca5ad245daad54befd5.png"},{"id":95638776,"identity":"411e14ed-7547-4c9e-9119-974255e9fada","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":18,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6801,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/95dbc01f205e1510c98ecd7b.png"},{"id":95638783,"identity":"4f6d079d-b57d-4d71-8c93-2feb3dfa704f","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":19,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":30620,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage7.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/97e5afc81a55ee387444004f.png"},{"id":95638785,"identity":"c00ee3b4-5e6c-4b64-8629-dabeb4782efc","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":20,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":34252,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage8.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/ff53622d4418ae62cce581a2.png"},{"id":95658013,"identity":"122589c6-54f5-4611-9f64-0abb433e71cf","added_by":"auto","created_at":"2025-11-11 16:22:41","extension":"png","order_by":21,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":22338,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefloatimage9.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/5ce762a7ba3a2a1f44831e9c.png"},{"id":95638787,"identity":"221277b9-14b8-4cea-a617-29d2a1ea6e7e","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"png","order_by":22,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":4876,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinegroupimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/8b15fad9e9b66e872c687fe1.png"},{"id":95638781,"identity":"b5d73798-84a6-4534-ab0e-ef6807e27768","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"xml","order_by":23,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":114933,"visible":true,"origin":"","legend":"","description":"","filename":"fdff63e7669047e788e8a99dd193bdbf1structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/df4dd783816370bb7c972862.xml"},{"id":95638784,"identity":"6bd1f577-080f-48e7-b5d2-49ae1c0616d1","added_by":"auto","created_at":"2025-11-11 13:03:45","extension":"html","order_by":24,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":126118,"visible":true,"origin":"","legend":"","description":"","filename":"earlyproof.html","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1/153e43c678807b47ed5545f3.html"},{"id":99768371,"identity":"03fd4854-1b85-4fb6-baa2-6984029c05d5","added_by":"auto","created_at":"2026-01-08 08:26:15","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":638609,"visible":true,"origin":"","legend":"","description":"","filename":"paperv11.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7666636/v1_covered_0f3c7242-2ba0-4d1c-970f-f97359f0c2d7.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Machine-Learning Classification Model and Tools for Real-time URL Phishing Detection","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Phishing, cybersecurity, machine learning, URL analysis, fraud detection, phishing classification, behavioral attributes","lastPublishedDoi":"10.21203/rs.3.rs-7666636/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7666636/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003ePhishing attacks are considered a significant cybersecurity concern, employing deceptive tactics to entice individuals into engaging with counterfeit websites. These malicious pages are skillfully designed replicas of legitimate platforms, aiming to collect sensitive data like usernames, passwords, banking credentials, and other personal details. This study focuses on phishing via Uniform Resource Locators (URLs) and investigates the potential of machine learning to identify such deceptive websites based on their behavior and URL attributes. To accomplish this, the work introduces and demonstrates two key tools; one for dataset creation and the other for URL classification.\u003c/p\u003e\u003cp\u003eMachine learning has already shown its effectiveness in identifying phishing attacks from URLs, though there are still some obstacles to be overcome, such as the need for vast quantities of high-quality training data and the requirement to keep up with the constantly changing tactics employed by phishing attackers. The integration of the proposed tools in a web browser plugin is supposed to enable real-time URL analysis within web browsers, enhancing the system's effectiveness against phishing attacks and hence improving user experience.\u003c/p\u003e\u003cp\u003eUsing a self-collected dataset of 46,000 URLs, several machine learning algorithms were trained and tested including support vector machine (SVM), XGBoost, decision tree, and random forest algorithms. Among these, XGBoost model achieved an impressive classification accuracy of 96%, F1-Score of 96.7%, Recall of 96.6% and Precision 96.9% after assessing various permutations of hyperparameter values using the grid search procedure. This success underscores the potency of machine learning techniques in bolstering cyber defenses and mitigating the impact of phishing attacks.\u003c/p\u003e","manuscriptTitle":"Machine-Learning Classification Model and Tools for Real-time URL Phishing Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-11-11 13:03:40","doi":"10.21203/rs.3.rs-7666636/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"dcc86c2d-4ae1-47cf-b0e9-4f9711ab2489","owner":[],"postedDate":"November 11th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-01-08T08:25:28+00:00","versionOfRecord":[],"versionCreatedAt":"2025-11-11 13:03:40","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7666636","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7666636","identity":"rs-7666636","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}