Cybersecurity Enhancement: Comprehensive Analysis of Machine Learning Models and Conventional Methods for Phishing URL Detection with Automated Domain Blocking

This research deeply emphasizes the rise of cyber threats with the emergence of artificial intelligence. Phishing attacks have rapidly increased in recent days. The conventional rule-based methods are not enough to detect the phishing URLs and require manual intervention. The study highlighted the importance of machine learning models to produce robust solutions for speedy detection of phishing URLs and learn the dynamic pattern of suspicious URLs. During the study, 5 different machine-learning models were introduced for training and prediction. All models obtained better results with high accuracy and F1 scores based on the model evaluation process. The Random Forest Classifier (ensemble bagging model) outperforms with the highest testing accuracy of 99.41% and an F1 score of 99.00%. For further analysis, we explored conventional methods like SSL status for certification, Nmap for HTTP/HTTPS port scanning and security, and WHOIS for domain details. Both SSL and Nmap didn't ensure the legitimacy of any URLs. Details were present for both legitimate and phishing URLs. WHOIS provided the registration name, registrant organization, and registrant address for legitimate URLs where phishing URLs had not disclosed the details. Moreover, their email addresses were asymmetric and suspicious. DNS server names were not similar to their entity despite using the names of the different entities of legitimate URLs. In addition, a web application integrated with machine learning models to interact with the real world. IP extraction was done at the same time to block the IP addresses of phishing domains using the Access Control List (ACL) of the firewall. Therefore, this system can perform detection and prevention of phishing URLs at the same time. Hence, it reduces time and automates the process. Thus the financial sector, telecom operators and network operators can eliminate the cyber threats of credential loss, fraud, financial loss and network compromise effectively.