Feature Engineering for Phishing Website Detection Using Machine Learning: A Systematic Review

Phishing website detection has been widely explored, yet most existing surveys focus on detection algorithms or general cybersecurity methods, offering only a brief treatment of feature engineering. This systematic literature review addresses this gap by analyzing recent studies on feature engineering for phishing URL detection using machine learning. The review categorizes feature types, such as URL/lexical, HTML/content, domain, behavioral, and emerging derived and hybrid features, and examines the application of feature selection and dimensionality reduction techniques. The findings reveal a persistent reliance on URL/lexical features for their simplicity and broad applicability, despite growing interest in integrating content-based and composite approaches for improved robustness. Key challenges include adapting to evolving phishing tactics, handling dataset limitations, mitigating high dimensionality, and balancing computational efficiency with detection accuracy. The review also identifies opportunities that have been underexplored in prior work, such as leveraging explainable AI methods (e.g., SHAP, LIME) to validate and optimize feature sets, expanding cross-lingual and adversarial-resilient features, and developing lightweight solutions for real-time or resource-constrained environments. This study offers a targeted roadmap for advancing phishing detection research by consolidating and reviewing the role of feature engineering. It highlights its pivotal role in creating more accurate, adaptive, and efficient detection systems.