A performance analysis of SHAP and LIME for interpreting boosting models in phishing URL detection

Phishing websites remain a common and unresolved problem in web security. Despite continuous improvements in detection techniques, attackers continue to exploit URL-level characteristics and social engineering cues to deceive users. As a result, phishing detection systems are increasingly expected not only to achieve high accuracy but also to provide explanations that can be understood and trusted in real-world use. This work presents a comparative analysis of two Explainable Artificial Intelligence frameworks, SHAP and LIME, for interpreting gradient boosting models applied to phishing URL detection. Three boosting models, Gradient Boosting Machine, XGBoost, and LightGBM were trained and evaluated. A publicly available phishing URL dataset consisting of 11,054 instances and 30 URL-based features was used. Model performance was evaluated through 10-fold cross-validation. Model interpretability was analyzed under the same experimental conditions using both explanation techniques. LightGBM showed the strongest predictive performance with an accuracy of 97.60% and a phishing URL detection precision of 98.23%. The explanation patterns produced by SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) differed in both stability and scope. SHAP produced stable feature attributions that were consistent at the global level and useful for model inspection and validation where LIME provided explanations at the individual instance level.