An Explainable and Robust Machine Learning Framework for Detecting Phishing URLs

Phishing is still a big cybersecurity threat, where criminals send fake and harmful links that take users to fake websites to steal sensitive information like login credentials, financial details and personal data. Machine learning (ML) techniques have been applying to phishing URL detection more and more by learning patterns from lexical, structural and domain-relates characteristics of URLs. However, existing methods are mostly designed to improve the accuracy of traditional classification and usually provide little insight into why a particular URL is classified as phishing or legitimate. Furthermore, many existing detection models can be less effective when attackers modify URL features to evade detection or when models are tested on data that differs from the training distribution. To overcome these limitations, this paper proposes an explainable and robust machine learning framework for phishing URL detection by unifying detection, interpretability and robustness evaluation. The proposed framework considers URL-based feature extraction, machine learning classification and Explainable Artificial Intelligence (XAI) techniques to identify the features that contribute to the model predictions. Moreover, robustness analysis is added to investigate the robustness of detection models against URL manipulation and evasion techniques. Besides, cross-dataset evaluation is considered to evaluate the generalization of the framework on different phishing URL datasets. In this work, we systematically review existing phishing URL detection methods, identify shortcomings in terms of interpretability, robustness and generalization and propose a conceptual direction to integrate these aspects into a reliable detection framework. The proposed research is expected to contribute toward a more transparent, robust and practically applicable machine learning-based approach for phishing URL detection and to provide a foundation for the future development of trustworthy cybersecurity detection systems.