Enhancing Phishing Detection through Feature Importance Analysis and Explainable AI: A Comparative Study of CatBoost, XGBoost, and EBM Models

TL;DR

This study compares machine learning models like CatBoost, XGBoost, and EBM for phishing URL detection, emphasizing feature importance and explainability to improve accuracy, robustness, and transparency in cybersecurity defenses.

Contribution

It introduces a comprehensive evaluation of feature selection and explainable AI techniques across multiple models for enhanced phishing detection.

Findings

XGBoost is highly efficient for large datasets.

CatBoost maintains high accuracy with fewer features.

SHAP provides valuable insights into feature importance.

Abstract

Phishing attacks remain a persistent threat to online security, demanding robust detection methods. This study investigates the use of machine learning to identify phishing URLs, emphasizing the crucial role of feature selection and model interpretability for improved performance. Employing Recursive Feature Elimination, the research pinpointed key features like "length_url," "time_domain_activation" and "Page_rank" as strong indicators of phishing attempts. The study evaluated various algorithms, including CatBoost, XGBoost, and Explainable Boosting Machine, assessing their robustness and scalability. XGBoost emerged as highly efficient in terms of runtime, making it well-suited for large datasets. CatBoost, on the other hand, demonstrated resilience by maintaining high accuracy even with reduced features. To enhance transparency and trustworthiness, Explainable AI techniques, such as SHAP, were employed to provide insights into feature importance. The study's findings highlight that effective feature selection and model interpretability can significantly bolster phishing detection systems, paving the way for more efficient and adaptable defenses against evolving cyber threats