A feature-engineered dataset of benign and phishing URLs for machine learning and large language models evaluation

TL;DR

This paper introduces a feature-rich dataset of 111,660 URLs labeled as benign or phishing, enabling better evaluation of machine learning and large language models for cybersecurity.

Contribution

The paper provides a curated, feature-engineered dataset for phishing detection with reproducible benchmarks for ML and LLM models.

Findings

The dataset includes 22 numerical features and 26 total columns for URL-based phishing detection.

Baseline models achieved over 96% accuracy and ROC AUC scores above 0.99.

The dataset supports reproducible benchmarks and future research on adversarial robustness.

Abstract

Phishing websites remain a major cybersecurity threat, yet the availability of balanced and feature-rich datasets for evaluating detection models is still limited. While machine learning (ML) and large language models (LLMs) have shown strong potential in URL-based classification, most public datasets provide raw URLs without feature engineering, making reproducibility and fair comparison across models difficult. To address this gap, we present a curated dataset of 111,660 URLs, consisting of 100,000 benign samples (label 0) and 11,660 phishing samples (label 1). Each URL entry is enriched with 22 numerical lexical and structural features (e.g., URL length, domain length, digit ratio, entropy, HTTPS usage). Additionally, three string reference columns (URL, domain, TLD) are preserved for interpretability, and one label column (0 = benign, 1 = phishing), totaling 26 columns. To demonstrate its utility, we evaluate two baseline approaches: a Random Forest (RF) classifier using handcrafted features, and a MiniLM embedding model with Logistic Regression (LR). Both achieved accuracy above 96 % and ROC AUC scores exceeding 0.99 across training, validation, and test splits. This dataset represents an important step toward building reproducible and comparable benchmarks for phishing detection, bridging traditional ML and LLM-based approaches, and supporting future research on adversarial robustness and scalable security models.

Figures