Model Performance Details
← Back

Model Details

Performance metrics, feature importance, and configuration details for all 9 machine learning models used in the phishing detection pipeline. Models span URL features (125), RAW HTML features (77) + engineered (23), combined features (225), and character-level CNN approaches.

Detection Pipeline
1URL Input
2Feature Extraction
33 URL Models
4HTML Download
52 HTML + 2 Combined
62 CNN Models
79-Model Consensus
URL Features 125 features +
All features extracted from the URL string. Hover over any feature to see its description.
Length & Structure
url_length
domain_length
path_length
query_length
url_length_category
domain_length_category
Character Counts
num_dots
num_hyphens
num_underscores
num_slashes
num_question_marks
num_ampersands
num_equals
num_at
num_percent
num_digits_url
num_letters_url
domain_dots
domain_hyphens
domain_digits
path_slashes
path_dots
path_digits
Character Ratios
digit_ratio_url
letter_ratio_url
special_char_ratio
digit_ratio_domain
symbol_ratio_domain
Domain Structure
num_subdomains
num_domain_parts
tld_length
sld_length
longest_domain_part
avg_domain_part_len
longest_part_gt_20
longest_part_gt_30
longest_part_gt_40
has_suspicious_tld
has_trusted_tld
has_port
has_non_std_port
domain_randomness_score
sld_consonant_cluster_score
sld_keyboard_pattern
sld_has_dictionary_word
sld_pronounceability_score
domain_digit_position_suspicious
Path Analysis
path_depth
max_path_segment_len
avg_path_segment_len
has_extension
extension_category
has_suspicious_extension
has_exe
has_double_slash
path_has_brand_not_domain
path_has_ip_pattern
suspicious_path_extension_combo
Query String
num_params
has_query
query_value_length
max_param_len
query_has_url
Statistical & Entropy
url_entropy
domain_entropy
path_entropy
max_consecutive_digits
max_consecutive_chars
max_consecutive_consonants
char_repeat_rate
unique_bigram_ratio
unique_trigram_ratio
sld_letter_diversity
domain_has_numbers_letters
url_complexity_score
Security Indicators
has_ip_address
has_at_symbol
has_redirect
is_shortened
is_free_hosting
is_free_platform
platform_subdomain_length
has_uuid_subdomain
is_http
Keywords & Brand Detection
num_phishing_keywords
phishing_in_domain
phishing_in_path
num_brands
brand_in_domain
brand_in_path
brand_impersonation
has_login
has_account
has_verify
has_secure
has_update
has_bank
has_password
has_suspend
has_webscr
has_cmd
has_cgi
brand_in_subdomain_not_domain
multiple_brands_in_url
brand_with_hyphen
suspicious_brand_tld
brand_keyword_combo
Encoding & Obfuscation
has_url_encoding
encoding_count
encoding_diff
has_punycode
has_unicode
has_hex_string
has_base64
has_lookalike_chars
mixed_script_score
homograph_brand_risk
suspected_idn_homograph
double_encoding
encoding_in_domain
suspicious_unicode_category
RAW HTML Features 77 raw features + 23 engineered +
All features extracted from HTML source and DOM structure. Hover over any feature to see its description.
Document Size & Text
dom_depth
html_length
text_length
num_words
text_to_html_ratio
inline_css_length
num_tags
Metadata & Page Identity
has_title
has_description
has_keywords
has_author
has_copyright
has_viewport
has_favicon
num_meta_tags
DOM Elements & Layout
num_divs
num_spans
num_paragraphs
num_headings
num_lists
num_tables
num_images
num_iframes
num_hidden_iframes
num_data_uri_images
num_css_files
num_scripts
num_inline_scripts
num_inline_styles
num_input_fields
Link & Resource Analysis
num_links
num_internal_links
num_external_links
ratio_external_links
num_unique_external_domains
num_mailto_links
num_javascript_links
num_ip_based_links
num_suspicious_tld_links
num_empty_links
num_anchor_text_mismatch
num_external_css
num_external_images
num_external_scripts
Forms & Inputs
has_form
has_login_form
num_forms
num_email_fields
num_password_fields
num_text_fields
num_submit_buttons
num_hidden_fields
num_forms_without_labels
num_empty_form_actions
num_external_form_actions
password_with_external_action
Scripts & Dynamic Behavior
has_eval
has_escape
has_unescape
has_atob
has_base64
has_fromcharcode
has_document_write
has_window_open
has_location_replace
has_meta_refresh
num_onclick_events
num_onload_events
num_onerror_events
Visibility & Interaction Tricks
has_display_none
has_visibility_hidden
has_right_click_disabled
has_status_bar_customization
Contact & Social Engineering Signals
has_email_address
has_phone_number
num_brand_mentions
num_urgency_keywords
Ratios & Proportions
forms_to_inputs_ratio
external_to_total_links
scripts_to_tags_ratio
hidden_to_visible_inputs
password_to_inputs_ratio
empty_to_total_links
images_to_tags_ratio
iframes_to_tags_ratio
Co-occurrence Interactions
forms_with_passwords
external_scripts_links
urgency_with_forms
brand_with_forms
iframes_with_scripts
hidden_with_external
Content Density
content_density
form_density
scripts_per_form
links_per_word
Composite Risk Scores
phishing_risk_score
form_risk_score
obfuscation_score
legitimacy_score
Boolean Flags
has_suspicious_elements
3 models trained on 120 URL-based features extracted from the URL string structure, domain properties, encoding analysis, and brand impersonation detection.
Logistic Regression
Baseline
93.71%
Accuracy
95.40%
Precision
91.84%
Recall
93.59%
F1-Score
0.9789
ROC-AUC
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
10,326
478
Actual Phish
881
9,922
Random Forest
Ensemble
97.63%
Accuracy
99.01%
Precision
96.22%
Recall
97.60%
F1-Score
0.9958
ROC-AUC
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
10,700
104
Actual Phish
408
10,395
Top 20 Features by Importance
1domain_length
0.0500
2num_domain_parts
0.0471
3domain_dots
0.0453
4num_subdomains
0.0393
5num_dots
0.0337
6domain_length_category
0.0335
7symbol_ratio_domain
0.0324
8digit_ratio_url
0.0298
9path_length
0.0297
10avg_domain_part_len
0.0292
11num_digits_url
0.0283
12domain_entropy
0.0282
13url_entropy
0.0266
14max_consecutive_digits
0.0246
15special_char_ratio
0.0242
16is_shortened
0.0237
17path_entropy
0.0225
18max_path_segment_len
0.0215
19num_letters_url
0.0206
20path_slashes
0.0201
XGBoost
Gradient Boosting
97.85%
Accuracy
99.00%
Precision
96.68%
Recall
97.82%
F1-Score
0.9953
ROC-AUC
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
10,698
106
Actual Phish
359
10,444
Top 20 Features by Importance
1domain_dots
0.2514
2is_shortened
0.1519
3num_subdomains
0.1423
4num_domain_parts
0.0492
5multiple_brands_in_url
0.0350
6is_free_platform
0.0281
7domain_hyphens
0.0252
8path_digits
0.0149
9is_http
0.0139
10platform_subdomain_length
0.0123
11avg_domain_part_len
0.0121
12path_slashes
0.0119
13brand_in_path
0.0111
14domain_length_category
0.0108
15domain_length
0.0106
16symbol_ratio_domain
0.0100
17encoding_diff
0.0087
18num_brands
0.0077
19tld_length
0.0071
20digit_ratio_url
0.0067
2 models trained on 100 HTML-based features extracted from the page structure, forms, scripts, links, and content analysis of downloaded web pages.
Random Forest HTML
Ensemble
89.65%
Accuracy
91.78%
Precision
87.11%
Recall
89.38%
F1-Score
0.9617
ROC-AUC
89.05%
CV F1 (5-fold)
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
15,012
1,271
Actual Phish
2,099
14,184
Hyperparameters
n_estimators500
max_depth35
min_samples_split2
min_samples_leaf1
max_featuressqrt
class_weightbalanced
XGBoost HTML
Gradient Boosting
89.07%
Accuracy
90.27%
Precision
87.56%
Recall
88.90%
F1-Score
0.9590
ROC-AUC
88.87%
CV F1 (5-fold)
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
14,747
1,536
Actual Phish
2,025
14,258
Hyperparameters
n_estimators600
max_depth8
learning_rate0.05
subsample0.8
colsample_bytree0.8
min_child_weight3
gamma0.1
reg_alpha0.1
reg_lambda1.0
early_stopping50 rounds
2 models trained on 221 combined features (121 URL + 100 HTML) for maximum detection accuracy.
Random Forest Combined
Ensemble
98.60%
Accuracy
99.16%
Precision
98.02%
Recall
98.59%
F1-Score
0.9990
ROC-AUC
98.59%
CV F1 (5-fold)
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
10,680
89
Actual Phish
213
10,556
Feature Importance Split
URL 29.1%
HTML 70.9%
Top 15 Features by Importance
1html_num_links
0.0640
2html_text_length
0.0577
3html_num_tags
0.0479
4html_num_internal_links
0.0463
5html_num_words
0.0422
6html_external_scripts_links
0.0361
7html_num_divs
0.0297
8html_num_lists
0.0291
9html_num_external_links
0.0276
10html_has_description
0.0258
11html_num_unique_external_domains
0.0236
12html_num_images
0.0231
13html_num_spans
0.0226
14html_num_headings
0.0220
15html_dom_depth
0.0210
Hyperparameters
n_estimators533
max_depth43
min_samples_split2
max_featuressqrt
class_weightbalanced
XGBoost Combined
Gradient Boosting
99.01%
Accuracy
99.35%
Precision
98.66%
Recall
99.01%
F1-Score
0.9991
ROC-AUC
98.90%
CV F1 (5-fold)
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
10,700
69
Actual Phish
144
10,625
Feature Importance Split
URL 37.1%
HTML 62.9%
Top 15 Features by Importance
1html_num_links
0.4420
2url_is_shortened
0.0427
3url_platform_subdomain_length
0.0397
4url_domain_dots
0.0315
5html_has_fromcharcode
0.0296
6url_num_domain_parts
0.0269
7html_has_meta_refresh
0.0148
8url_is_http
0.0126
9url_encoding_diff
0.0124
10url_path_digits
0.0116
11html_text_length
0.0107
12url_path_slashes
0.0105
13url_multiple_brands_in_url
0.0103
14url_brand_in_path
0.0102
15url_domain_hyphens
0.0095
Hyperparameters
n_estimators726
max_depth6
learning_rate0.137
subsample0.698
2 character-level CNN models that process raw text directly — no hand-crafted features needed. Parallel Conv1D branches with kernel sizes (3, 5, 7) capture patterns at different scales.
CNN URL (Char-level)
Deep Learning
98.38%
Accuracy
98.88%
Precision
97.86%
Recall
98.37%
F1-Score
0.9976
ROC-AUC
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
8,013
90
Actual Phish
173
7,930
Architecture
InputRaw URL characters
max_len800
vocab_size87
Conv1D kernels3, 5, 7
Dataset108,034 URLs
CNN HTML (Char-level)
Deep Learning
96.33%
Accuracy
98.18%
Precision
94.41%
Recall
96.26%
F1-Score
0.9908
ROC-AUC
Confusion Matrix
Pred Legit
Pred Phish
Actual Legit
5,943
106
Actual Phish
338
5,711
Architecture
InputRaw HTML source
max_len5,000
vocab_size100
Conv1D kernels3, 5, 7
Dataset80,652 HTML pages
Side-by-side comparison of all 9 models across URL, HTML, Combined, and CNN categories.
All Models
Model Category Accuracy Precision Recall F1-Score ROC-AUC Features
Logistic Regression URL 93.71% 95.40% 91.84% 93.59% 0.9789 121
Random Forest URL 97.71% 99.06% 96.33% 97.68% 0.9958 121
XGBoost URL 98.07% 99.12% 97.00% 98.05% 0.9963 121
Random Forest HTML HTML 88.03% 87.49% 88.74% 88.11% 0.9561 100
XGBoost HTML HTML 87.86% 86.45% 89.80% 88.09% 0.9557 100
RF Combined Combined 98.60% 99.16% 98.02% 98.59% 0.9990 221
XGBoost Combined Combined 99.01% 99.35% 98.66% 99.01% 0.9991 221
CNN URL CNN 98.38% 98.88% 97.86% 98.37% 0.9976 chars
CNN HTML CNN 96.33% 98.18% 94.41% 96.26% 0.9908 chars
Key Insights
Best Overall
XGBoost Combined
99.01% accuracy, 99.35% precision — best performance by combining 121 URL + 100 HTML features.
Ensemble Strength
9-Model Consensus
Combining 3 URL + 2 HTML + 2 Combined + 2 CNN models via majority vote maximizes reliability.
Top Signal
html_num_links
Number of links in HTML dominates XGBoost Combined at 44.2% importance — the single strongest feature.