ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION

Hacer Berkil; Özlem Batur Dinler

TR EN

PHISHING URL TESPİTİ İÇİN GELİŞMİŞ HİBRİT ÖZELLİK SEÇİMİ VE BAYESIAN OPTİMİZASYONU

Abstract

Phishing saldırıları, kullanıcıları sahte web sitelerine yönlendirerek hassas bilgileri ele geçirmeyi amaçlayan önemli bir siber güvenlik tehdididir. Kara liste ve kural tabanlı geleneksel yöntemler, özellikle sıfır-gün saldırılarında yetersiz kalabilmektedir. Bu çalışmada, phishing URL tespiti için hibrit özellik seçimi, Bayesian hiperparametre optimizasyonu, model karşılaştırmaları, topluluk öğrenmesi, açıklanabilirlik analizi ve ek doğrulama stratejilerini kapsayan sistematik bir metodolojik kıyaslama (benchmark) çerçevesi sunulmuştur. Deneyler, 88.647 URL ve 111 özelliğe sahip bir veri seti üzerinde yürütülmüş; 7 hibrit özellik seçimi yöntemi, 3 Bayesian optimizasyon tekniği ve 252 optimize edilmiş model yapılandırması, derin öğrenme temel modelleriyle birlikte değerlendirilmiştir. Bulgular, hibrit özellik seçimi ve optimizasyonun ağaç tabanlı modeller üzerinde belirgin katkı sağladığını göstermiştir. L1+Boruta özellik seti ve Scikit-Optimize ile optimize edilen LightGBM modeli en güçlü tek model performansını sergilerken (Test Doğruluk: %97,28, F1: %95,99, AUC: %99,54), en iyi topluluk modeli (CAT+XGB+LGBM, Soft Voting) %97,34 doğruluk, %96,17 F1 ve %99,60 AUC ile benzer bir performans seviyesine ulaşmıştır. Derin öğrenme modelleri daha düşük performans göstermiş, ek doğrulama deneyleri ise topluluk yapısının temel modele kıyasla farklı veri bölünmelerinde de tutarlı bir iyileştirme sağladığını ortaya koymuştur.

Keywords

ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION

Abstract

Phishing attacks are a major cybersecurity threat that aim to steal sensitive information by redirecting users to fraudulent websites. Traditional blacklist- and rule-based methods often remain insufficient, especially against zero-day attacks. This study presents a systematic methodological benchmark framework for phishing URL detection, integrating hybrid feature selection, Bayesian hyperparameter optimization, model comparison, ensemble learning, explainability analysis, and additional validation strategies. Experiments were conducted on a dataset of 88,647 URLs with 111 features, evaluating 7 hybrid feature selection methods, 3 Bayesian optimization techniques, and 252 optimized model configurations, complemented by deep learning baselines. The findings show that hybrid feature selection and optimization provide a clear contribution, particularly for tree-based models. The LightGBM model optimized on the L1+Boruta feature set with Scikit-Optimize produced the strongest single-model performance (Test Accuracy: 97.28%, F1: 95.99%, AUC: 99.54%), while the best ensemble (CAT+XGB+LGBM, Soft Voting) reached 97.34% accuracy, 96.17% F1, and 99.60% AUC — a comparable level of performance. Deep learning models yielded lower performance, while additional validation experiments demonstrated that the ensemble structure provided a consistent improvement over the baseline across different data splits.

Keywords

Supporting Institution

This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.

Ethical Statement

This study does not require ethical approval as it uses a publicly available dataset and does not involve human subjects, animals, or personal data collection.

Thanks

The authors would like to thank Vrbančič et al. for making the phishing URL dataset publicly available, which made this research possible.

References

Akiba, T., Sano, S., Yanase, T., Ohta, T., & Koyama, M. (2019). Optuna: A next-generation hyperparameter optimization framework. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2623–2631. https://doi.org/10.1145/3292500.3330701
Aydemir, M. (2024). Siberuzamda suç tipolojileri ve siber iletişim tabanlı çözümleme modelinin analizi. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 27(4), 1375–1400. https://doi.org/10.17780/ksujes.1477116
Batur Dinler, Ö., & Batur Şahin, C. (2021). Prediction of phishing web sites with deep learning using WEKA environment. European Journal of Science and Technology, 24, 35–41. https://doi.org/10.31590/ejosat.901465
Batur Dinler, Ö., Batur Şahin, C., & Abualigah, L. (2021). Comparison of performance of phishing web sites with different DeepLearning4J models. European Journal of Science and Technology, 28, 425–431. https://doi.org/10.31590/ejosat.1004778
Bergstra, J., & Bengio, Y. (2012). Random search for hyper-parameter optimization. Journal of Machine Learning Research, 13, 281-305.
Bergstra, J., Yamins, D., & Cox, D. D. (2013). Making a science of model search: Hyperparameter optimization in hundreds of dimensions for vision architectures. In Proceedings of the 30th International Conference on Machine Learning (ICML), PMLR 28(1), 115-123.
Chawla, N. V., Bowyer, K. W., Hall, L. O., & Kegelmeyer, W. P. (2002). SMOTE: Synthetic minority over-sampling technique. Journal of Artificial Intelligence Research, 16, 321-357. https://doi.org/10.1613/jair.953
Chen, T., & Guestrin, C. (2016). XGBoost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD, 785-794. https://doi.org/10.1145/2939672.2939785

Güneş, H., Aktürk, C., & Talan, T. (2025). A hybrid CNN-LSTM approach for brain tumor classification: A comparative performance analysis with conventional classifiers. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 28(3), 1219–1233. https://doi.org/10.17780/ksujes.1638455
Jain, A. K., & Gupta, B. B. (2019). A machine learning based approach for phishing detection using hyperlinks information. Journal of Ambient Intelligence and Humanized Computing, 10(5), 2015-2028. https://doi.org/10.1007/s12652-018-0798-z
Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye, Q., & Liu, T.-Y. (2017). LightGBM: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems, 30, 3146–3154.
Kursa, M. B., & Rudnicki, W. R. (2010). Feature selection with the Boruta package. Journal of Statistical Software, 36(11), 1-13. https://doi.org/10.18637/jss.v036.i11
Lale, T. (2025). Tabular Transformer architecture with Optuna optimization for early diagnosis of Alzheimer’s disease. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 28(4), 2014–2031. https://doi.org/10.17780/ksujes.1772927
Lundberg, S. M., & Lee, S. I. (2017). A unified approach to interpreting model predictions. Advances in Neural Information Processing Systems, 30, 4768–4777.
Mienye, I. D., & Sun, Y. (2022). A survey of ensemble learning: Concepts, algorithms, applications, and prospects. IEEE Access, 10, 99129-99149. https://doi.org/10.1109/ACCESS.2022.3207287
Mohammad, R. M., Thabtah, F., & McCluskey, T.L. (2014). Predicting phishing websites based on self-structuring neural network. Neural Computing and Applications, 25, 443-458. https://doi.org/10.1007/s00521-013-1490-z
Prokhorenkova, L., Gusev, G., Vorobev, A., Dorogush, A. V., & Gulin, A. (2018). CatBoost: Unbiased boosting with categorical features. Advances in Neural Information Processing Systems, 31, 6639–6649.
Pudjihartono, N., Fadason, T., Kempa-Liehr, A. W., & O'Sullivan, J. M. (2022). A review of feature selection methods for machine learning-based disease risk prediction. Frontiers in Bioinformatics, 2, 927312. https://doi.org/10.3389/fbinf.2022.927312
Rao, R. S., & Pais, A. R. (2019). Detection of phishing websites using an efficient feature-based machine learning framework. Neural Computing and Applications, 31, 3851–3873. https://doi.org/10.1007/s00521-017-3305-0
Saeys, Y., Abeel, T., & Van de Peer, Y. (2008). Robust Feature Selection Using Ensemble Feature Selection Techniques. In: Daelemans, W., Goethals, B., Morik, K. (eds) Machine Learning and Knowledge Discovery in Databases. ECML PKDD 2008. Lecture Notes in Computer Science, 5212. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-87481-2_21
Sahingoz, O. K., Buber, E., Demir, O., & Diri, B. (2019). Machine learning based phishing detection from URLs. Expert Systems with Applications, 117, 345-357. https://doi.org/10.1016/j.eswa.2018.09.029
Seijo-Pardo, B., Porto-Díaz, I., Bolón-Canedo, V., & Alonso-Betanzos, A. (2017). Ensemble feature selection: Homogeneous and heterogeneous approaches. Knowledge-Based Systems, 118, 124-139. https://doi.org/10.1016/j.knosys.2016.11.017
Tümse, S. (2025). LSTM, XGBoost and Random Forest models in forecasting current and future electricity consumption in Türkiye. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 28(4), 2139–2148. https://doi.org/10.17780/ksujes.1785928
Uzun Arslan, R., Şenyer Yapıcı, İ., & Erkaymaz, O. (2024). Diyabet risk durumunun belirlenmesinde sınıflandırma algoritmalarının performanslarının kapsamlı bir şekilde karşılaştırılması. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 27(4), 1320–1333. https://doi.org/10.17780/ksujes.1465177
Vrbančič, G., Fister Jr, I., & Podgorelec, V. (2020). Datasets for phishing websites detection. Data in Brief, 33, 106438. https://doi.org/10.1016/j.dib.2020.106438

Details

Primary Language

English

Subjects

System and Network Security

Journal Section

Research Article

Authors

Hacer Berkil
0009-0007-4605-6148
Türkiye

Özlem Batur Dinler ^*
0000-0002-2955-6761
Türkiye

Publication Date

June 3, 2026

Submission Date

November 28, 2025

Acceptance Date

April 24, 2026

Published in Issue

Year 2026 Volume: 29 Number: 2

IZ

https://izlik.org/JA44UW96BD

Cite

RIS / Bibtex

APA

Berkil, H., & Batur Dinler, Ö. (2026). ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, 29(2), 678-698. https://izlik.org/JA44UW96BD

AMA

1.Berkil H, Batur Dinler Ö. ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION. KSU J. Eng. Sci. 2026;29(2):678-698. https://izlik.org/JA44UW96BD

Chicago

Berkil, Hacer, and Özlem Batur Dinler. 2026. “ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION”. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi 29 (2): 678-98. https://izlik.org/JA44UW96BD.

EndNote

Berkil H, Batur Dinler Ö (June 1, 2026) ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi 29 2 678–698.

IEEE

[1]H. Berkil and Ö. Batur Dinler, “ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION”, KSU J. Eng. Sci., vol. 29, no. 2, pp. 678–698, June 2026, [Online]. Available: https://izlik.org/JA44UW96BD

ISNAD

Berkil, Hacer - Batur Dinler, Özlem. “ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION”. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi 29/2 (June 1, 2026): 678-698. https://izlik.org/JA44UW96BD.

JAMA

1.Berkil H, Batur Dinler Ö. ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION. KSU J. Eng. Sci. 2026;29:678–698.

MLA

Berkil, Hacer, and Özlem Batur Dinler. “ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION”. Kahramanmaraş Sütçü İmam Üniversitesi Mühendislik Bilimleri Dergisi, vol. 29, no. 2, June 2026, pp. 678-9, https://izlik.org/JA44UW96BD.

Vancouver

1.Hacer Berkil, Özlem Batur Dinler. ADVANCED HYBRID FEATURE SELECTION AND BAYESIAN OPTIMIZATION FOR PHISHING URL DETECTION. KSU J. Eng. Sci. [Internet]. 2026 Jun. 1;29(2):678-9. Available from: https://izlik.org/JA44UW96BD