AI-Based Phishing Website Detection Using Machine Learning: A Comprehensive and Critical Literature Review

Author

Ms. Akansha S. Malthankar, Mrs. Shubhangi P. Bomble

Abstract

 Phishing websites are a major cybersecurity threat in which attackers imitate legitimate websites to deceive users into revealing sensitive information, such as usernames, passwords, financial credentials, and personal data. Traditional phishing detection mechanisms such as blacklists, whitelists, and manually defined rules are useful for known threats but are often unable to detect newly created and rapidly changing phishing websites. Artificial intelligence (AI) and machine learning (ML) have therefore emerged as important approaches for automatically identifying phishing websites using URLs, domains, HTML, JavaScript, webpage content, and visual features.

This study presents a comprehensive and critical literature review of AI-based phishing website detection techniques. Sixty relevant studies published across journals, conferences, and scholarly sources are reviewed, covering classical machine learning, ensemble learning, deep learning, transformer-based models, feature engineering, visual similarity, dataset construction, explainable AI, adversarial robustness, and real-time deployment. The literature shows that random forest, support vector machine, gradient boosting, XGBoost, CNN, LSTM, and transformer-based models can achieve high classification performance under specific experimental conditions. However, reported performance depends strongly on dataset characteristics, feature representation, class balance, and evaluation methodology. Recent studies have also shown that models achieving high accuracy on randomly divided datasets may exhibit poor generalization when evaluated on newly generated domains or independent datasets. Therefore, accuracy alone is not sufficient to establish the practical effectiveness of a phishing detection system. This review identifies important research gaps related to temporal generalization, cross-dataset evaluation, feature engineering, explainability, adversarial robustness, computational efficiency, and real-time deployment. Finally, a research framework is proposed for developing adaptive, explainable, and lightweight AI-based phishing website detection systems.

Keywords

phishing website, machine learning, artificial intelligence, phishing URL, deep learning, random forest, ensemble learning, transformer, explainable AI, and cybersecurity.

Full Text:

Download Paper PDF

References

[1] A. K. Jain and B. B. Gupta, “Phishing Detection: Analysis of Visual Similarity Based Approaches,” Security and Communication Networks, 2017, Article ID 5421046, doi: 10.1155/2017/5421046.

[2] E. Medvet, E. Kirda, and C. Kruegel, “Visual-Similarity-Based Phishing Detection,” Proceedings of SecureComm, 2008, doi: 10.1145/1460877.1460905.

[3] W. Liu, G. Huang, X. Liu, M. Zhang, and X. Deng, “Detection of Phishing Webpages Based on Visual Similarity,” Proceedings of WWW, 2005, pp. 1060–1061, doi: 10.1145/1062745.1062868.

[4] A. Safi and S. Singh, “A Systematic Literature Review on Phishing Website Detection Techniques,” Journal of King Saud University – Computer and Information Sciences, vol. 35, no. 2, pp. 590–611, 2023, doi: 10.1016/j.jksuci.2023.01.004.

[5] G. Xiang, J. Hong, C. P. Rose, and L. Cranor, “CANTINA+: A Feature-Rich Machine Learning Framework for Detecting Phishing Web Sites,” ACM Transactions on Information and System Security, vol. 14, no. 2, 2011, doi: 10.1145/2019599.2019606.

[6] S. Hutchinson, Z. Zhang, and Q. Liu, “Detecting Phishing Websites with Random Forest,” Machine Learning and Intelligent Communications, 2018, doi: 10.1007/978-3-030-00557-3_46.

[7] J.-L. Chen, Y.-W. Ma, and K.-L. Huang, “Intelligent Visual Similarity-Based Phishing Websites Detection,” Symmetry, vol. 12, no. 10, 1681, 2020, doi: 10.3390/sym12101681.

[8] “Visual Similarity Based Anti-phishing with the Combination of Local and Global Features,” IEEE TrustCom, 2014, doi: 10.1109/TrustCom.2014.28.

[9] A. K. Jain and B. B. Gupta, “Phishing Detection: Analysis of Visual Similarity Based Approaches,” Security and Communication Networks, 2017, doi: 10.1155/2017/5421046.

[10] M. Wang, L. Song, L. Li, Y. Zhu, and J. Li, “Phishing Webpage Detection Based on Global and Local Visual Similarity,” Expert Systems with Applications, vol. 252, 124120, 2024, doi: 10.1016/j.eswa.2024.124120.

[11] G. Xiang, J. Hong, C. P. Rose, and L. Cranor, “CANTINA+: A Feature-Rich Machine Learning Framework for Detecting Phishing Web Sites,” ACM TISSEC, 2011, doi: 10.1145/2019599.2019606.

[12] “Survey on Detection and Prevention of Phishing Websites Using Machine Learning,” IEEE ICACITE, 2021, doi: 10.1109/ICACITE51222.2021.9404714.

[13] “Phishing Website Detection Using Random Forest and Support Vector Machine: A Comparison,” IEEE AiDAS, 2021, doi: 10.1109/AiDAS53897.2021.9574282.

[14] “URL Phishing Detection Using Machine Learning Techniques Based on URLs Lexical Analysis,” IEEE ICICS, 2021, doi: 10.1109/ICICS52457.2021.9464539.

[15] A. Al-Alyan and S. Al-Ahmadi, “Robust URL Phishing Detection Based on Deep Learning,” KSII Transactions on Internet and Information Systems, vol. 14, no. 7, 2020, doi: 10.3837/tiis.2020.07.001.

[16] “Malicious URL Detection Using NLP, Machine Learning and FLASK,” IEEE ICSES, 2021, doi: 10.1109/ICSES52305.2021.9633889.

[17] “A Comparative Analysis of Machine Learning-Based Website Phishing Detection Using URL Information,” IEEE PRAI, 2022, doi: 10.1109/PRAI55851.2022.9904055.

[18] “Phishing Website Detection Using Machine Learning Methods,” IEEE ICIICS, 2023, doi: 10.1109/ICIICS59993.2023.10420933.

[19] “Phishing URL Detection: A Real-Case Scenario Through Login URLs,” IEEE Access, vol. 10, pp. 42949–42960, 2022, doi: 10.1109/ACCESS.2022.3168681.

[20] “Phishing URL Detection Using Machine Learning: A Comparative Study,” IEEE ICMCSI, 2025, doi: 10.1109/ICMCSI64620.2025.10883082.

[21] R. Yang et al., “Phishing Website Detection Based on Deep Convolutional Neural Network and Random Forest Ensemble Learning,” Sensors, vol. 21, no. 24, 8281, 2021, doi: 10.3390/s21248281.

[22] “Phishing Website Detection Using Machine Learning with URL Analysis,” IEEE AIC, 2022, doi: 10.1109/AIC55036.2022.9848895.

[23] “Phishing Website Detection Using LGBM Classifier With URL-Based Lexical Features,” IEEE SILCON, 2022, doi: 10.1109/SILCON55242.2022.10028793.

[24] M. Selvakumari, M. Sowjanya, S. Das, and S. Padmavathi, “Phishing Website Detection Using Machine Learning and Deep Learning Techniques,” Journal of Physics: Conference Series, vol. 1916, 012169, 2021, doi: 10.1088/1742-6596/1916/1/012169.

[25] Y. Mourtaji et al., “Hybrid Rule-Based Solution for Phishing URL Detection Using Convolutional Neural Network,” Wireless Communications and Mobile Computing, 2021, Article ID 8241104, doi: 10.1155/2021/8241104.

[26] “Phishing Website Detection: How Effective Are Deep Learning-Based Models and Hyperparameter Optimization?” Security and Privacy, 2022, doi: 10.1002/spy2.256.

[27] J. K. Joshma and V. Sankar P, “Phishing Website Detection,” Indian Journal of Data Mining, 2024, doi: 10.54105/ijdm.A1642.04010524.

[28] “Intelligent Deep Machine Learning Cyber Phishing URL Detection Based on BERT Features Extraction,” Electronics, vol. 11, no. 22, 3647, 2022, doi: 10.3390/electronics11223647.

[29] “Detecting Phishing URLs Using the BERT Transformer Model,” IEEE BigData, 2023, doi: 10.1109/BigData59044.2023.10386782.

[30] “PhishTransformer: A Novel Approach to Detect Phishing Attacks Using URL Collection and Transformer,” Electronics, vol. 13, no. 1, 30, 2024, doi: 10.3390/electronics13010030.

[31] “Automatic Phishing Website Detection and Prevention Model Using Transformer Deep Belief Network,” Computers & Security, vol. 147, 104071, 2024, doi: 10.1016/j.cose.2024.104071.

[32] M. Bahaghighat, M. Ghasemi, and F. Özen, “A High-Accuracy Phishing Website Detection Method Based on Machine Learning,” Journal of Information Security and Applications, vol. 77, 103553, 2023, doi: 10.1016/j.jisa.2023.103553.

[33] A. Chawla, “Phishing Website Analysis and Detection Using Machine Learning,” International Journal of Intelligent Systems and Applications in Engineering, vol. 10, no. 1, pp. 10–16, 2022, doi: 10.18201/ijisae.2022.262.

[34] “Phishing Attacks Detection Using Ensemble Machine Learning Algorithms,” Computers, Materials & Continua, vol. 80, no. 1, pp. 1325–1345, 2024, doi: 10.32604/cmc.2024.051778.

[35] R. Choutapally and T. Das, “Web-Based Machine Learning Framework for Phishing URL Detection and Analysis,” IEEE Conference on Artificial Intelligence, 2025, doi: 10.1109/CAI64502.2025.00170.

[36] “Website Phishing Detection of Machine Learning Approach Using SMOTE Method,” IEEE ICECCT, 2023, doi: 10.1109/ICECCT56650.2023.10179745.

[37] F. Rashid, B. Doyle, S. C. Han, and S. Seneviratne, “Phishing URL Detection Generalisation Using Unsupervised Domain Adaptation,” Computer Networks, vol. 245, 110398, 2024, doi: 10.1016/j.comnet.2024.110398.

[38] “Phishing or Not Phishing? A Survey on the Detection of Phishing Websites,” IEEE Access, vol. 11, pp. 18499–18519, 2023, doi: 10.1109/ACCESS.2023.3247135.

[39] C. Catal, G. Giray, B. Tekinerdogan, S. Kumar, and S. Shukla, “Applications of Deep Learning for Phishing Detection: A Systematic Literature Review,” Knowledge and Information Systems, vol. 64, pp. 1457–1500, 2022, doi: 10.1007/s10115-022-01672-x.

[40] S. Safi and S. Singh, “A Systematic Literature Review on Phishing Website Detection Techniques,” Journal of King Saud University – Computer and Information Sciences, 2023, doi: 10.1016/j.jksuci.2023.01.004.

[41] S. Kavya and D. Sumathi, “Staying Ahead of Phishers: A Review of Recent Advances and Emerging Methodologies in Phishing Detection,” Artificial Intelligence Review, vol. 58, article 50, 2025, doi: 10.1007/s10462-024-11055-z.

[42] J. Islam, C. Patra, P. K. Mani, S. Biswas, D. Giri, and T. Maitra, “Phishing URL Detection via Machine Learning: A Comprehensive Survey,” Lecture Notes in Networks and Systems, vol. 1405, 2025, doi: 10.1007/978-981-96-6348-4_12.

[43] Y. A. Kustiawan and K. I. Ghauth, “Feature Engineering for Phishing Website Detection Using Machine Learning: A Systematic Review,” IEEE Access, vol. 13, pp. 192080–192104, 2025, doi: 10.1109/ACCESS.2025.3630334.

[44] D. Popescul and L. D. Radu, “AI in Phishing Detection: A Bibliometric Review,” Frontiers in Artificial Intelligence, vol. 8, 1496580, 2025, doi: 10.3389/frai.2025.1496580.

[45] F. L. Santa Cruz-Rufasto and C. A. Dios-Castillo, “Diagnosing the Performance of Machine Learning Models for Phishing Website Detection: A Literature Review,” LACCEI, 2025, doi: 10.18687/LACCEI2025.1.1.274.

[46] M. Wang, L. Song, L. Li, Y. Zhu, and J. Li, “Phishing Webpage Detection Based on Global and Local Visual Similarity,” Expert Systems with Applications, vol. 252, 124120, 2024, doi: 10.1016/j.eswa.2024.124120.

[47] S. Guptta, K. T. Shahriar, H. Alqahtani, D. Alsalman, and I. H. Sarker, “Modeling Hybrid Feature-Based Phishing Websites Detection Using Machine Learning Techniques,” Annals of Data Science, vol. 11, 2024, doi: 10.1007/s40745-022-00379-8.

[48] S. Anupam and A. K. Kar, “Phishing Website Detection Using Support Vector Machines and Nature-Inspired Optimization Algorithms,” Telecommunication Systems, vol. 76, 2021, doi: 10.1007/s11235-020-00739-w.

[49] “Machine Learning Based Phishing Website Detection,” IEEE INDIACom, 2024, doi: 10.23919/INDIACom61295.2024.10498854.

[50] “Advanced Learning for Phishing URLs Detection to Secure Consumer-Centric Applications,” IEEE Transactions on Consumer Electronics, vol. 70, no. 3, pp. 5756–5763, 2024, doi: 10.1109/TCE.2024.3404459.

[51] “An Optimized Machine Learning Framework for Phishing Website Detection Integrating Feature Robustness and Adversarial Resilience Ranking,” IEEE ICPCSN, 2025, doi: 10.1109/ICPCSN65854.2025.11035371.

[52] “Phishing URL Detection Using Machine Learning and Deep Learning,” IEEE World AI IoT Congress, 2024, doi: 10.1109/AIIoT61789.2024.10579005.

[53] K. Barik, S. Misra, and R. Mohan, “Web-Based Phishing URL Detection Model Using Deep Learning Optimization Techniques,” International Journal of Data Science and Analytics, vol. 20, pp. 4449–4471, 2025, doi: 10.1007/s41060-025-00728-9.

[54] “An Integrated Model Based on Deep Learning Classifiers and Pre-Trained Transformer for Phishing URL Detection,” Future Generation Computer Systems, vol. 161, pp. 269–285, 2024, doi: 10.1016/j.future.2024.06.031.

[55] “Automatic Phishing Website Detection and Prevention Model Using Transformer Deep Belief Network,” Computers & Security, vol. 147, 104071, 2024, doi: 10.1016/j.cose.2024.104071.

[56] “Phishing URL Detection Using Transformer-Based Architecture and Contextual Content Features,” Computers, vol. 15, no. 6, 335, 2026, doi: 10.3390/computers15060335.

[57] “PhiUSIIL: A Diverse Security Profile Empowered Phishing URL Detection Framework Based on Similarity Index and Incremental Learning,” Computers & Security, vol. 136, 103545, 2024, doi: 10.1016/j.cose.2023.103545.

[58] “Website Phishing Detection of Machine Learning Approach Using SMOTE Method,” IEEE ICECCT, 2023, doi: 10.1109/ICECCT56650.2023.10179745.

[59] “Enhancing Online Safety: Phishing URL Detection Using Machine Learning and Explainable AI,” IEEE ICCCNT, 2024, doi: 10.1109/ICCCNT61001.2024.10723976.

[60] “Phishing Website Detection Using Machine Learning and Real-Time Email Notification System,” IEEE ICSSAS, 2025, doi: 10.1109/ICSSAS66150.2025.11081299.

 

 

 

Share your valuable work from Social Media Buttons