arXiv CSopen access

Explainable Machine Learning for Phishing Detection on Heterogeneous Datasets with MCP-Enabled Deployment

Explainable Machine Learning for Phishing Detection on Heterogeneous Datasets with MCP-Enabled Deployment Nikhil Kumar Doraa , Sumit Kumar Tetaravea , Rishikesh Sahayb , Madhusudan Singhc , Xiaoqing Lib a School of Computer Applications, Kalinga Institute of Industrial Technology, India b Department of Management Information Systems, University of Illinois, Springfield, USA

arXiv:2605.17891v1 [cs.CR] 18 May 2026

c Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA

Abstract With the growth in digital transformation and Internet usage, the Social Engineering techniques such as Phishing have become a major concern for the users and the organizations. Phishing attacks involve deceptive techniques to trick users into revealing confidential information that causes financial loss and reputation damage to organizations. According to report of Verizon, 36% of all data breaches involved phishing, highlighting the need for intelligent, adaptive, and explainable security mechanisms. This paper examines the efficiency of different machine learning algorithms in phishing detection on heterogeneous phishing datasets that include a publicly available UCI dataset, our generated datasets using tools such as EvilGinx and Zphisher, and AI generated datasets. Moreover, this work incorporates explainable AI (XAI) techniques such as Information Gain, SHAP (SHapley Additive Explanations), and LIME (Local Interpretable Model-Agnostic Explanations) to examine the most influential features impacting classification outcomes. To support practical deployment, this work also incorporates an MCP-based phishing URL detection system that offers real-time URL analysis, feature extraction, confidence-based classification, and AI-assisted security interpretation. The experimental results demonstrate that among classical models the highest accuracy is obtained by Logistic Regression at 92.44%, among ensemble models CatBoost achieved the highest accuracy at 95.01%, among neural network CNN achieved an accuracy of 94.02%, and among transformer-based models, DistilBERT got the highest accuracy at 99.78% Keywords: Machine Learning, Explainable Artificial Intelligence (XAI), Deep Learning, Generative AI, Heterogeneous Phishing Datasets

1. Introduction The advancements of the Internet technology and industry 4.0 offer great opportunities for individuals and businesses alike. With the growing trends of digital transformation in many industries, different cyber threats are also emerging. Among the myriad tactics used by malicious actors, phishing attacks have emerged as a pervasive and insidious threat that exploits human vulnerabilities to compromise confidenEmail addresses: [email protected] (Nikhil Kumar Dora), [email protected] (Sumit Kumar Tetarave), [email protected] (Rishikesh Sahay), [email protected] (Madhusudan Singh), [email protected] (Xiaoqing Li)

tial information, financial assets, and critical infrastructure. The Anti-Phishing Working Group (APWG) reported that in the second quarter of 2025, they recorded 1,130,393 phishing attacks [2]. This number increased from 1,003,924 attacks in the first quarter of 2025. According to the CrowdStrike threat report, many cyber criminals used callback phishing to obtain initial access to the organizations in 2024 [1]. The report also mentioned that cyber attackers are using Generative AI tools, particularly for social engineering attacks. The CrowdStrike highlighted that LLM generated phishing messages have significantly higher chances (54%) of getting clicked compared to messages written by humans. Furthermore, Zscaler ThreatLabz reports a significant shift in the phishing landscape, i.e., from a highvolume spam campaign to sophisticated and targeted social engineering attacks, facilitated by Generative AI tools that can create highly realistic and convincing lures [3]. The report further highlights that phishing campaigns use CAPTCHAs on malicious websites to evade automated security scanners and embed deceptive signals to bypass AI-powered detection. This trend emphasizes the need for more resilient and explainable machine learning defenses. Traditional phishing detection methods face limitations due to evolving attack techniques used by attackers. Traditional detection methods depend on static features of webpages, which is insufficient to detect zero day phishing attacks [23]. Therefore, advanced phishing detection techniques that can adapt to detect evolving sophisticated phishing attacks are required. Machine learning (ML) and Deep Learning (DL) offer this opportunity, making them capable of combating phishing attacks by efficiently identifying anomalies and patterns. Moreover, recent works have employed machine learning and deep learning for phishing detection by analyzing URL features of website [16, 18, 10, 23]. Although previous studies have highlighted the effectiveness of machine learning and deep learning for phishing detection, many depend on single public datasets. These may not capture the features of modern phishing URLs, including tool-generated phishing URLs and AI-generated URLs. To address this limitation, this study examines classical machine learning, ensemble learning, deep learning, and transformerbased models across multiple phishing datasets, while incorporating explainable AI techniques and an MCP-enabled phishing analysis system for practical deployment. To capture diverse phishing patterns, four distinct data sources are utilized in this work: (a) a publicly available phishing dataset from the UCI Machine Learning Repository [14], (b) phishing URLs generated using open-source phishing tools such as EvilGinx, GoPhish, and Zphisher to simulate realistic phishing URLs, (c) phishing URLs downloaded from OpenPhish, and (d) synthetically generated phishing URLs with the help script provided by DeepSeek to analyze evolving phishing patterns. The main contributions of this paper are summarized below: • Development of a comprehensive collection of phishing datasets. • Comparative performance analysis of multiple ML and DL models such as Random Forest, Decision Tree, AdaBoost, Logistic Regression, Multi-Layer Perceptron, and Deep Learning—across heteroge-

2

neous phishing datasets using standard evaluation metrics. • Application of SHAP, LIME and information gain based explainability to rank and analyze the most influential features impacting phishing detection across different datasets and learning models. • Design, implementation, and evaluation of a phishing MCP server using the best-performing ML model, assessed through advanced metrics such as Context Integrity Score (CIS), Attack Propagation Factor (APF), Mitigation Response Efficiency (MRF), and Context Sensitivity Index (CSI). The rest of the paper is organized as follows: Related extant literature on phishing detection is described in Section 2. Section 3 describes the proposed methodology, including dataset generation, machine learning and deep learning models, and explainable AI metrics. An implementation of phishing MCP server is explained in Section 4 along with its evaluation metrics. Section 5 presents the results. Finally, Section 6 presents the conclusion and future work. 2. Related Works Existing studies have widely explored the application of classical machine learning models using URLs, domain, and lexical features [4, 9]. The most widely used models are Random Forest, Decision Tree, Support Vector Machine, Naive Bayes, Logistic Regression, and AdaBoost. Most of these studies performed an evaluation on public datasets such as UCI, Kaggle, PhishTank, and Mendeley. Several works using the UCI-based phishing dataset found that the Random Forest and Ensemble models are effective for phishing classification [4, 20]. Other studies have also applied feature-selection-based Random Forest models, SVMbased classifiers, and proprietary machine learning approaches for phishing website detection [12, 7, 19]. Moreover, meta-learning and ensemble-based techniques such as AdaBoost-Extra Tree, Bagging-Extra Tree, Rotation Forest-Extra Tree, and LogitBoost-Extra Tree have shown improved detection accuracy of 97% and low false-positive rates of 0.028 [5]. However, many of these works depend on single public dataset that may reduce generalizability against evolving phishing attacks. Recently, deep learning and transformer-based techniques have been studied for phishing and malicious URL detection. Deep learning models such as CNN, LSTM, and CNN-LSTM have been used to analyze URLs patterns, with CNN-based models often demonstrating better detection performance [6]. In [22], a multidimensional deep learning technique combines URL character sequences, statistical URL features, webpage code features, and textual features to enhance phishing detection accuracy to 98.99% [22]. In [21], a transformer-based model is used for malicious URL detection, with fine-tuned ELECTRA model achieving almost perfect accuracy and outperforming many classical machine learning and deep learning baselines. The authors pointed out the importance of lexical and structural URL features, show the superiority of transformer models for phishing and malicious URL detection, and highlight the need for future research on adversarial robustness and efficient real-time deployment.

3

Many recent works have tried to address these limitations by including expressive feature representations and conducting comprehensive comparisons across different models. For instance, PhishOFE integrates URL-based, HTML-based, and composite derived features and evaluates ten machine learning models, with CatBoost achieving an accuracy of 99.48% [9]. Similarly, in [15] the authors evaluated a large number of URL-based features and applied feature selection with deep learning architectures such as Feedforward Neural Networks (FNN), Deep Neural Networks (DNN) and TabNet [15]. The work highlights the importance of robust feature engineering and model comparison. The results show that a feedforward model using only 14 selected features achieved an accuracy of 94.46%. Nevertheless, previous studies often focus on isolated benchmark datasets, limited dataset diversity, and insufficient explanation of model decisions. In contrast, this work evaluates classical machine learning, ensemble learning, deep learning, and transformer-based models across heterogeneous phishing datasets, including publicly available datasets, tool generated phishing URLs, and AI-generated phishing URLs. Moreover, this work includes explainable AI techniques, including Information Gain, SHAP, and LIME, to study influential phishing features. Furthermore, an MCP-enabled phishing analysis system is also developed to support practical deployment and real-time phishing URL analysis. 3. Methodology The proposed methodology uses multiple data sources to capture diverse patterns of phishing URLs and support robust phishing detection. Figure 1 shows the complete workflow, which includes data acquisition, preprocessing, feature standardization, model evaluation, and explainability analysis across machine learning, deep learning, and transformer-based models. Each normalized dataset is evaluated using multiple machine learning and deep learning algorithms to classify and detect phishing attacks. Finally, the best performing model is evaluated using standard performance metrics and Model Context Protocol (MCP)based analysis to test robustness, interpretability, and contextual reliability.

3.1. Phishing Datasets 3.1.1. UCI Phishing Websites Dataset We used the publicly available UCI Phishing dataset as a baseline [14]. It comprises 5,849 distinct samples (3,019 legitimate and 2,830 phishing) with 30 features that include basic URL and website attributes such as length, IP address presence, SSL status, ports, abnormal tags in HTML or Javascript, and redirect information. Each instance is labeled as phishing (1) or legitimate (0). This dataset served as a template for constructing features from other sources.

4

Figure 1: Overall Framework

3.1.2. Synthetic Phishing URL Generation Using EvilGinx and Zphisher To simulate phishing scenarios, we generate phishing URLs using tools such as EvilGinx [11] and Zphisher [13] within a controlled Kali Linux environment deployed in VirtualBox [17]. We provided a list of legitimate domains to these tools to generate the corresponding phishing links, and saved the phishing URLs and corresponding legitimate URLs in separate files. Links from these two separate files are combined into a single file, and features are extracted from the file, including phishing and legitimate URLs. EvilGinx is used to generate legitimate looking phishing URLs that closely mimic real login pages of services like Google, Microsoft, and Facebook. Furthermore, Zphisher is used to generate automated phishing URL, covering multiple social engineering templates, to introduce variations in the phishing dataset. These tools enabled us to generate phishing URLs without interacting with live targets. Algorithm 1 and Algorithm 2 describe a detailed implementation of EvilGinx to generate phishing based dataset. The dataset-generation pipeline uses two cooperating scripts: a Bash script show in Algorithm 1 that generates feature-rich domain variants and an Expect-based EvilGinx automator, which is Algorithm 2 that programmatically creates phishing lures and captures phishing URLs. The bash script calls the automator as a subprocess, collects phishing and legitimate URL pairs into output files, and performs post-hoc feature counting via regex-based analytics. The workflow is executed in a virtual machine using authorized domains, with retry mechanisms to improve robustness. 5

Algorithm 1 Feature-Based URL Generation using Bash Script Require: Feature set F = { f 1 , f 2 , . . . , f k }, Target per feature T Ensure: phishing_links.txt, legitimate_links.txt, feature_report.txt 1: Clear previous output files 2: Create initial feature_rich_domains.txt 3: for each feature f in F do 4: Generate T domain variants for f 5: Append generated domains to feature_rich_domains.txt 6: end for 7: Shuffle domain list for randomness 8: for each domain d in domain list do 9: success ← False 10: retries ← 0 11: while (not success) and (retries < 3) do 12: Run evilginx_automator.exp with domain d 13: if execution successful then 14: success ← True 15: else 16: retries ← retries + 1 17: end if 18: end while 19: end for 20: Analyze phishing_links.txt for feature presence 21: for each feature f in F do 22: Count occurrences of pattern corresponding to f 23: end for 24: Write summary statistics to feature_report.txt

Similarly, Zphisher is used to create phishing URLs by selecting a set of pre-designed phishing templates and generate masked URLs in a controlled environment. The generated URLs are checked, stored, and matched with the corresponding legitimate URLs to create the dataset. All activities are performed in an isolated virtual machine. 3.1.3. AI Assisted Synthetic URL Generation using DeepSeek DeepSeek is employed to support script generation to synthesize new phishing-like URLs in Google Colab to incorporate novel phishing patterns [8]. The generated URLs mimic common phishing traits such as subdomains with misleading names, words that suggest a security concern, and URL construction that is not obviously suspicious, as listed in Algorithm 3.

3.2. Threat-Intelligence Based Phishing URL Collection Phishing URLs are also collected from threat-intelligence feeds such as OpenPhish and URLhaus, then deduplicated and processed for feature extraction. All datasets are standardized using consistent feature names and labels, enabling reproducible experiments and straightforward comparison of various machine learning and deep learning approaches. The overall class distribution in all the datasets are summarized in 6

Algorithm 2 Automated Phishing and Legitimate URL Collection using EvilGinx Require: Number of links N, Domain base D Ensure: Appends phishing URLs and legitimate URLs to output files 1: Launch EvilGinx in developer mode 2: Configure domain ← D, IPv4 ← 127.0.0.1 3: Enable (phishlet) 4: Delete existing lures 5: Initialize output files for collecting phishing and legitimate URLs 6: for i ← 1 to N do 7: retries ← 0 8: url_captured ← False 9: while (not url_captured) and (retries < 3) do 10: Create new lure with EvilGinx 11: Extract phishing URL from lure 12: if URL is valid and not filtered then 13: Generate matching legitimate URL for D 14: Save both URLs to respective files 15: url_captured ← True 16: else 17: retries ← retries + 1 18: end if 19: end while 20: end for 21: Close EvilGinx session and output files 22: Return total successful URLs Algorithm 3 AI-Assisted Synthetic Phishing URL Generation Require: Set of legitimate URLs L, target URL count N Ensure: List of unique AI-assisted synthetic phishing URLs U 1: Initialize an empty list U and hash set H 2: Define phishing URL transformation rules based on common malicious patterns 3: while |U | < N do 4: Select a random legitimate URL b from L 5: Generate a phishing-like variant v using one or more transformation rules 6: Normalize v and compute its hash value 7: if hash of v is not present in H then 8: Append v to U 9: Insert hash of v into H 10: end if 11: end while 12: Return synthesized URL list U

Table 1.

3.3. Data Preprocessing We processed the data to ensure quality, consistency, and comparability across data sources. The dataset initially differed in structure, feature composition, and labeling format, required a unified preprocessing pipeline.

7

Table 1: Class Distribution for Each Dataset

Dataset UCI OpenPhish EvilGinx GenAI

Label (0: Legitimate) 3019 1811 2446 2446

Label (1: Phishing) 2830 1884 2010 3200

3.3.1. Data Cleaning and Standardization In the preprocessing phase, an exploratory analysis of each dataset is performed, including examination of the shape, feature names, and label distribution of the dataset. Initially, the UCI dataset contained 11,055 instances with 31 features showing a significant number of duplicate records. After removal of duplicates, the sample contains 5849 unique samples. However, the OpenPhish, EvilGinx, and AI datasets do not contain duplicate records. Moreover, the datasets are examined for missing or null values to ensure complete feature sets. Furthermore, to ensure label standardization, in the UCI dataset, the target column Result with values

−1 and 1 is renamed as label for consistency. The remaining datasets already contain a binary label column (0 for legitimate and 1 for phishing instances). 3.3.2. Feature Alignment Feature inconsistency across datasets is addressed by standardizing feature names such as URL_Length vs. url_length and popUpWindow vs. popup_window. Additionally, redundant features are removed. For example, in the EvilGinx dataset, duplicate representations of URL_Length are resolved by keeping the numerical version and discarding the categorical version. Initially, the datasets contain a varying number of features: 31, 37, 38, and 37 respectively. For consistency, a common feature space is established across all datasets. 3.3.3. Coefficient-Based Feature Selection Feature selection is performed using a coefficient-based importance approach derived from Logistic Regression. This method is selected because of its computational efficiency, interpretability, and ability to provide a consistent global ranking of features. Given a feature vector X = ( x1 , x2 , . . . , xn ), Logistic Regression models the probability of phishing as:

P ( y = 1| X ) =

1 T 1 + e−(w X +b)

where w = (w1 , w2 , . . . , wn ) represents the learned coefficients. The magnitude of each coefficient wi shows the importance of the corresponding feature.

8

To improve robustness, coefficient values are aggregated across stratified K-fold cross-validation as shown:

w̄ j =

1 k (i ) wj k i∑ =1

(i )

where k indicates the number of folds and w j shows the coefficient of feature j in the i-th fold. Depending on the averaged coefficients, a subset of 23 common and significant features is selected in all datasets. It ensures uniformity in the input space and allowed fair comparisons between models. Although coefficient-based methods mainly measure linear relationships, they can be used as an effective modelagnostic dimensionality reduction filter. 3.3.4. Final Dataset Preparation In the final preprocessing stage, all datasets are reduced to 23 selected common features along with the standardized label column. To ensure consistency and avoid bias, only the selected numerical features are used for model training. The final preprocessed datasets offer a unified and reliable input structure for subsequent machine learning and deep learning models, enabling consistent evaluation and comparison across datasets.

3.4. Machine Learning Algorithms We use a diverse set of machine learning and deep learning algorithms to evaluate phishing detection on heterogeneous datasets. In general, each model learns a decision function f (x) : Rn → {0, 1} that maps an input feature vector x to a legitimate or phishing class. Model training aims to minimize the empirical risk N1 ∑iN=1 ℓ(yi , f (xi )) given a labeled training set {(xi , yi )}iN=1 , where ℓ(·) denotes the task-specific loss function. The formulation enables a fair and consistent comparison between different learning paradigms under identical experimental conditions. 3.4.1. Regression-based Machine Learning Models Traditional linear and regression-based models are employed as baseline models because of their computational efficiency, interpretability, and good performance in high-dimensional feature space. Models evaluated in this category include: Logistic Regression, Ridge Classifier, Stochastic Gradient Descent (SGD) Classifier, Elastic Net–regularized Logistic Regression, and Linear Support Vector Classifier (Linear SVC). These models approximate the posterior probability P(y = 1 | x) using linear decision boundaries of the form f (x) = σ (w⊤ x + b) or margin-based separation functions, where w shows the learned weight vector. Feature standardization is applied to ensure stable optimization and comparable feature scales, specifically for gradient-based solvers. Regularization terms such as ∥w∥1 , ∥w∥2 , or their combination in Elastic

9

Net are included into the loss function to reduce overfitting and handle correlated phishing indicators. Despite their simplicity, these models offer a good and interpretable baseline to quantify the performance gains introduced by MCP-driven context isolation and feature fusion. 3.4.2. Tree-Based and Ensemble Models Tree-based and ensemble models are evaluated because of their capability to model complex, non-linear interactions among phishing related features. Unlike linear classifiers, these models partition the feature space using a hierarchy of decision rules, implicitly learning piecewise non-linear decision functions: M f (x) = ∑m =1 αm hm ( x ), Where hm (·) indicates an individual decision tree and αm its corresponding weight.

The models evaluated in this category include Decision Tree, Random Forest, Extra Trees, Gradient Boosting, XGBoost, and CatBoost. Bagging based ensemble methods such as Extra Trees or Random Forest, combine multiple trees that are de-correlated to reduce the variance of prediction, whereas boosting based methods iteratively minimize residual errors by focusing on misclassified samples. CatBoost is included for its robustness to heterogeneous feature distributions and its ability to mitigate overfitting under distribution shifts, which is particularly relevant for phishing datasets collected from real-world, tool-generated, and AI-synthesized sources. 3.4.3. Deep Learning Models We explore multiple deep learning architectures, such as: Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), and Bidirectional LSTM (BiLSTM) to capture higher-order feature interactions and latent contextual patterns. Deep neural networks learn hierarchical representations through successive non-linear transformations h(l ) = ϕ(W(l ) h(l −1) + b(l ) ), enabling the detection of subtle phishing indicators that may not be linearly identifiable. CNN-based models are used to learn localized and position-invariant feature patterns, while recurrent architectures, such as LSTM and GRU model sequential dependencies within the feature representations. BiLSTM further improves contextual understanding by processing feature sequences in both forward and backward directions. All deep learning models are optimized using the Adam optimizer and binary crossentropy loss: ℓ(y, ŷ) = −[y log(ŷ) + (1 − y) log(1 − ŷ)], with early stopping applied to prevent overfitting. This integrated mechanism ensures computational efficiency while maintaining robust generalization in various scenarios of phishing attack.

3.5. ML Evaluation Metrics To improve model transparency and identify the most important phishing features, this study uses both statistical feature selection, including Accuracy, Precision, Recall, F1-Score, area under curve (AUC), Receiver

10

Operating Characteristic (ROC) and model-agnostic explainability techniques (XAI), including Information Gain, SHAP, and LIME. 3.5.1. Confusion Matrix The confusion matrix for binary phishing classification is defined as:  M=

TP

FP

FN

TN

 

(1)

where TP indicates true positives (phishing correctly detected), FP false positives (legitimate samples misclassified as phishing), FN false negatives (phishing samples misclassified as legitimate), and TN true negatives (legitimate samples correctly classified). Accuracy evaluates the overall correctness of the classifier and is defined as: ( TP + TN )/( TP + TN + FP + FN ). Precision quantifies the reliability of phishing predictions and is calculated as: TP/( TP + FP). Recall, referred to as the True Positive Rate (TPR), measures the classifier’s ability to correctly identify phishing instances, i.e., TP/( TP + FN ). Moreover, the F1-score offers a harmonic mean of Precision and Recall, denoted by: 2 × [( Precision × Recall )/( Precision + Recall )]. 3.5.2. ROC and AUC The Receiver Operating Characteristic (ROC) curve demonstrates the trade-off between the True Positive Rate (TPR) and the False Positive Rate (FPR) across varying classification thresholds. The FPR is defined as: FP/( FP + TN ), and the ROC curve as: {(FPR(t), TPR(t)) | t ∈ [0, 1]}, where t denotes the decision threshold. Moreover, the Area Under the ROC Curve (AUC) illustrates the discriminatory power of classifier and R1 is defined as: 0 TPR(FPR) d(FPR). A higher AUC value denotes superior classification performance and robustness against threshold variation. 3.5.3. Cross-Validation Evaluation To ensure statistical reliability, k-fold cross-validation is used. Let Sk denote the performance score achieved from the k-th fold; the average performance metric is computed as: K1 ∑kK=1 Sk . This evaluation ensures an unbiased performance estimate across heterogeneous phishing datasets. 3.5.4. Information Gain Information Gain (IG) evaluates the reduction in uncertainty of the target variable after observing a feature. Let Y denote the class label (phishing or legitimate), and X j denote a feature. The entropy of Y is defined as:

11

∑

H (Y ) = −

P(y) log2 P(y)

(2)

y∈{0,1}

The conditional entropy of Y given X j is: H (Y | X j ) = ∑ P ( x ) H (Y | X j = x )

(3)

x∈Xj

The information gain of the feature X j is then computed as: IG (Y, X j ) = H (Y ) − H (Y | X j )

(4)

Features with higher Information Gain contribute more significantly to reducing classification uncertainty and are prioritized during feature selection. 3.5.5. SHAP (SHapley Additive Explanations) SHAP is a game-theoretic approach that assigns an importance value to each feature by fairly distributing the prediction outcome among all features. Given a model f and an input instance x, the SHAP explanation model is defined as: n

f (x) = ϕ0 + ∑ ϕj

(5)

j =1

where ϕ0 represents the base value (expected model output), and ϕj denotes the Shapley value of feature j. The Shapley value is computed as:

ϕj =

|S|!(| F | − |S| − 1)! [ f (S ∪ { j}) − f (S)] | F |! S⊆ F \{ j}

∑

(6)

where F is the set of all features and S is a subset that excludes the feature j. SHAP provides both global and local interpretability by quantifying the contribution of each feature to the final prediction. 3.5.6. LIME (Local Interpretable Model-Agnostic Explanations) LIME explains individual predictions by approximating the original model locally with an interpretable surrogate model. For a given instance x, LIME minimizes the following objective function:

L( f , g, πx ) = ∑ πx (z) ( f (z) − g(z))2 + Ω( g)

(7)

z∈ Z

where f is the original complex model, g is the interpretable local surrogate model, πx (z) is a proximity measure between instance z and x, Ω( g) penalizes model complexity. LIME thus provides localized

12

explanations by highlighting the most influential features responsible for individual phishing predictions. 4. The Proposed Phishing MCP Server The Phishing MCP Server provides a middleware layer between phishing detection models and user-facing interfaces. The system is designed for modularity, scalability, and educational reproducibility, allowing researchers and students to interact with phishing-detection tools using simple API calls or web interfaces. The system is lightweight and requires minimal setup, making it practical for integration into research and LLM-based phishing-analysis workflows. Figure 2 shows the proposed architecture with four conceptual layers. Client Layer encompasses any client that is compatible with MCP, such as ChatGPT, Claude Desktop, MCP Inspector, or web dashboards, which sends structured requests to the server for phishing analysis. MCP Core Layer manages the standardized exchange of requests and responses via the MCP protocol. It handles tool registration, session management, and JSON serialization of requests and responses. Service Layer provides the core functionalities of the phishing detection system as MCP tools such as URL feature extraction and phishing model inference. Every tool executes its specific function and provides results in a structured JSON format, facilitating straightforward composition and integration. Data and Model Layer is the fourth layer, which comprises of datasets (legitimate and phishing URLs), and pre-trained machine learning models for realtime classification.

Figure 2: Phishing MCP Server and its Integration with Client

For better illustrating the phishing detection system, we develop a use case as shown in Fig. 3, where a client enters an URL for the analysis in the dashboard. When the URL is entered by the client, the MCP Core module sends the request to Service Layer, which analyzes the URL and provides the result as phishing detected. Moreover, the Phishing Detector system also offers the rationale for the analysis. As we can see in Fig. 3, the system detects features such as the IP address in the URL, which signals it as a phishing.

13

Figure 3: Phishing URL Detector

4.1. MCP Components Moreover, the MCP Server is designed to provide a secure, scalable, and explainable phishing detection framework by integrating Context Isolation, Provenance Validation, and Hybrid Feature Fusion. These components collectively enhance robustness, interpretability, and generalization across heterogeneous phishing datasets. 4.1.1. Context Isolation Context Isolation ensures that each phishing detection request is processed independently to prevent contextual interference and adversarial contamination. Let an incoming URL request be denoted as ri , that is assigned to an isolated context Ci defined as: Ci = {xi , f (xi ), ŷi }

(8)

where xi ∈ Rn denotes the extracted feature vector, f (·) represents the trained machine learning classifier, and ŷi ∈ {0, 1} indicates the predicted class label (legitimate or phishing). Context isolation enforces: 14

Ci ∩ Cj = ∅

∀ i ̸= j

(9)

This constraint ensures secure, independent inference and mitigates session-based and cross-request attacks. 4.1.2. Provenance Validation Provenance Validation verifies the origin and trustworthiness of each input sample. Each input is associated with a provenance label pi such as: pi ∈ { DUCI , DOpenPhish , DEvilGinx , DGenAI }

(10)

where DUCI , DOpenPhish , DEvilGinx , and DGenAI represent public benchmark data, phishing-tool-generated data, and Generative AI–generated data, respectively. A Provenance Confidence Score (PCS) is computed as:

PCSi =

1 k I( p i = p j ) k j∑ =1

(11)

where I(·) is the indicator function and k indicates the number of nearest neighbors in the feature space. Samples with low PCSi values are flagged for further examination to ensure data integrity. 4.1.3. Hybrid Feature Fusion Hybrid Feature Fusion combines statistically significant features with explainability-driven insights. Let FIG denote the feature subset selected using Information Gain, and FXAI represent the features identified using SHAP and LIME. The final feature set is defined as:

Ffinal = FIG ∪ FXAI

(12)

Each feature f j ∈ Ffinal is assigned a composite importance weight: w j = α · IGj + β · | f j |,

where α + β = 1

(13)

This weighted fusion balances global statistical relevance with local interpretability. 4.1.4. Decision Function The final phishing classification decision within the proposed MCP framework is achieved through a context-aware probabilistic inference. Given an incoming request ri with feature representation xi and hybrid feature weights w derived from Information Gain and XAI-based importance scores, the classifier

15

produces a weighted feature embedding xi ⊙ w. The trained model f (·) then estimates the posterior class probabilities conditioned on the isolated context. Accordingly, the predicted label ŷi is computed as: ŷi = arg max P c | f (xi ⊙ w)

(14)

c∈{0,1}

where c = 0 and c = 1 correspond to legitimate and phishing classes, respectively. This formulation ensures that the final decision jointly reflects statistical relevance, explainability-driven feature importance, and strict context isolation enforced by the MCP server.

4.2. MCP Evaluation Metrics We propose four evaluation metrics to analyze heterogeneous phishing datasets, the Context Integrity Score (CIS), Attack Propagation Factor (APF), Mitigation Response Efficiency (MRE), and Context Sensitivity Index (CSI). 4.2.1. Context Integrity Score (CIS) It measures contextual similarity between pre- and post-attack states, which derives from Eq. 8. It quantifies pre

the similarity between the original isolated context Ci

post

and the attacked context Ci

, which can be derived

from Eq. 8 as follows. pre

post

CISi = sim(Ci , Ci

)

(15)

4.2.2. Attack Propagation Factor (APF) It quantifies the degree of contextual degradation caused by adversarial manipulation, i.e., a direct consequence of violating isolation (Eq. 9). APF measures how much this constraint is broken under attack using Eq. 16. pre

post

Ci ∩ Cj 1 APF = ∑ N i̸= j |Ci |

(16)

4.2.3. Context Sensitivity Index (CSI) It captures the susceptibility of model performance to small perturbations in contextual inputs, and would be linked to Ff inal of Eq. 12. CSI measures that how sensitive the prediction ŷ is to small perturbations in Ff inal and would be related as follows. CSI = E[| P(ŷ| Ff inal ) − P(ŷ| Ff inal + δ)|]

16

(17)

4.2.4. Mitigation Response Efficiency (MRE) It measures how quickly and effectively the system restores contextual stability after detecting low-provenance or adversarial samples, and would be stated as in Eq. 18. MRE =

CIS postm itigation − CIS posta ttack CIS prea ttack

(18)

The defined MCP components are directly operationalized through the proposed evaluation metrics. Context Isolation is quantified using the Context Integrity Score (CIS) and Attack Propagation Factor (APF), which respectively measure the preservation of isolated inference states and the extent of cross-context leakage under adversarial manipulation. Provenance Validation and Hybrid Feature Fusion influence the Context Sensitivity Index (CSI) by stabilizing model predictions against small contextual perturbations, while Mitigation Response Efficiency (MRE) captures the system’s ability to restore contextual integrity following attack detection. Together, these metrics provide a holistic evaluation of MCP’s robustness, resilience, and explainability. 5. Result Evaluation

5.1. Simulation-Based Evaluation To quantitatively evaluate the effectiveness of the proposed phishing detection framework, a set of standard performance metrics is used, including Accuracy, Precision, Recall, F1-Score and AUC. These metrics assess classification accuracy, detection capability, and robustness across different phishing datasets: UCI, OpenPhish, EvilGinx, and GenAI, as mentioned in Table 1. The average performance metrics for classical models, ensemble models, neural network models and transformer models are stated in Table 2, Table 3, Table 4, and Table 5, respectively. Table 6 shows the average model coefficients in 23 common features. Table 2: Performance Comparison of Classical Models

Model Logistic Regression SGD Classifier Ridge Classifier Elastic Net

Accuracy 0.9244 0.9184 0.9172 0.8914

Precision 0.9315 0.9286 0.9288 0.8862

Recall 0.9244 0.9184 0.9172 0.8914

F1 Score 0.9243 0.9180 0.9166 0.8825

ROC AUC 0.9604 0.9581 0.9594 0.9587

Table 3: Performance Comparison of Ensemble Models

Model CatBoost XGBoost Random Forest Decision Tree

Accuracy 0.950175 0.949975 0.948800 0.941550

Precision 0.95295 0.95235 0.95120 0.94370

17

Recall 0.950175 0.949975 0.948800 0.941550

F1 Score 0.950225 0.950025 0.948875 0.941575

ROC AUC 0.978975 0.979575 0.976850 0.957750

Table 4: Average Performance Comparison of Neural Network Models

Model MLP CNN GRU CNN-LSTM

Accuracy 0.939025 0.940225 0.931725 0.937900

Precision 0.941075 0.942325 0.940200 0.940075

Recall 0.939025 0.940225 0.931725 0.937900

F1 Score 0.939025 0.940300 0.931650 0.937800

ROC AUC 0.966475 0.968125 0.962850 0.966800

Table 5: Average Performance Comparison of Transformer Models

1

1

1

1

1

0.998 0.98

ROC AUC 0.9996 0.9995 1.0000 0.9999

0.977

0.975

0.98 0.959

F1 Score 0.9966 0.9959 0.9979 0.9973

0.954

0.956 0.95

Score

0.98 0.96

Recall 0.9939 0.9934 0.9963 0.9952

1

0.997

0.998

Precision 0.9993 0.9985 0.9995 0.9995

0.995

1

0.996

Accuracy 0.9962 0.9955 0.9978 0.9973

0.994

Model BERT-PhishFinder CodeBERT DistilBERT BERT

0.94 0.92 0.9 UCI

OpenPhish

EvilGinx

GenAI

Dataset Accuracy

Precision

Recall

F1-Score

AUC

Figure 4: CatBoostClassifier performance across 4 phishing datasets

In the UCI dataset, Logistic Regression achieves 91.96% accuracy, 91.18% precision, 92.33% recall, F1score 91.75%, and AUC 0.9757, while ElasticNet and SGDClassifier are slightly lower. On OpenPhish and GenAI, these linear models perform very well, reaching 99–100% accuracy with AUC values close to 1.0. However, on EvilGinx, their performance drops (Logistic Regression 92.48%, ElasticNet 92.66%, SGDClassifier 91.94%), indicating that simple linear models cannot fully capture complex phishing patterns. Moreover, Tree-based and boosting models consistently outperform linear models across all datasets. On UCI, Random Forest achieves 94.87% accuracy (AUC 0.9887), XGBoost 95.21% (AUC 0.9930), and CatBoost 95.57% (AUC 0.9937). On OpenPhish, CatBoost performs best with 99.65% accuracy and AUC 0.9999, while XGBoost and Random Forest are slightly lower. On EvilGinx, Random Forest and CatBoost maintain high

18

Table 6: Average Model Coefficients across Datasets of 23 Common Features

Feature Abnormal_URL DNSRecord Google_Index HTTPS_token Iframe Links_in_tags Links_pointing_to_page Prefix_Suffix Redirect Request_URL RightClick SFH Shortening_Service Statistical_report Submitting_to_email URL_Length URL_of_Anchor double_slash_redirecting having_At_Symbol having_IP_Address having_Sub_Domain on_mouseover web_traffic

UCI -0.4827 0.2437 0.6323 -0.3112 -0.2753 0.8051 0.4836 2.6478 -1.1182 0.3498 0.2697 0.9813 -0.8048 0.4847 -0.2062 -0.0635 3.1479 0.4681 0.4063 0.4866 0.6981 0.0033 0.5755

OPEN 0.6688 -2.1974 -4.1267 0.0002 0.0000 0.0000 -2.2492 1.8077 0.5051 0.0000 0.0000 0.0223 -0.4122 -2.3826 0.0000 0.0340 0.0000 0.0000 0.0045 0.7305 3.2913 0.0000 -2.3203

EVIL 1.6715 -1.0089 -1.0089 -1.0089 -1.0089 -1.0089 -1.0089 0.3514 -1.0089 1.6715 -1.0089 1.6715 -0.5280 -0.2661 -1.0089 0.2053 -1.0089 0.4209 0.2679 -0.2405 2.5123 -1.0089 -1.0089

DS 0.3482 -2.3997 -3.7476 0.0000 0.3228 0.8991 -2.5735 0.4961 -0.0085 0.0000 0.0000 0.0000 0.0507 -3.1394 0.0000 0.0976 0.4450 0.3237 0.8544 2.2674 -0.4731 0.0000 -3.4701

accuracy (98.16% and 97.95%) and AUC above 0.997. Neural networks such as MLP, CNN, and GRU also perform well. On UCI, MLP achieves 94.28% accuracy (AUC 0.9885), CNN 93.45% (AUC 0.9858), and GRU 91.52% (AUC 0.9733). On OpenPhish and GenAI, neural networks reach nearly and equal to 100% accuracy and AUC. Figure 4 shows the overall accuracy comparison of different models on the hetrogeneous datasets. Across all evaluation metrics, CatBoostClassifier consistently demonstrates superior and stable performance across heterogeneous phishing datasets, while CNN exhibits higher variance, particularly on the EvilGinx dataset, as summarized in Table 7. Moreover, Figure 5a and Figure 5b confirms the best model claim against CatBoostClassifier. Table 7: Performance of CatBoost across different phishing datasets

Dataset UCI OpenPhish EvilGinx GenAI

Accuracy 0.9557 0.9965 0.9796 0.9998

Precision 0.9499 0.9984 0.9753 1.0000

19

Recall 0.9590 0.9947 0.9796 0.9997

F1-Score 0.9545 0.9965 0.9774 0.9998

AUC 0.9937 0.9999 0.9976 1.0000

(a) ROC of four dataset

(b) Pre recall of four dataset

5.2. Explainable AI (XAI) Based Evaluation 5.2.1. Information Gain Information Gain (IG) measures the dependency between input features and the target label. Higher IG values indicate that features are more useful for distinguishing phishing from legitimate samples. The OpenPhish (0.136) and GenAI (0.123) datasets exhibit the highest average information gain, followed by EvilGinx (0.088). The UCI dataset shows the lowest information gain (0.035). These results confirm that features in OpenPhish and GenAI are more strongly aligned with phishing behavior, explaining their higher effectiveness in phishing detection tasks. 5.2.2. SHAP Feature Importance Analysis We used SHAP values with the best CatBoost model to evaluate the impact of each feature on the model’s decisions for detecting phishing URLs. On the UCI dataset, SHAP values range from approximately ±0.35 to ±0.40, indicating that a few key features have a very strong effect , the model relies heavily on these features to distinguish between legitimate and phishing URLs. For OpenPhish, the SHAP value range is smaller, around ±0.20, and EvilGinx is similar at ±0.22. This suggests that while features in these datasets are influential, their impact is more evenly distributed and not dominated by just one or two features. In contrast, the GenAI dataset exhibits almost zero SHAP values, only about ±0.003. This implies that no single feature significantly controls the decision; instead, the model achieves perfect results because legitimate and phishing URLs are naturally well separated in the dataset . For which GenAI dataset accuracy touch to 100% accuracy.

20

(a) SHAP for UCI Dataset

(b) SHAP for OpenPhish Dataset

(c) SHAP for EvilGinx Dataset

(d) SHAP for GenAI Dataset

Figure 6: SHAP Analysis on Heterogeneous Dataset

21

5.2.3. LIME Feature Importance Analysis LIME explanations provide local insights into individual predictions using CatBoostClassifier in the four datasets. It shows that which features are most critical for a single instance’s classification. LIME works by slightly perturbing the feature values of a single URL and observing how the model’s output changes. Based on these changes, it identifies the most influential features responsible for that specific prediction. In the LIME plots, green bars indicate features that increase the phishing score, while red bars indicate features that reduce the phishing score. The length of each bar represents the strength of the feature’s influence, and the text shown on each bar (for example, SSLfinal_State ≤ 1.00) represents the exact condition applied by the model. For the UCI dataset, the phishing classification is mainly driven by SSLfinal_State ≤ 1.00 (∼0.38), Prefix_Suffix ≤ 1.00 (∼0.30), web_traffic ≤ 1.00 (∼0.22), and having_Sub_Domain ≤ 1.00 (∼0.18). These strong phishing indicators clearly outweigh the small benign contribution from Links_pointing_to_page

≤ 0.00 (−0.07). In the OpenPhish dataset, the model primarily relies on reputation-based and lexical features such as Google_Index = 0 (∼0.31), having_Sub_Domain (∼0.22), Statistical_report (∼0.20), and Digit_Features (∼0.18). For the EvilGinx dataset, phishing detection is dominated by Abnormal_URL (∼0.26), SFH (∼0.23), and entropy (∼0.20), even though Digit_Features contributes negatively (−0.11), indicating conflicting feature behavior. In the GenAI dataset, the model depends mainly on SSLfinal_State (∼0.37), Prefix_Suffix (∼0.29), and web_traffic (∼0.21), while Links_pointing_to_page has a minor negative influence (−0.08). This demonstrates that GenAI-based phishing URLs are detected primarily using general behavioral and domain-level signals rather than obvious structural URL manipulations.

5.3. MCP-Based Evaluation Table 8 summarizes the effectiveness of the proposed MCP-based framework across the UCI, OpenPhish, EvilGinx, and GenAI datasets. All datasets achieve a Context Integrity Score (CIS) of 1.0 after mitigation, highlighting that the recovery mechanism restores contextual consistency following attack injection. The Attack Propagation Factor (APF) indicates a dataset-specific variation, with measurable propagation observed only in the UCI dataset, whereas OpenPhish, EvilGinx, and GenAI show no attack propagation. The positive Mitigation Response Efficiency (MRE) for the UCI dataset shows measurable recovery from an initially degraded context, whereas other datasets maintain stable contextual behavior throughout the evaluation. Table 9 further compares isolation, provenance validation, and hybrid mitigation strategies. The hybrid strategy preserves high CIS and low APF values, demonstrating that combining context isolation with provenance-aware validation improves resilience against contextual perturbations. Overall, the results highlight that the proposed MCP-based framework improves contextual stability, supports attack traceability, and enhances robustness for phishing detection across heterogeneous datasets. These findings also

22

align with the explainability results, where the GenAI dataset shows a strong reliance on general behavioral and domain-level indicators rather than only obvious URL-level manipulations.

(a) LIME for UCI Dataset

(b) LIME for OpenPhish Dataset

(c) LIME for EvilGinx Dataset

(d) LIME for GenAI Dataset

Figure 7: LIME Analysis on Heterogeneous Dataset

Table 8: MCP-Based Attack–Mitigation Effectiveness Across Datasets

Dataset UCI OpenPhish EvilGinx GenAI

CIS 1.0 1.0 1.0 1.0

APF 0.368654 0.000000 0.000000 0.000000

MRE 0.135505 0.000000 0.000000 0.000000

CSI 0.99979 1.00000 1.00000 1.00000

The Mitigation Response Efficiency (MRE) is positive for the UCI dataset (0.1355), reflecting measurable recovery from an initially degraded context. All datasets achieve CSI values close to 1.0, confirming that the overall contextual structure remains highly stable even under adversarial perturbations. These results demonstrate that while mitigation mechanisms are effective across all datasets, GenAI-generated data exhibits the highest intrinsic robustness, showing no attack propagation and perfect context stability. This finding aligns with earlier entropy, information gain, and explainability analyses, and helps explain the superior machine learning performance observed on GenAI datasets.

23

Table 9: Performance Comparison of Isolation, Validation, and Hybrid Strategies Across Datasets

Strategy Isolation

Validation

Hybrid

Dataset UCI OpenPhish EvilGinx GenAI UCI OpenPhish EvilGinx GenAI UCI OpenPhish EvilGinx GenAI

CIS 0.8806 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000

APF 0.3668 0.0000 0.0000 0.0000 0.3646 0.0000 0.0000 0.0000 0.3663 0.0000 0.0000 0.0000

MRE – – – – 0.1339 0.0000 0.0000 0.0000 0.1346 0.0000 0.0000 0.0000

CSI 0.9998 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 1.0000 0.9999 1.0000 1.0000 1.0000

6. Conclusion, Limitations, and Future Work This work presented an explainable phishing detection framework evaluated across heterogeneous datasets, to study diverse phishing patterns. Classical machine learning, ensemble learning, deep learning, and transformer-based models are compared, with ensemble and transformer-based models showing strong detection performance and DistilBERT achieving the best overall result among the evaluated transformer models. The framework also includes Information Gain, SHAP, and LIME to improve explainability, along with an MCP-enabled phishing analysis system to facilitate practical deployment. The MCP-based evaluation shows that context isolation, provenance-aware validation, and hybrid feature fusion improve contextual robustness and reduce attack propagation across heterogeneous datasets. This work has some limitations. The evaluation mainly uses URL-based and derived numerical features, while real-world phishing detection may also require email content, webpage screenshots, HTML structure, and network-flow data. In addition, tool-generated and AI-generated datasets are created in controlled environments and may not fully represent all live phishing behaviors. Future work will therefore focus on multi-modal phishing detection, real-time deployment validation, adaptive context policies, and federated MCP-based detection for collaborative defense. References [1] CROWDSTRIKE 2025 GLOBAL THREAT REPORT , 2025. [2] PHISHING ACTIVITY TRENDS REPORT. Technical report, Anti Phishing Working Group, 2025. [3] Zscaler ThreatLabz 2025 Phishing Report, 2025. [4] Shouq Alnemari and Majid Alshammari. Detecting phishing domains using machine learning. Applied Sciences, 13(8), 2023.

24

[5] Yazan Ahmad Alsariera, Victor Elijah Adeyemo, Abdullateef Oluwagbemiga Balogun, and Ammar Kareem Alazzawi. Ai meta-learners and extra-trees algorithm for the detection of phishing websites. IEEE Access, 8:142532– 142542, 2020. [6] Zainab Alshingiti, Rabeah Alaqel, Jalal Al-Muhtadi, Qazi Emad Ul Haq, Kashif Saleem, and Muhammad Hamza Faheem. A deep learning-based phishing detection system using cnn, lstm, and lstm-cnn. Electronics, 12(1), 2023. [7] Andrei Butnaru, Alexios Mylonas, and Nikolaos Pitropakis. Towards lightweight url-based phishing detection. Future Internet, 13(6), 2021. [8] DeepSeek-AI, Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Luan, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. Nature, 645(8081):633–638, 2025. [9] Ali Hamid Farea, Iman Askerzade, Omar H Alhazmi, and Savaş Takan. Fsfs: A novel statistical approach for fair and trustworthy impactful feature selection in artificial intelligence models. Computers, Materials and Continua, 84(1):1457–1484, 2025. [10] Rawshon Ferdaws and Nahid Ebrahimi Majd. Phishing url detection using machine learning and deep learning. In 2024 IEEE World AI IoT Congress (AIIoT), pages 0485–0490, 2024. [11] Kuba Gretzky. Evilginx 3.0 + Evilginx Mastery, 2023. [12] Anirudha Joshi and Prof. Tanuja R Pattanshetti. Phishing attack detection using feature selection techniques. Proceedings of International Conference on Communication and Information Processing (ICCIP) 2019, 2019. [13] Steve Matindi. How to Install and Use Zphisher for Phishing Attacks, 2024. [14] Rami Mohammad and Lee McCluskey. Phishing Websites. UCI Machine Learning Repository, 2015. DOI: https://doi.org/10.24432/C51W2X. [15] Ganesh S Nayak, Balachandra Muniyal, and Manjula C Belavagi. Enhancing phishing detection: a machine learning approach with feature selection and deep learning models. IEEE Access, 2025. [16] Routhu Srinivasa Rao and Alwyn Roshan Pais. Detection of phishing websites using an efficient feature-based machine learning framework. Neural Computing and Applications, 31:3851 – 3873, 2018. [17] Rishikesh Sahay, Weizhi Meng, and Wenjuan Li. A comparative analysis of phishing tools: Features and countermeasures. In Zhe Xia and Jiageng Chen, editors, Information Security Practice and Experience, pages 365–382, Singapore, 2025. Springer Nature Singapore. [18] Smita Sindhu, Sunil Parameshwar Patil, Arya Sreevalsan, Faiz Rahman, and Ms. Saritha A. N. Phishing detection using random forest, svm and neural network with backpropagation. In 2020 International Conference on Smart Technologies in Computing, Electrical and Electronics (ICSTCEE), pages 391–394, 2020. [19] Abdulhamit Subasi and Emir Kremic. Comparison of adaboost with multiboosting for phishing website detection. Procedia Computer Science, 168:272–278, 2020. Complex Adaptive Systems Malvern, Pennsylvania November 13-15, 2019.

25

[20] A. Suryan, C. Kumar, M. Mehta, R. Juneja, and A. Sinha. Learning model for phishing website detection. EAI Endorsed Transactions on Scalable Information Systems, 7(27), 3 2020. [21] Fuat Türk and Mahmut Kılıçaslan. Maliciousurl detection with advanced machine learning and optimizationsupported deep learning models. Applied Sciences, 15(18):10090, 2025. [22] Peng Yang, Guangzhen Zhao, and Peng Zeng. Phishing website detection based on multidimensional features driven by deep learning. IEEE Access, 7:15196–15209, 2019. [23] Kun Zhang, Haifeng Wang, Meiyi Chen, Xianglin Chen, Long Liu, Qiang Geng, and Yu Zhou. Leveraging machine learning to proactively identify phishing campaigns before they strike. Journal of Big Data, 12, 2025.

26