Systematic XGBoost Pipeline for Phishing Website Detection: Hyperparameter Tuning Approach with Nested Cross-Validation

Abstract

Phishing attacks have become increasingly sophisticated and pose a critical threat to cybersecurity, with more than 4.7 million attacks reported in 2023. Traditional blacklist and rule-based detection struggles to keep pace with evolving URL patterns and impersonation techniques. Rather than proposing a new classifier, this study presents a systematic and reproducible XGBoost-based phishing detection pipeline intended as an academic baseline with operationally motivated evaluation (not a production-integrated system). The Mendeley Phishing Websites dataset (58,645 URLs; 30,647 phishing and 27,998 legitimate) with 111 URL- and website-based features. The pipeline applies data cleaning, column-transformer-based pre-processing, and a stratified 80:20 train–test split, with all pre-processing steps fit on the training data only to reduce leakage risk. The final model uses 98 active features after removing 13 constant attributes; quasi-constant features are analyzed and retained. Continuous features are sanitised, log-transformed, and standardised, while binary features are left unchanged. Hyperparameters are tuned via stratified cross-validation using the ROC-AUC metrics, followed by early stopping, probability calibration, and simple threshold tuning. On the hold-out test set, the optimized model, set at a 0.50 decision threshold, achieves 96.34% accuracy, 96.31% precision, 96.70% recall, and 96.51% F1-score, improving over a default XGBoost baseline and yielding fewer false positives and false negatives. These results show that a systematically designed XGBoost pipeline provides a strong and reproducible baseline for URL-based phishing website detection and offers a practical foundation for future work on cost-sensitive learning and temporal validation. This study is limited to tabular URL/website feature-based detection and does not include visual content analysis, HTML/DOM parsing, or deep learning on raw text/images.