Machine Learning Techniques for Real-Time Phishing Attack Detection

Abstract

Phishing attacks remain one of the most pervasive and damaging forms of cybercrime, with attackers continuously evolving techniques to bypass traditional detection systems. This study investigates the application of machine learning (ML) techniques for real-time phishing attack detection, focusing on the trade-off between detection accuracy and processing speed. A quantitative, experimental research design was employed using a blended dataset of 114,000 website URLs (58,000 legitimate, 56,000 phishing) sourced from PhishTank, OpenPhish, and the University of New Brunswick’s ISCX URL dataset. Three ML models—Random Forest (RF), Support Vector Machine (SVM), and a deep learning-based Multilayer Perceptron (MLP)—were trained on 30 lexical and host-based features. The models were evaluated using precision, recall, F1-score, accuracy, and inference time per sample. Results indicate that the Random Forest model achieved the highest accuracy (98.7%) and an inference time of 0.23 ms per sample, making it the most suitable for real-time deployment. The deep learning model showed comparable accuracy (98.1%) but with higher latency (1.8 ms). These findings suggest that ensemble tree-based methods currently offer the best balance for production-level real-time systems. Key limitations include potential dataset aging and lack of testing against zero-day phishing sites.