Feature-Engineered Machine Learning Models for Phishing URL Classification Using Entropy and Behavioral Signals

2. Related Work

Phishing detection has evolved across three primary paradigms: signature/blacklist-based systems, heuristic and lexical feature analysis, and machine learning–driven classification. Each approach contributes incremental improvements, yet all exhibit structural limitations when confronted with adversarially generated URLs and rapidly changing attack infrastructure. This section positions the proposed hybrid model against these existing approaches and isolates the specific gap it addresses.

2.1 Blacklist and Signature-Based Detection

Early phishing mitigation strategies relied heavily on URL blacklists maintained by browsers, email gateways, and threat intelligence providers. Systems ingest known malicious domains and block user access based on exact or pattern-based matches. While operationally simple and computationally efficient, blacklist approaches are fundamentally reactive. They depend on prior identification of malicious infrastructure and therefore fail against zero-day phishing campaigns.

Empirical studies consistently show that phishing domains often remain active for only a short time window—sometimes hours—before being abandoned or rotated. This temporal volatility renders blacklist updates insufficiently timely. Furthermore, attackers increasingly employ domain generation techniques and fast-flux hosting, ensuring that newly generated phishing URLs evade detection until explicitly cataloged. Consequently, blacklist-based systems exhibit low recall for novel threats and provide limited resilience in dynamic adversarial environments.

2.2 Heuristic and Rule-Based Systems

To address the limitations of static blacklists, heuristic-based detection methods were introduced. These systems analyze URL characteristics such as:

• Presence of IP addresses instead of domain names
• Excessive subdomains
• Suspicious keywords (e.g., “login”, “verify”, “secure”)
• URL length and special character usage

While heuristics improve detection of previously unseen URLs, they are inherently brittle. Attackers can reverse-engineer rule sets and craft URLs that deliberately avoid triggering known heuristics. This leads to an adversarial cycle where detection rules must be continuously updated, yet remain perpetually behind evolving attack strategies.

Additionally, heuristic systems often produce high false-positive rates, particularly in environments where legitimate services use complex or dynamically generated URLs (e.g., cloud platforms, SaaS applications). This operational friction reduces usability and undermines trust in automated filtering mechanisms.

2.3 Machine Learning Approaches

The introduction of machine learning significantly advanced phishing detection by enabling pattern recognition beyond static rules. Supervised learning models—such as Decision Trees, Random Forests, Support Vector Machines (SVM), and Gradient Boosting—have been widely applied to classify URLs based on extracted features.

2.3.1 Lexical Feature-Based Models

Most early ML-based systems rely on lexical features derived directly from URL strings. These include:

• Character frequency distributions
• Token lengths and segmentation
• Presence of delimiters and special characters
• Domain and subdomain structure

These models outperform heuristic systems by learning statistical patterns across large datasets. However, they still operate within a constrained feature space that can be manipulated. Adversaries can generate URLs that statistically resemble benign ones, effectively bypassing classifiers trained solely on superficial structural attributes.

2.3.2 Content-Based and DOM Analysis

Some approaches extend beyond the URL itself and analyze webpage content, including HTML structure, JavaScript behavior, and visual similarity to legitimate websites. While these methods improve detection accuracy, they introduce significant computational overhead and latency. Real-time classification becomes challenging, particularly in high-throughput environments such as enterprise gateways.

Additionally, content-based approaches require fetching and rendering web pages, which introduces security risks and resource constraints. As a result, they are less suitable for scalable, real-time deployment.

2.3.3 Deep Learning Models

Recent research explores deep learning architectures, including Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs), for phishing detection. These models can automatically learn hierarchical representations of URL structures and, in some cases, outperform traditional ML models.

However, deep learning approaches introduce several trade-offs:

• Reduced interpretability (black-box behavior)
• Higher computational cost
• Increased training data requirements
• Difficulty in operational deployment within constrained environments

In enterprise security contexts, interpretability and explainability remain critical for incident response and compliance, limiting the practical adoption of purely deep learning–based systems.

2.4 Hybrid Detection Models

Recognizing the limitations of single-domain feature extraction, some studies have proposed hybrid models that combine lexical, host-based, and network-level features. These approaches represent a shift toward more comprehensive threat modeling. Features such as WHOIS data, IP reputation, and DNS characteristics have been incorporated to improve classification performance.

Despite this progress, two key gaps remain: First, many hybrid models underutilize information-theoretic measures, such as entropy, to quantify randomness and obfuscation in URL structures. Entropy provides a mathematically grounded method for detecting algorithmically generated or deliberately randomized domains, which are common in phishing campaigns. Second, behavioral signals are often treated superficially or inconsistently. Critical indicators—such as redirection patterns, DNS volatility, and TLS anomalies—are either excluded or insufficiently integrated into the feature engineering pipeline. This results in models that still lack full visibility into the operational characteristics of phishing infrastructure.

2.5 Identified Research Gap

From the analysis above, the following limitations are evident across existing approaches:

• Over-reliance on static or lexical-only features
• Insufficient modeling of dynamic and behavioral characteristics
• Limited integration of entropy-based analysis
• Trade-offs between accuracy, interpretability, and deployability

These gaps directly contribute to elevated false-positive rates and reduced robustness against adversarial manipulation.

2.6 Positioning of This Work

This research addresses these deficiencies through a structured hybrid feature engineering framework that:

• Formally incorporates entropy as a primary signal for detecting structural randomness
• Integrates behavioral telemetry (DNS, redirection, TLS, hosting patterns) into the feature space
• Maintains compatibility with interpretable, high-performance supervised learning models
• Prioritizes deployability within real-world enterprise security architectures

Unlike prior approaches, the proposed model does not treat phishing detection as a purely static classification problem. Instead, it models phishing URLs as artifacts of dynamic adversarial systems, capturing both their structural and operational signatures.

3. Feature Engineering Methodology

This section defines the core technical contribution of the research: a structured, hybrid feature engineering framework that transforms phishing URL detection from a purely lexical classification problem into a multi-dimensional signal analysis task. The methodology is deliberately constructed to capture both structural randomness and operational behavior, enabling robust discrimination in adversarial conditions.

The feature space is divided into two primary domains:

• Lexical / Entropy-Based Features (Static Analysis)
• Behavioral Features (Dynamic and Contextual Analysis)

These domains are fused into a unified feature vector for supervised learning.

3.1 Design Principles

The feature engineering strategy is guided by three constraints:

3.2 Lexical and Entropy-Based Features

Lexical features are derived directly from the URL string without external resolution. These features capture structural properties, randomness, and statistical irregularities commonly present in phishing URLs.

3.2.1 Shannon Entropy as a Core Signal

Entropy is used to quantify the degree of randomness within a URL string. Phishing URLs—particularly those generated algorithmically or obfuscated—tend to exhibit higher entropy than human-readable legitimate domains.

3.2.2 URL Structural Features

The following lexical attributes are extracted:

• • URL Length: Obfuscation correlation.
• • Subdomain Depth: Deceptive nesting detection.
• • Special Character Ratio: Manipulation metrics.
• • Digit-to-Character Ratio: Numeric noise evasion.
• • Token Variance: Segmentation irregularities.
• • Keywords: Weighted signals (e.g., “login”).

3.2.3 Advanced Lexical Metrics

To move beyond basic features, the model incorporates:

• Character Distribution Variance: Measures deviation from expected natural language patterns.
• N-gram Irregularity Scores: Detects unnatural sequences of characters.
• Domain Randomness Index (Custom Feature): A composite metric combining entropy, digit ratio, and token variance.

This layer ensures that lexical analysis is not superficial but statistically grounded.

3.3 Behavioral Feature Extraction

This is the differentiating layer of the model. Unlike lexical features, behavioral signals capture how a URL behaves within network and infrastructure contexts. Phishing campaigns rely on unstable, short-lived, and often misconfigured infrastructure. These properties create detectable patterns.

3.3.1 Redirection Behavior

Redirect Chain Length: Phishing URLs frequently use multiple redirects to obscure final destinations.

Redirect Consistency: Legitimate services maintain predictable redirect patterns; phishing chains are often irregular.

Final Landing Domain Mismatch: Discrepancy between initial URL and resolved endpoint.

3.3.2 DNS and Domain Intelligence

Domain Age: Newly registered domains are high-risk indicators.

DNS Time-To-Live (TTL) Variability: Frequent changes suggest fast-flux infrastructure.

Resolution Stability: Inconsistent IP mappings over time indicate malicious hosting behavior.

WHOIS Completeness and Anomalies: Missing or anonymized registration details.

3.3.3 Hosting and Network Indicators

Autonomous System Number (ASN) Reputation: Certain hosting networks are statistically associated with malicious activity.

IP Geolocation Volatility: Rapid geographic shifts in hosting endpoints.

Shared Hosting Density: High concentration of suspicious domains on the same IP.

3.3.4 Transport Layer Security (TLS) Signals

Certificate Validity Duration: Short-lived certificates may indicate automated issuance for phishing.

Issuer Reputation: Less trusted certificate authorities.

Domain-Certificate Mismatch: Inconsistencies between URL and certificate subject.

3.3.5 Temporal and Response Behavior

Time-to-First-Byte (TTFB): Abnormal latency patterns from poorly provisioned infrastructure.

Availability Consistency: Phishing sites often exhibit intermittent uptime.

3.4 Feature Vector Construction

All extracted features are normalized and combined into a unified feature vector:

Feature scaling techniques (e.g., Min-Max normalization or Z-score standardization) are applied to ensure compatibility across models.

3.5 Feature Importance and Selection

To prevent overfitting and improve model efficiency:

• Correlation Analysis is used to remove redundant features
• Feature Importance Ranking (via ensemble models) identifies dominant signals
• Recursive Feature Elimination (RFE) refines the final feature set

Expected Outcome: Behavioral features significantly reduce false positives by providing contextual validation beyond surface-level URL structure.

3.6 Adversarial Considerations

The feature engineering process explicitly accounts for attacker adaptation:

• Entropy-based detection resists simple keyword manipulation
• Behavioral features are harder to spoof without operational cost
• Multi-domain feature fusion increases evasion complexity

This shifts the attacker’s burden from trivial string manipulation to infrastructure-level sophistication.

3.7 Summary of Methodological Advantage

The proposed feature engineering framework differs from existing approaches in three fundamental ways:

1. It quantifies randomness rigorously using entropy rather than heuristic approximations
2. It models phishing as a dynamic system, not just a static artifact
3. It balances performance and deployability, avoiding the overhead of full content analysis or deep learning black-box models

4. Machine Learning Models and Training Architecture

This section formalizes the modeling layer that consumes the engineered feature space defined in Section 3. The objective is not merely high classification accuracy, but robust, interpretable, and deployable performance under adversarial conditions. The architecture therefore emphasizes ensemble learning, controlled generalization, and reproducibility.

4.1 Modeling Strategy Overview

Given the heterogeneous feature space (lexical + behavioral), the modeling strategy adopts supervised classification with algorithms capable of:

• Handling mixed feature types (continuous, categorical, derived metrics)
• Capturing non-linear relationships
• Providing feature importance insights
• Operating efficiently in production environments

This combination ensures both statistical rigor and practical deployment feasibility.

4.2 Data Preparation Pipeline

Before training, the dataset undergoes structured preprocessing:

4.2.1 Data Splitting

4.2.2 Feature Normalization

Due to scale differences across features:

• Z-score standardization is applied for SVM
• Min-Max scaling is applied where required for gradient-based optimization
• Tree-based models (RF, GBM) operate without strict scaling requirements but are still evaluated under normalized conditions for consistency.

4.2.3 Handling Class Imbalance

Phishing datasets often exhibit imbalance (fewer malicious samples compared to benign traffic). To mitigate bias:

• SMOTE (Synthetic Minority Over-sampling Technique) is applied on training data
• Class weights are adjusted for SVM and boosting models

This ensures the model does not overfit to the majority class.

4.3 Model Definitions

4.4 Training Procedure

4.4.1 Cross-Validation: To ensure generalization, k-fold cross-validation (k = 5 or 10) is applied, maintaining class balance.

4.4.2 Hyperparameter Optimization: Tuned via Grid Search and Random Search focusing on F1-score and False Positive Rate (FPR).

4.4.3 Model Selection Criteria: The final model is selected based on lowest False Positive Rate (primary), High Recall, and Balanced Precision.

4.5 Evaluation Metrics

The models are evaluated using standard classification metrics: Accuracy, Precision, Recall, F1-Score, and False Positive Rate (FPR).

4.6 Baseline Comparison Framework

To validate the contribution of hybrid feature engineering, two baseline models are defined:

• Baseline A: Lexical features only
• Baseline B: Lexical + limited structural heuristics

4.7 Feature Importance Analysis

Post-training, feature importance is extracted (primarily from Random Forest and Gradient Boosting models):

• Entropy-based features are expected to rank highly
• Behavioral features (e.g., domain age, redirect depth) provide strong discriminatory power
• Combined features outperform isolated feature groups

4.8 Model Robustness and Overfitting Control

To ensure stability, cross-validation variance is monitored and regularization is tuned. Models are tested against newly observed phishing samples and slightly perturbed benign URLs.

4.9 Deployment Readiness Considerations

Tree-based models are favored for deployment due to fast inference, low memory footprint, and native support for feature importance.

4.10 Summary of Modeling Advantage

The modeling architecture delivers strong performance across multiple classifiers, reduced false positives, and high interpretability for security operations.

5. Dataset Construction and Preprocessing

This section establishes the empirical foundation of the study. In phishing detection research, dataset quality is the primary determinant of credibility. Weak sourcing, poor labeling, or leakage between training and test sets will invalidate results regardless of model sophistication. The methodology here is therefore explicit, reproducible, and aligned with operational data realities.

5.1 Dataset Design Objectives

The dataset is constructed to satisfy four constraints:

5.2 Data Sources

5.2.1 Phishing URL Collection

Phishing samples are aggregated from multiple channels to reduce source bias:

• CTI

  Threat Intelligence Feeds

  Aggregated feeds providing verified phishing indicators (community and commercial).

• PUB

  Open Phishing Repositories

  Public datasets containing reported phishing URLs.

• INT

  Internal CTI Logs (Megadriod Unit)

  Real-world indicators observed across monitored environments.

5.2.2 Benign URL Collection

Benign samples are curated to reflect legitimate traffic diversity:

• High-ranking domains (enterprise, financial services, SaaS platforms)
• Frequently accessed URLs from anonymized browsing logs
• Verified non-malicious domains across multiple industries

Special care is taken to avoid bias toward overly “clean” datasets. Legitimate URLs include complex, parameterized structures typical of modern web applications.

5.3 Data Labeling and Validation

5.3.1 Ground Truth Assignment: Each URL is assigned a binary label: 1 (Phishing/Malicious) or 0 (Benign/Legitimate). Labeling is validated via cross-referencing, reputation checks, and manual verification.

5.3.2 Label Confidence Scoring: To improve reliability, each sample is associated with a score based on the number of independent sources confirming the label, consistency across time, and behavioral validation. Low-confidence samples are excluded.

5.4 Data Cleaning and Deduplication

5.5 Temporal Consistency and Leakage Prevention

A critical but often ignored issue in phishing research is temporal leakage, where future knowledge unintentionally influences training.

5.6 Class Distribution and Balancing

To address the raw dataset imbalance between minority (phishing) and majority (benign) classes, controlled downsampling and SMOTE are applied.

5.7 Feature Extraction Pipeline

5.8 Handling Missing and Noisy Data

Behavioral data is inherently incomplete due to domain expiration or network timeouts. Strategy: missing values encoded via sentinel values, selective imputation, and importance-based signal discarding.

5.9 Dataset Scale and Composition

5.10 Data Pipeline Architecture

5.11 Ethical and Compliance Considerations

Process ensures no storage of PII, anonymization of traffic sources, and alignment with Nigeria Data Protection Regulation and ISO/IEC 27001.

5.12 Summary of Dataset Integrity

The dataset methodology ensures high-confidence labeling, realistic representation, and protection against data leakage, providing a reliable foundation for true detection capability.

6. Experimental Results and Performance Evaluation

This section presents the empirical validation of the proposed hybrid feature-engineered model. The evaluation is designed to demonstrate not only classification performance but also operational relevance, with particular emphasis on false-positive reduction, which directly impacts enterprise usability and trust in automated detection systems.

6.1 Experimental Setup

All models described in Section 4 were trained and evaluated using the dataset constructed in Section 5. Experiments were conducted under controlled conditions to ensure reproducibility.

6.2 Evaluation Metrics

Model performance is assessed using standard classification metrics: Accuracy, Precision, Recall, and F1-Score. However, the **False Positive Rate (FPR)** is identified as the primary optimization target.

6.3 Baseline Performance

6.4 Proposed Model Performance

The hybrid model integrating entropy and behavioral features demonstrates consistent improvement across all metrics.

6.5 False Positive Reduction Analysis

The measurable reduction in false positives is attributed to: Behavioral Validation Layer, Entropy as a Discriminator, and Feature Interaction Effects.

6.6 Model Comparison

6.7 Feature Importance Results

Behavioral features consistently rank among the top predictors, validating the hypothesis that phishing detection requires more than static analysis.

6.8 Error Analysis

6.8.1 False Positives: Primarily complex enterprise URLs with dynamic tokens, CDN links with high entropy, and short-lived legitimate domains.

6.8.2 False Negatives: Observed when phishing domains mimic legitimate infrastructure closely or use reputable hosting providers.

6.9 Robustness Testing

Models were tested on newly collected phishing URLs and slightly perturbed benign URLs. Outcome: The proposed model maintained stable performance with minimal degradation under simulated adversarial conditions.

6.10 Statistical Significance

Performance improvements were validated via cross-validation consistency and confidence interval estimation. The observed false-positive reduction is consistent and not due to random variation.

6.11 Operational Impact

• Reduced alert fatigue for security teams
• Lower disruption of legitimate user activity
• Improved trust in automated detection systems

6.12 Summary of Findings

The experimental results confirm that hybrid feature engineering significantly enhances detection, behavioral signals are essential for reducing false positives, and the model is operationally viable.

7. Deployment Architecture and System Integration

This section operationalizes the research. The objective is to translate the validated model into a production-grade detection engine that integrates seamlessly with enterprise security infrastructure. The design prioritizes low-latency inference, modularity, observability, and compliance alignment.

7.1 System Overview: Megadriod Phishing Detection Engine (MPDE)

The proposed system—MPDE—is a service-oriented architecture that ingests URLs from multiple control points, enriches them with features, performs real-time classification, and returns actionable verdicts with explainability artifacts.

Core capabilities:

• Real-time URL classification
• Hybrid feature extraction
• Model inference with confidence scoring
• Explainable outputs (top contributing features)
• Feedback loop for continuous learning

7.2 High-Level Architecture

The system is organized into five logical layers: Ingestion, Feature Extraction, Inference, Decision & Policy, and Telemetry & Feedback. Data flows are asynchronous where possible, with synchronous “fast path” decisions for inline enforcement.

7.3 Ingestion Layer

7.4 Feature Extraction Layer

This layer implements the methodology from Section 3 as a set of microservices, splitting processing into Fast and Enrichment paths.

7.5 Inference Layer

A stateless service exposing the trained model(s): Gradient Boosting (Primary) and Random Forest (Fallback).

7.6 Decision & Policy Layer

Maps model outputs to enforcement actions based on environment-specific thresholds and risk aggregation.

7.7 Telemetry & Feedback Layer

Critical for continuous improvement: handles event logging, drift detection, and SOC analyst feedback ingestion to trigger retraining snapshots.

7.8 Integration Points

7.9 Performance Engineering

Includes TTL-aware caching, queue-based batching for high volumes, and independent autoscaling for CPU and IO-bound services.

7.10 Security Hardening

Outbound request sandboxing, egress controls, input validation to prevent injection, and vault-backed secrets management.

7.11 Compliance and Control Mapping

Deployment supports ISO/IEC 27001 (A.12, A.13, A.16) and Nigeria Data Protection Regulation through risk exposure reduction and data minimization.

7.12 Deployment Topologies

• 1. Inline: Enforcement mode via SWG/SEG.
• 2. Out-of-band: SIEM enrichment mode.
• 3. Hybrid: Fast-path inline + Asynchronous updates.

7.13 SLA Targets

7.14 Summary

MPDE converts research into a scalable, low-latency detection service, satisfying real-world enterprise constraints through modular scaling and graceful degradation.