Abstract:

Operational phishing detection requires predictive quality and interpretable model behavior. This study compares global interpretability of logistic regression, Random Forest, Extreme Gradient Boosting (XGBoost), a Support Vector Machine (SVM) and Multilayer Perceptron (MLP). A multi-source corpus of Uniform Resource Locators (URLs) and infrastructure features was split by registrable domain into 108 762 training, 21 676 validation and 21 000 test cases. Rankings across 110 and 47 features emphasized URL length, delimiters and infrastructure differently. Reduction changed F1 by at most 0.0022 for four models - MLP declined from 0.9156 to 0.8811. XGBoost achieved the highest ROC-AUC (0.9811) and the lowest false-positive rate (FPR - 0.0196). The external generalization test reduced every model’s specificity. These findings support model-aware interpretation and validation after source changes: coherent rankings establish neither generalization nor causality.