Phishing URL Random Forest
Random Forest classifier that labels a URL as phishing or safe from 14 lexical features of the URL text (length, dots, hyphens, digits, "@", IP host, suspicious keywords, etc.). The scheme (http/https) is removed before feature extraction.
Student project: Hasan Ratul (20243120073), Professional Training 2, Yunnan University.
Code: https://github.com/ratulhasan16961/PT22026 (branch has073-phishing, folder has073).
Training data
"Phishing Site URLs" (Kaggle, 549,346 URLs). After removing duplicates: 507,195 URLs (392,897 safe, 114,298 phishing). Training URLs with a path also received a domain-only copy to remove a dataset shortcut (path-less URLs were 97.5% phishing).
Results (20% stratified test set, 101,439 URLs)
| Metric | Value |
|---|---|
| Accuracy | 0.91 |
| Phishing precision / recall / F1 | 0.90 / 0.68 / 0.78 |
| ROC-AUC | 0.952 |
Domain-only test (path removed from the same test URLs): safe recall 0.99, phishing recall 0.23, phishing precision 0.85, ROC-AUC 0.710.
Limitations
- Only URL text is used. Phishing recall is 68% and drops to 23% without the path.
- The dataset is old and its safe and phishing URLs come from different sources, so real-world performance would likely be lower.
- Educational demo, not a security tool.
Usage
Trained with scikit-learn 1.9.1, numpy 2.5.4, pandas 3.1.0. Use the same versions to load it. Only load pickle files from sources you trust.
from huggingface_hub import hf_hub_download
import joblib
model = joblib.load(hf_hub_download("Ratul16961/phishing-url-random-forest", "best_model.joblib"))