Analysis of Feature Selection Effects on Phishing URL Detection Performance

Abstract

Phishing remains a significant cybersecurity threat, highlighting the need for effective methods to identify malicious URLs. Machine learning has been widely applied to phishing detection, but its performance depends partly on the features used for classification. Feature selection offers a potential solution by reducing the number of input features while retaining relevant information. This study aims to analyze the effect of Mutual Information (MI)-based feature selection on the classification performance and training time of Random Forest, Extreme Gradient Boosting (XGBoost), and Linear Support Vector Machine (SVM) for phishing URL detection. The experiments used the PhiUSIIL Phishing URL (Website) Dataset, consisting of 235,795 records and 50 numerical and binary features after preprocessing. MI was used to rank features and construct five feature subsets containing the top 10, 20, 30, 40, and 50 features. Model performance was evaluated using accuracy, precision, recall, F1-score, and training time. Random and domain-based data splitting were also examined to assess performance under different evaluation conditions. The results show that feature selection can reduce input dimensionality while maintaining high classification performance. In particular, XGBoost achieved an F1-score of approximately 99.995% using the top 10 features in the combined URL and webpage feature group. However, the effect of feature selection varied across algorithms and feature groups, indicating that additional features did not consistently improve performance. These findings suggest that MI-based feature selection can support more compact phishing detection models. Further evaluation using independent datasets is needed to assess the generalizability of the results.