通过特征重要性分析提升钓鱼网站检测准确率
Enhancing Phishing Detection through Feature Importance Analysis and Explainable AI: A Comparative Study of CatBoost, XGBoost, and EBM Models
- 用递归特征消除法筛选出长度、域名激活时间等关键特征
- XGBoost运行快适合大数据，CatBoost在特征减少时仍保持高精度
- 结合SHAP解释技术，让模型决策过程透明可信任
钓鱼攻击持续威胁网络安全，亟需高效检测方法。本研究通过机器学习识别钓鱼网址，强调特征选择与模型可解释性对性能的关键作用。采用递归特征消除法，精准识别出'length_url'、'time_domain_activation'和'Page_rank'等关键特征作为钓鱼行为强指标。评估了CatBoost、XGBoost及Explainable Boosting Machine（EBM）等多种算法的鲁棒性与扩展性。XGBoost在运行时间上表现优异，适用于大规模数据；CatBoost在特征缩减情况下仍保持高准确率，展现强韧性。通过SHAP等可解释AI技术揭示特征重要性，增强系统透明度与可信度。研究结果表明，有效的特征选择与可解释性能显著提升钓鱼检测系统性能，为应对不断演化的网络威胁提供更高效、灵活的防御路径。
原文摘要 · Abstract (English)
Phishing attacks remain a persistent threat to online security, demanding robust detection methods. This study investigates the use of machine learning to identify phishing URLs, emphasizing the crucial role of feature selection and model interpretability for improved performance. Employing Recursive Feature Elimination, the research pinpointed key features like "length_url," "time_domain_activation" and "Page_rank" as strong indicators of phishing attempts. The study evaluated various algorithms, including CatBoost, XGBoost, and Explainable Boosting Machine, assessing their robustness and scalability. XGBoost emerged as highly efficient in terms of runtime, making it well-suited for large datasets. CatBoost, on the other hand, demonstrated resilience by maintaining high accuracy even with reduced features. To enhance transparency and trustworthiness, Explainable AI techniques, such as SHAP, were employed to provide insights into feature importance. The study's findings highlight that effective feature selection and model interpretability can significantly bolster phishing detection systems, paving the way for more efficient and adaptable defenses against evolving cyber threats
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。