Skip to content
Contact UsStart Building

Cybersecurity

Phishing website detection

Classify legitimate, suspicious and phishing websites from URL and page indicators for security review.
AI-generated representative illustration of a credible network-security appliance, neat ethernet connections and an unbranded hardware security key.
AI-generated task illustration. Representative scene; not a customer site or benchmark observation.
From known examples to a prediction

Available inputs

  • URL characteristics and domain age
  • Traffic, security indicators and page behavior

Known examples

1,353 recorded examples

Prediction target

Legitimate, suspicious or phishing website
9.2%lower prediction log loss

vs. CatBoost (tuned ensemble), the strongest conventional result in this benchmark.

Phishing website classificationLog loss · Lower is better

1,353 examples · 9 inputs · 30 evaluation splits

00.5
  1. Causilo
    0.2163
  2. CatBoost
    0.2382
  3. LightGBM
    0.2466
  4. Extra trees
    0.2495
  5. XGBoost
    0.2507
  6. Random forest
    0.2572
  7. K-nearest neighbors
    0.2987
  8. Logistic regression
    0.3578

The task in practice

The study uses URL, domain, traffic and page indicators. Recorded labels classify sites as legitimate, suspicious or phishing.

  1. Use labeled website records. Pair the supplied website indicators with their categorical labels.
  2. Describe another website record. Collect the same address, traffic and behavior fields.
  3. Evaluate category probabilities. Check log loss and false-category assignments on independent websites.

Scope. The historical website categories do not establish protection against current phishing campaigns.

Dataset, sources and evaluation

Phishing website classification dataset. Original source and curated OpenML task linked below. Original dataset source.

The TabArena-curated OpenML version (46963) supplies the dataset and recorded target, WebsiteType. Comparison scores come from the retained results_per_split_official.csv evaluation snapshot. These pages describe the task and compare the recorded means; source records are not republished here.

Log loss evaluates the probability assigned to the recorded outcome category. A lower value is better. The percentage compares the reported mean with the strongest conventional result; it does not measure business impact.

Causilo uses its default configuration. Each conventional family uses its strongest reported mean across default, tuned and tuned-ensemble settings. The chart compares reported means, without a claim of statistical significance, customer deployment or operational savings.

Relative error change = (strongest conventional mean − Causilo mean) ÷ strongest conventional mean × 100. A negative change is shown as higher error.

How to read these comparisons · All configurations and original values.