A comparative Analysis on Stacked Hybrid Intelligence: A Multi-Paradigm Machine Learning Framework for Robust Phishing URL Detection

Abstract

The escalating sophistication of phishing campaigns necessitates detection frameworks that transcend conventional single-paradigm classifiers. This study introduces a comprehensive evaluation of six distinct machine learning architectures spanning traditional ensemble methods, kernel-based classifiers, and deep neural architectures applied to the PhiUSIIL dataset comprising 235,795 URLs with rich lexical and host-based features. This research implement Random Forest (RF), XGBoost, character-level Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (Bi-LSTM) networks, Support Vector Machines (SVM) with Radial Basis Function kernel, and a novel stacked hybrid ensemble integrating RF, XGBoost, and SVM through meta-learning. Rigorous 5-fold cross-validation demonstrates that this research hybrid ensemble achieves superior performance with 98.73% accuracy, 98.91% F1-score, and 99.04% AUC-ROC, outperforming individual models by 1.8–3.4% in critical metrics while maintaining robustness against class imbalance (legitimate-to-phishing ratio 1.34:1). Feature ablation reveals that structural URL features, for instance, CharContinuationRate, URLCharProb; contribute disproportionately to detection efficacy compared to host reputation indicators. Computational analysis further establishes that gradient boosting methods offer optimal accuracy-latency tradeoffs for real-time deployment, whereas deep architectures excel in capturing complex sequential patterns but incur 4.7× higher inference latency. This work provides practitioners with empirically validated guidance for model selection under varying operational constraints and establishes a new benchmark for hybrid intelligence in cyber threat detection.