PhishNet: A Cost-Sensitive Stacked-Ensemble Approach to Machine Learning-Based Phishing Website Detection

Jahnavi Somaraju, Dhanalakshmi G, Rakshitha V, Kavitha G, Rajani A

Real-world phishing traffic is heavily imbalanced — legitimate URLs vastly outnumber phishing ones in any live traffic stream — and the two error types carry different costs: a missed phishing site (false negative) can lead directly to credential theft, while a legitimate site wrongly blocked (false positive) erodes user trust in the detector itself. Most published phishing classifiers are trained and evaluated on artificially balanced datasets with a single fixed decision threshold, which does not reflect either the imbalance or the asymmetric cost structure a detector actually faces in deployment. This paper proposes PhishNet, a cost-sensitive phishing detection system built around two design choices largely absent from prior singleclassifier or flat-ensemble systems: tiered feature acquisition, which extracts cheap lexical and DNS-level features first and only escalates to expensive page-rendering features when the cheap tier is inconclusive, and a stacked-generalization ensemble (five tier-appropriate base learners combined by a logistic-regression meta-learner) trained with fold-safe oversampling and an explicit cost matrix rather than a single fixed threshold. We present the tiered feature taxonomy, the stacking architecture, an imbalance-aware training pipeline, an edge-cached deployment design, and a cost-curve-based evaluation protocol for selecting a deployment-appropriate operating point rather than reporting one threshold-independent accuracy figure. A worked case study traces one URL through every tier of the pipeline. Full benchmark-scale quantitative results across the proposed test scenarios are scoped as the immediate next phase of this work and are described here as a concrete, reproducible protocol.