Enhancing Phishing Detection through Feature Importance Analysis and Explainable AI: A Comparative Study of CatBoost, XGBoost, and EBM Models

Understanding why AI makes decisions matters for security: The paper demonstrates that using explainable AI techniques (like SHAP) to show why a system flags an email or link as phishing is just as important as accuracy itself. This transparency helps security teams trust and properly deploy these systems in real-world settings.

Simpler models can be more reliable: CatBoost maintained high accuracy even when using fewer features to make decisions, suggesting that phishing detection doesn't require overly complex systems. This finding supports building more maintainable and auditable security tools rather than "black box" solutions.

Specific website characteristics are strong phishing indicators: The research identified concrete features—like URL length, how recently a domain was registered ("time_domain_activation"), and a site's reputation ranking ("Page_rank")—as reliable red flags for phishing attempts, providing actionable insights for both AI systems and human security experts.

Different AI tools have different strengths: While XGBoost was fastest for processing large volumes of data, CatBoost proved more robust and adaptable. This suggests organizations should evaluate multiple approaches rather than assuming one solution fits all security needs.

Feature selection is foundational to responsible AI: By carefully choosing which characteristics the system analyzes, researchers improved both performance and interpretability, demonstrating that thoughtful data preparation is essential for building AI systems that are both effective and trustworthy.