Explainable Machine Learning for Phishing Detection on Heterogeneous Datasets with MCP-Enabled Deployment

Phishing remains a critical security threat: According to Verizon data cited in the paper, phishing is involved in 36% of all data breaches, underscoring why organizations need better detection methods beyond traditional approaches.

Explainability is essential for security tools: The paper demonstrates that using explainable AI techniques (SHAP, LIME, and Information Gain) to identify which features most influence phishing detection decisions makes security systems more trustworthy and interpretable to users and security teams.

Machine learning can effectively detect phishing: The research achieved 95.01% accuracy using CatBoost, suggesting that well-designed ML models can reliably identify phishing attempts when trained on diverse, realistic datasets including AI-generated examples.

Real-world deployment requires practical considerations: The paper's inclusion of an MCP-enabled system for real-time URL analysis and "confidence-based classification" highlights that responsible AI for security must balance accuracy with practical usability—security tools need to work in actual organizational environments, not just in research settings.

Training data diversity matters: By testing on heterogeneous datasets (including publicly available data, synthetically generated phishing attempts, and AI-generated examples), the research demonstrates that robust phishing detection requires exposure to varied attack types rather than relying on a single data source.