Detecting Phishing Websites from Character-Level URL Sequences: A Bidirectional LSTM Approach with Class-Imbalance Mitigation

Abstract

Phishing websites remain a significant cybersecurity threat, exploiting deceptive Uniform Resource Locator (URLs) to trick users into revealing sensitive information. Existing detection approaches, particularly blacklist-based and traditional Machine Learning (ML) methods, struggle to generalize to newly crafted Phishing URLs and often fail to capture the sequential patterns inherent in URL structures. To address these limitations, this study proposes a Deep Learning (DL)–based Phishing website detection model using a Bidirectional Long Short-Term Memory (Bi-LSTM) network that operates on character-level URL representations. A large-scale dataset comprising 450,176 URLs (Phishing and legitimate) sourced from the Mendeley repository was employed. The URLs were preprocessed through normalization, character-level tokenization, and embedding, while class imbalance was mitigated using Synthetic Minority Over-Sampling Technique (SMOTE). The proposed Bi-LSTM model was trained and evaluated using standard performance metrics, including accuracy, precision, recall, F1-score, and Receiver Operating Characteristic (ROC)–Area Under the Curve (AUC), and was compared against a baseline Convolutional Neural Network (CNN). Experimental results demonstrate that the Bi-LSTM model achieves an accuracy of 97.81%, precision of 94.75%, recall of 95.97%, and an F1-score of 95.36%, outperforming the CNN baseline in terms of accuracy and precision while maintaining comparable recall.