Enhancing phishing website detection: a comparative study of SMOTETomek-XGB and SMOTEENN-XGB

Abstract

In the evolving landscape of cybersecurity, phishing websites continue to be a persistent threat, challenging detection methods due to the significant class imbalance between phishing and legitimate websites. This study evaluates the effectiveness of two advanced hybrid-resampling techniques SMOTETomek and SMOTEENN integrated with the extreme gradient boosting (XGBoost) classifier to enhance phishing website detection. SMOTETomek combines the synthetic minority over-sampling technique (SMOTE) with Tomek links, creating synthetic examples and eliminating overlapping instances to address dataset imbalance. SMOTEENN, on the other hand, merges SMOTE with edited nearest neighbors (ENN) to improve class balance through synthetic sample generation and noise reduction. The comparative analysis reveals that both methods significantly enhance classification performance, SMOTETomek-XGB consistently outperforms SMOTEENN-XGB across key evaluation metrics, including accuracy, F1 score, recall, and receiver operating characteristic - area under the curve (ROC-AUC), underscoring its superior effectiveness in distinguishing phishing sites from legitimate ones. This study offers practical insights into the application of advanced resampling methods for improving machine learning model performance in cybersecurity.