url phishing

The dataset employed in this study is a large-scale, clustered phishing detection dataset designed to support advanced machine learning (ML), deep learning (DL), and hybrid AI-based approaches for identifying phishing and malicious URLs. The specific dataset under consideration, referred to as the Cluster dataset, contains 147,292 individual samples, each corresponding to a unique URL instance. These instances represent both malicious (phishing) and benign (legitimate) URLs collected from multiple heterogeneous sources, ensuring diversity in terms of domain structure, hosting infrastructure, and attack sophistication. The dataset is structured for binary classification, making it suitable for supervised learning paradigms. Each sample is described by 112 numerical features, all of which are derived from URL strings, domain metadata, DNS records, and network-level observations. The exclusive use of numeric features eliminates the need for extensive encoding or tokenization steps, allowing direct compatibility with a wide range of ML and DL algorithms. Class Labels and Distribution The target variable in the dataset is denoted as label, which follows a binary encoding scheme: Label = 1: Indicates phishing or malicious URLs Label = 0: Indicates legitimate or benign URLs Out of the total 147,292 samples, the dataset includes: 61,294 malicious URLs (positive class) 85,998 benign URLs (negative class) This distribution reflects a moderate class imbalance, with benign URLs slightly dominating the dataset. Such imbalance is typical of real-world cybersecurity datasets, where legitimate traffic generally exceeds malicious activity. The presence of this imbalance makes the dataset particularly useful for evaluating classifier robustness, precision–recall trade-offs, and cost-sensitive learning strategies. URL-Centric Feature Design URLs remain one of the most widely exploited vectors for phishing attacks, serving as entry points for credential theft, malware delivery, and social engineering campaigns. Modern phishing URLs often employ lexical obfuscation, domain impersonation, excessive parameterization, and short-lived infrastructure to evade detection. To address these challenges, the dataset emphasizes URL-based characteristics that capture both surface-level patterns and deep structural cues associated with malicious intent. The selected features aim to balance interpretability, discriminative power, and computational efficiency, making them suitable for both traditional ML models and complex DL architectures. Feature Composition and Categorization The 112 features in the dataset can be broadly categorized into the following groups: Lexical and Character-Level Features Structural and Length-Based Features Directory and Parameter Analysis Features Domain and Host-Based Features Network and Infrastructure-Level Features Security and Certificate-Related Features本研究采用的数据集为大规模聚类式钓鱼检测数据集，旨在为识别钓鱼与恶意统一资源定位符（Uniform Resource Locator, URL）的先进机器学习（Machine Learning, ML）、深度学习（Deep Learning, DL）以及混合人工智能方法提供支撑。 本次研究聚焦的特定数据集被命名为Cluster数据集，共包含147292个独立样本，每个样本对应一个唯一的URL实例。这些样本涵盖恶意（钓鱼）与良性（合法）两类URL，采集自多个异构数据源，确保了在域名结构、托管基础设施与攻击复杂度层面的多样性。该数据集采用二元分类结构，适配监督学习范式。 每个样本由112个数值型特征描述，所有特征均源自URL字符串、域名元数据、域名系统（Domain Name System, DNS）记录以及网络级观测数据。仅使用数值型特征无需进行大量编码或分词（Tokenization）步骤，可直接兼容绝大多数机器学习与深度学习算法。 类别标签与分布 该数据集的目标变量记为label，采用二元编码方案： Label=1：表示钓鱼或恶意URL Label=0：表示合法或良性URL 在全部147292个样本中，数据集包含： 61294个恶意URL（正类） 85998个良性URL（负类） 该分布存在中等程度的类别不平衡，良性样本略占多数。此类不平衡是真实网络安全数据集的典型特征，因为合法流量通常多于恶意活动。该不平衡特性使得该数据集特别适合用于评估分类器的鲁棒性、精确率-召回率权衡以及代价敏感学习策略。 以URL为核心的特征设计 URL仍是钓鱼攻击最广泛利用的攻击向量之一，作为凭证窃取、恶意软件分发以及社会工程活动的入口点。现代钓鱼URL通常采用词汇混淆、域名仿冒、过度参数化以及短期托管基础设施等手段来逃避检测。 为应对这些挑战，本数据集重点提取基于URL的特征，以捕获与恶意意图相关的表层模式与深层结构线索。所选特征兼顾可解释性、判别能力与计算效率，既适用于传统机器学习模型，也适配复杂的深度学习架构。 特征组成与分类 该数据集包含的112个特征可大致划分为以下类别： 词汇与字符级特征 结构与长度特征 目录与参数分析特征 域名与主机级特征 网络与基础设施级特征 安全与证书相关特征