Table of Contents
Type: Dissertation Proposal | Subject: Computer Science | Level: Masters | Word Count: ~2,400 words
This model dissertation proposal was produced by an Essays UK specialist as reference material for learning purposes only. For support in this field, see our computer science writing team.
Overview: This model dissertation proposal sets out a plan to detect phishing URLs using supervised machine learning. It frames the problem, reviews the principal detection techniques, and specifies an experimental methodology that compares several classifiers on a labelled URL dataset using standard evaluation metrics, supported by a realistic project timeline and an ethical framework.
Phishing remains one of the most persistent and damaging forms of cyber-crime, exploiting human trust rather than purely technical vulnerabilities. In a typical attack, a fraudulent web page impersonates a legitimate service and persuades the victim to disclose credentials, payment details, or other sensitive information. The uniform resource locator (URL) is central to this deception because it is the first artefact a potential victim encounters and, crucially, one that can be examined before any page content is loaded. Industry monitoring bodies such as the Anti-Phishing Working Group have reported that the volume of distinct phishing sites continues to grow year on year, with attackers increasingly registering short-lived domains that evade static defences (Anti-Phishing Working Group, 2023).
Traditional countermeasures rely heavily on blacklists: curated databases of known malicious URLs distributed to browsers and email gateways. While blacklists produce very few false positives, they are inherently reactive. A newly created phishing URL will not appear on any list until it has been reported, analysed, and published, by which time much of the harm may already have been done. Because the operational lifetime of a phishing site is frequently measured in hours rather than days, the window in which a blacklist is useful is narrow. Heuristic rule-based systems extend coverage by flagging suspicious patterns, but they are brittle, demand constant manual tuning, and are readily circumvented once their rules are understood.
Machine learning offers a more adaptive alternative. By learning the statistical patterns that distinguish malicious URLs from benign ones, a trained classifier can generalise to previously unseen addresses without requiring an exact match in any database. This dissertation therefore investigates the extent to which supervised machine learning can detect phishing URLs accurately and efficiently, using features extracted directly from the URL string and its associated metadata. The study is motivated by the practical need for proactive, low-latency detection that complements existing blacklist infrastructure rather than seeking to replace it outright.
The aim of this dissertation is to design, implement, and critically evaluate a machine learning pipeline capable of classifying URLs as phishing or legitimate, and to determine which combination of features and classification algorithm offers the best balance of detection accuracy, false-positive rate, and computational cost.
To achieve this aim, the research will pursue the following objectives:
The investigation is guided by three research questions:
The following review summarises the principal strands of research relevant to this study and identifies the gap that the dissertation will address.
Early and still widely deployed defences depend on blacklists and signature matching. These mechanisms are fast and generate very few false alarms, but their reactive nature leaves systems exposed during the critical first hours of a campaign (Dubois and Tanaka, 2018). Heuristic systems attempt to close this gap by encoding expert rules, for example flagging any URL that contains an IP address in place of a domain name or an unusually long sequence of subdomains. While useful, such rules are static: once attackers understand them, they are trivially evaded by minor modifications to the URL structure.
A substantial body of work treats phishing detection as a supervised classification problem driven by hand-crafted features. Lexical features derived from the URL string — its length, the number of dots and special characters, the presence of an IP address in place of a registered domain, and the appearance of brand or action keywords such as “login” or “verify” — have proved particularly informative (Rossi and Novak, 2020). Host-based features, including domain age obtained through WHOIS queries and the presence of a valid TLS certificate, add further discriminative power, but they require network lookups that increase latency and introduce a dependency on external services. Comparative studies report that ensemble methods such as random forests and gradient boosting tend to outperform single classifiers, although the margin varies with the feature set and the composition of the dataset (Ahmed and Okonkwo, 2019; Mensah and Ahmed, 2020).
More recent research applies deep neural networks directly to the raw URL, treating it as a sequence of characters and allowing the model to learn representations automatically (Haddad, Lindqvist and Mensah, 2021). Convolutional and recurrent architectures can capture subtle patterns that manual feature engineering may overlook, and they remove the need for external lookups. However, they typically demand larger training sets, longer training times, and offer limited interpretability — a significant drawback in security contexts, where analysts must be able to understand and justify an automated decision (Nowak and Dubois, 2021).
Across the literature, three issues recur. First, results are frequently reported on differently constructed datasets, which makes direct comparison between studies unreliable. Second, many studies emphasise headline accuracy while under-reporting the false-positive rate, which is arguably the most consequential metric for a system that must not block legitimate traffic. Third, the trade-off between the predictive strength of deep models and the interpretability and speed of feature-based models is rarely quantified within a single controlled experiment. This dissertation addresses these gaps by evaluating a spectrum of models on one consistently prepared dataset, by using a metric suite that foregrounds the false-positive rate, and by explicitly measuring the accuracy, interpretability, and latency trade-off.
The study adopts a quantitative, experimental design grounded in a positivist research philosophy, which is appropriate for an investigation that tests measurable hypotheses under controlled conditions. The central hypothesis is that a feature-based ensemble classifier can achieve detection performance comparable to a character-level deep learning model while offering greater interpretability and lower inference latency. The work follows the established knowledge-discovery process of data collection, pre-processing, feature engineering, modelling, and evaluation, with each stage documented to support reproducibility.
Phishing URLs will be drawn from established public feeds such as PhishTank and OpenPhish, which aggregate community-verified reports (PhishTank, 2026). Legitimate URLs will be sampled from a reputable top-sites ranking such as the Tranco list, which is specifically designed to resist manipulation (Le Pochat et al., 2019). The target is a balanced corpus of approximately 20,000 URLs, split evenly between the two classes to avoid the misleading accuracy that severe class imbalance can produce. Where residual imbalance remains, the synthetic minority over-sampling technique (SMOTE) will be considered (Chawla et al., 2002). Duplicate and malformed entries will be removed, and every URL will be normalised to a consistent format before feature extraction so that the models learn from genuine structural differences rather than formatting artefacts.
Features will be grouped into two categories, as summarised below. Lexical features are computed from the URL string alone and are therefore fast to extract, whereas host-based features require external lookups and will be treated as an optional enhancement whose cost is measured explicitly.
| Feature Category | Example Features | Rationale |
|---|---|---|
| Lexical | URL length; count of dots, hyphens and digits; number of subdomains; presence of an IP address; use of an “@” symbol; suspicious keywords (login, verify, secure, account, update); character entropy; use of a URL-shortening service | Captures the structural tricks attackers use to disguise a malicious address; computed instantly from the string |
| Host-based | Domain age (WHOIS); domain registration length; presence of a valid TLS certificate; DNS record availability | Reflects the short-lived, hastily registered infrastructure typical of phishing campaigns; adds accuracy at the cost of latency |
To ensure a fair comparison across model families, the study will train and tune the following algorithms:
All classical models will be implemented in Python using the scikit-learn library (Pedregosa et al., 2011), with the deep model built in a standard neural network framework. Hyperparameters will be optimised through grid search combined with stratified five-fold cross-validation, ensuring that every configuration is assessed on representative subsets of the data.
The dataset will be partitioned into a 70% training set, a 15% validation set, and a 15% held-out test set using stratified sampling to preserve class balance in each partition. Models will be trained on the training set, tuned on the validation set, and assessed only once on the test set to give an unbiased estimate of generalisation performance. To support reproducibility, random seeds will be fixed and the complete pipeline, including the feature-extraction code, will be version-controlled.
Because the dataset is balanced but the operational cost of errors is asymmetric, accuracy alone would be an insufficient measure of success. The following metrics will therefore be reported for every model.
| Metric | Definition | Relevance to Phishing Detection |
|---|---|---|
| Accuracy | Proportion of all URLs classified correctly | A general headline figure, but insufficient on its own |
| Precision | Proportion of flagged URLs that are genuinely phishing | High precision keeps the false-positive rate low, protecting legitimate traffic |
| Recall | Proportion of actual phishing URLs successfully caught | High recall minimises the number of threats that slip through |
| F1 score | Harmonic mean of precision and recall | Balances the two competing error types in a single figure |
| ROC-AUC | Area under the receiver operating characteristic curve | Summarises performance across all decision thresholds |
| Inference latency | Average time to classify a single URL | Determines whether a model is viable for real-time filtering |
The dissertation will be completed over a 24-week period. The indicative schedule below allocates time to each phase and builds in a contingency buffer to absorb delays in data collection or model tuning.
| Phase | Key Activities | Duration |
|---|---|---|
| 1. Literature review | Survey existing work; refine research questions | Weeks 1–4 |
| 2. Data collection | Gather and clean phishing and legitimate URLs | Weeks 5–8 |
| 3. Feature engineering | Implement and validate lexical and host-based features | Weeks 9–11 |
| 4. Model development | Train, tune and cross-validate all classifiers | Weeks 12–16 |
| 5. Evaluation and analysis | Compute metrics; compare and interpret results | Weeks 17–20 |
| 6. Writing and revision | Draft, review and finalise the dissertation | Weeks 21–24 |
Although the research does not involve human participants, several ethical and legal considerations apply. Phishing URLs may point to live malicious content; they will therefore be handled only as text strings and never visited within an ordinary browser or on a networked machine that could be compromised. Any dynamic analysis that proves necessary will take place within an isolated, sandboxed environment. The datasets used are publicly available and will be employed in accordance with their respective terms of use and licences. No personal data relating to victims or attackers will be collected or processed, which keeps the study outside the scope of the UK GDPR and the Data Protection Act 2018. The research will be conducted in line with the university’s code of research ethics and submitted for ethical review and approval before data collection begins. Finally, the dual-use nature of the work is acknowledged: any insight into evasion techniques will be reported responsibly and framed to strengthen defences rather than to assist attackers.
The dissertation is expected to contribute a controlled, like-for-like comparison of feature-based and deep learning approaches on a single, carefully prepared dataset, together with a clear account of the accuracy, interpretability, and latency trade-off that practitioners face in practice. The findings should inform the design of proactive detection layers that complement, rather than replace, existing blacklists. Several limitations are anticipated. A static, URL-only approach cannot inspect page content or runtime behaviour, so it may miss attacks that rely on otherwise innocuous-looking addresses. Public feeds may carry labelling errors and sampling bias, and because attackers adapt continually, any deployed model will require periodic retraining to remain effective. These limitations will be discussed candidly in the completed dissertation so that the strength of the conclusions can be judged fairly.
You May Also Like
All work is written by human writers. 100% AI free, guaranteed.
100% money back guarantee if you find plagiarism in our work.
COMPANY DETAILS
