A Robust Ensemble Learning Approach to URL-Based Phishing Webpage Detection

Abstract

The proliferation of online fraud has resulted in substantial financial damage to individuals and organizations alike, with web phishing emerging as one of the most pervasive and harmful attack vectors. In response, this paper proposes the Stacking Ensemble Models Generator (SEMG), a URL-based phishing detection approach that leverages a multi-objective Genetic Algorithm to jointly optimize Precision and Recall in the selection and configuration of stacking ensemble models. An initial pool of base learners is trained on labeled datasets and subsequently evolved through genetic operators toward a globally optimal ensemble. Experimental evaluation across five datasets sourced from Mendeley and UCI repositories demonstrates that SEMG consistently surpasses individual base learners and compares favorably against existing methods, attaining $99.2\%$ performance across all metrics on D2 while matching or exceeding state-of-the-art results on the remaining benchmarks. These outcomes underscore the framework’s robustness and its potential for deployment in real-world phishing detection systems.

1. Introduction

Daily, billions of unsolicited emails circulate; despite improved security consciousness, approximately 33% of phishing messages are opened, with phishing serving as the fundamental trigger for nearly $90\%$ of all data compromises. Moreover, recent data documented close to four million phishing incidents throughout 2024 [1], resulting in yearly global economic damage totaling billions of dollars [2]. This persistent vulnerability stems from URL phishing, which employs deceptive hyperlinks to counterfeit domains that perfectly replicate authentic corporate portals. These platforms manipulate targets into submitting sensitive fiscal information, utilizing artificial urgency to bypass human cognitive defenses. Furthermore, the sheer velocity of modern automated URL generation renders manual blacklisting obsolete, as malicious sites often vanish before detection. To conceal the theft, certain URLs even forward users to the genuine website once credentials have been harvested. While numerous machine learning (ML) strategies have been proposed by investigators, the evolving complexity of these evasive tactics necessitates more robust, real-time detection frameworks.

Numerous modern phishing identification frameworks employ varied ML and deep learning (DL) strategies, integrating ensemble, DL, NLP, and traditional paradigms [3,4,5,6,7,8]. Ensemble approaches regularly utilize stacking or boosting with high-dimensional embedding features, reaching up to $98.60\%$ Accuracy while mitigating class imbalances via reinforcement learning or specialized selectors [3,4,5,6,7,9,10]. DL structures, encompassing convolutional neural networks (CNNs) and generative adversarial networks (GANs), enable automated feature extraction from raw URLs and HTML data, though they frequently necessitate intensive dataset-specific recalibration [11,12,13,14]. Furthermore, NLP-based methods utilize LSTMs and attention mechanisms for sequential analysis, markedly decreasing manual feature engineering in text-heavy scenarios [15,16,17]. Classical techniques still depend on rigorous feature selection and hyperparameter tuning yet remain vulnerable to overfitting on evolving datasets [8,18]. Despite these robust outcomes, most approaches experience “concept drift,” where reliance on narrow feature sets restricts generalization across heterogeneous webpage phishing environments. Additionally, current multi-objective frameworks typically emphasize Accuracy alongside highly localized context-linked metrics; this rigidity expands the architectural overhaul needed for adaptation to new threat landscapes and reduces overall system flexibility.

The objective of this research is to develop a framework capable of generalizing across heterogeneous URL-based phishing datasets regarding instance volume or feature dimensionality. Consequently, SEMG comprises a SEL generator utilizing a multi-objective GA to identify the subset of base learners maximizing both Recall and Precision. Multiple heterogeneous base learners are independently trained and their predictive outputs recorded. The multi-objective optimization algorithm represents a GA variant wherein two primary objectives are maximized: Precision and Recall. The optimization outcome is the SEL model achieving the optimal Precision-Recall balance.To ensure the framework remains entirely agnostic to input data, the two optimized objectives are the metrics of Precision and Recall. To enhance efficacy, we selected diverse model architectures with optimized hyperparameters. To ensure high performance across varied datasets, the framework utilizes a diverse array of modern base learners with differing underlying architectures to maximize structural resilience. Furthermore, we implemented a sophisticated parameter tuning method: Bayesian optimization. Naturally, the architecture allows for integrating superior models or discarding underperforming ones, ensuring high modularity. This methodology is applicable exclusively to labeled data, justifying our focus on URL-based phishing detection. Furthermore, the simultaneous optimization of Precision and Recall is specifically advantageous for phishing detection, as it targets maximizing true positives while mitigating false negatives. In practice, this dual optimization maintains an equilibrium between detecting fraudulent sites and reducing classification errors—a vital requirement in cybersecurity where every false negative carries severe risks.

The remainder of this paper is structured as follows. Section 2 reviews relevant related works, critically highlighting existing approaches and their inherent limitations. Section 3 details the materials and methods employed in this study, including dataset characterizations, model configurations, and evaluation criteria. The results obtained from the experiments are presented in Section 4. Section 5 provides a discussion of the findings, comparing them with previous studies and examining their implications. Finally, Section 6 concludes by summarizing key insights and outlining future research directions.

2. Related Works

The study of phishing detection has gained significant interest due to its critical sensitivity and the escalating proliferation of scam websites. ML-based phishing detection approaches are primarily divided into two major categories defined by their reliance on supervised or unsupervised learning paradigms. The first comprises supervised frameworks that prioritize textual examination through NLP [15,16,17,19,20,21,22,23], uncovering deceptive patterns embedded in emails or webpage bodies by targeting linguistic indicators such as urgency markers, orthographic anomalies, and emotional triggers. DL models including CNNs, LSTMs, RNNs, and BERT have been explored for this purpose [24], with hybrid architectures combining BERT, CNN, GRU, and multi-head attention further refining detection [25]. URL-based neural embedding using n-gram representations has also shown effectiveness in identifying phishing pages [19], while real-time systems leveraging DL have been deployed to intercept attacks before user interaction [16]. While these approaches capture rich semantic context, they are computationally expensive, language-dependent, and generalize poorly across domains, limiting their suitability for real-time or multilingual deployment.

The second category applies both supervised and unsupervised paradigms to structured, preprocessed datasets, utilizing extracted URL properties and numerical metadata. Classical algorithms such as SVM and Naive Bayes [8,18] are widely used alongside ensemble techniques, including boosting and stacking [3,4,5,6,7,9,10,26]. Stacking ensembles have demonstrated consistent improvements over individual classifiers across multiple phishing literature [5,7,10], and hybrid URL-HTML feature fusion architectures have further strengthened detection robustness [14]. Feature selection via mutual information [18] and hybrid optimization [22] have been shown to reduce dimensionality while preserving discriminative power. Comparative studies confirm that white-box models offer interpretability advantages, whereas black-box models tend to yield higher Accuracy [27], and that ensemble methods reliably outperform single classifiers when base learners are sufficiently diverse [28]. Although feature-based methods offer interpretability and lower computational cost, their performance depends heavily on the quality of manual feature engineering, and they remain vulnerable to adversarial URL obfuscation.

A third category employs DL architectures—CNNs, GANs [11,12,13,14,23,29,30], and Transformer-based models such as BERT—to autonomously extract contextual and semantic representations, consistently outperforming conventional methods through superior comprehension of how phishing content mimics legitimate communication. CNN-based models exploiting raw URL and HTML characteristics have achieved state-of-the-art results [11], while dual-branch networks fusing URL and HTML features demonstrate further gains [13]. Optimization-augmented CNNs such as the CNN-Brown-Bear framework [30] have extended robustness against evolving attack vectors. Despite their superior performance, DL architectures demand large labeled datasets and significant computational resources and offer limited interpretability—constraints that restrict deployment in resource-limited environments. A comparison of these approaches is given in

Table 1. Summary of representative ML-based phishing detection approaches.

Ref.	Author/Year	Category	Method	Dataset	Acc.%	Limitations
[26]	Li et al. 2019	Ensemble	Stacking on URL + HTML features	Custom	97.3	Fixed stack; no automatic selection
[4]	Al-sarem et al. 2021	Ensemble	Optimized stacking	UCI + custom	97.16	Single-objective;
[5]	Kalabarige et al. 2022	Ensemble	Multilayer stacking	UCI phishing	98.9	Manual base learner selection
[28]	Wei & Sekiya 2022	Ensemble	Ensemble ML methods	Multiple	96.94	No feature selection; fixed configurations
[9]	Qi et al. 2023	Ensemble	Ensemble + undersampling	Email	99.45	Class imbalance dependency
[31]	Karim et al. 2023	Feature-based ML	Hybrid ML on URL features	Custom	98.12	No ensemble optimization step
[8]	Abdul Samad et al. 2023	Feature-based ML	Fine-tuned ML on URL features	Multiple	97.47	No ensemble; vulnerable to obfuscation
[17]	Sahingoz et al. 2019	NLP	ML on URL text features	Custom URL	97.98	No semantic context; static features
[19]	Bozkir et al. 2023	NLP	N-GRAM embedding + NN	Custom URL	98.27	URL-only; no HTML or content features
[23]	Lakshmi et al. 2021	DL	DL + ADAM optimizer	Web pages	–	High compute; limited generalization
[13]	Korkmaz et al. 2022	DL	Hybrid DL URL + content analysis	Custom	98.37	Complex pipeline; high training cost
[24]	Atawneh & Aljehani 2023	DL	CNN, LSTM, BERT on emails	Email corpus	99.6	Language-dependent; no URL features
[12]	Aldakheel et al. 2023	DL	DL on URLs	Custom URL	98.7	Large data requirement; black-box
[16]	Asiri et al. 2024	DL	Real-time DL phishing detection	Custom web	99.0	High inference cost; not interpretable
[29]	Gupta et al. 2024	DL	CNN + brown-bear optimization	Custom URL	93.0	Metaheuristic overhead; single objective
[14]	Jiang et al. 2025	DL	Dual-branch URL + HTML fusion	Custom web	99.2	Requires HTML access; high compute

.

While the majority of URL-based phishing detection methodologies remain highly context-dependent, necessitating manual architectural adjustments for novel datasets, our approach addresses these limitations by shifting optimization beyond standard feature selection or hyperparameter tuning. The primary deficiency in existing models is their reliance on static ensemble structures where all base learners participate regardless of the input, which often leads to poor generalization across disparate data distributions. To mitigate this, we introduce a decentralized, dataset-independent framework that uniquely constructs a tailored ensemble for each specific case. By dynamically evolving the ensemble composition rather than maintaining a fixed model set, our system facilitates on-the-fly adaptation. This mechanism ensures resilient and stable performance against evolving threats without the need for intensive manual intervention or exhaustive model retraining.

3. SEMG: Design and Methodology

To ensure consistent reliability and adaptive performance across heterogeneous datasets, this research implements a strategic selection of diverse base learners. The ensemble incorporates a spectrum of sophisticated paradigms, including tree-based architectures, probabilistic frameworks, and specialized ensemble methods, each chosen for their demonstrated efficacy in capturing multi-dimensional patterns. By synthesizing these heterogeneous models, the framework constructs a robust composite architecture designed to maintain high classification fidelity across disparate data distributions while enhancing generalization capabilities for unseen instances.

Furthermore, the selection of base learners within SEMG is formulated as a combinatorial optimization problem. Given N candidate models, the number of possible model subsets is $2^N$, making exhaustive evaluation impractical. While simpler ensemble strategies such as weighted voting or heuristic model inclusion can be applied, these approaches typically rely on fixed weighting schemes and do not explicitly optimize multiple objectives. In contrast, the proposed Genetic Algorithm provides a stochastic search mechanism capable of efficiently exploring the large space of possible model combinations while simultaneously optimizing Precision and Recall. This enables SEMG to identify subsets of complementary models that achieve a favorable trade-off between the objectives.

The following subsections provide a comprehensive formalization of each constituent model and the SEMG procedure.

3.1. The Baseline Models

The SEMG framework integrates thirteen heterogeneous base learners to facilitate robust generalization across distinct phishing datasets. This diverse ensemble encompasses linear, tree-based, boosting, and probabilistic paradigms—each strategically selected for their complementary predictive strengths and demonstrated capacity to capture multi-dimensional data patterns. By leveraging this architectural diversity, SEMG dynamically identifies the optimal subset of learners for each specific data distribution, autonomously adapting its search trajectory to synthesize the most effective SEL model. The final classification output of the SEL architecture is adjudicated via a voting ensemble technique, ensuring the framework achieves high-fidelity, adaptive performance across evolving threat landscapes.

3.1.1. Tree-Based Learners

Tree-based architectures iteratively segment the input space $\mathcal{X}$ into mutually exclusive regions by optimizing a specific impurity reduction metric (e.g., Gini impurity or information entropy). Every leaf node provides a fixed prediction, yielding a piecewise-constant estimation of the underlying mapping.

• Decision Tree (DT): Decision Tree [32] constructs a hierarchical architecture of decision rules. Despite being highly expressive, an individual tree exhibits high variance and remains significantly sensitive to data perturbations.
• Extra Tree (ET): Extra Tree [33] incorporates randomness during split threshold selection, diminishing correlation among partitions and marginally biasing the estimator toward lower variance.

3.1.2. Bagging-Based Ensemble Learners

Bagging estimates the ideal predictor by aggregating various models developed on bootstrap replicates. Mathematically, if $f_b\left(x\right)$ represents the output of the b-th model, the collective ensemble result is:

$$\widehat{f}\left(x\right)={\displaystyle \frac{1}{B}}\sum _{b=1}^B{f}_b\left(x\right),$$

(1)

which reduces variance when base learners are weakly correlated.

• Bagging (BAG): Combines outputs from autonomously trained learners to enhance predictive stability.
• Random Forest (RF): Augments bagging via stochastic sampling of instances and features, minimizing inter-tree dependence.
• Random Subspace Forest (RSF): Emphasizes feature-level sub-sampling, prompting learners to investigate diverse projections of the input manifold.
• Balanced Random Forest (BRF): Adjusts bootstrap procedures to normalize class proportions, effectively redirecting the empirical risk toward minority groups.
• Extra Trees (ETs): Randomizes feature choice and splitting points, boosting ensemble variance and mitigating overfitting despite a marginal bias rise.

3.1.3. Boosting-Based Ensemble Learners

Boosting builds an additive framework by iteratively minimizing a loss function $L(y,f(x\left)\right)$. In every iteration, a subsequent learner estimates the negative gradient of the loss:

$$f_m\left(x\right)=f_{m-1}\left(x\right)+\eta h_m\left(x\right),$$

(2)

where $\eta$ is the learning rate and $h_m$ is the weak learner.

• Gradient Boosting (GB): Successively rectifies residual errors to construct a powerful ensemble from a sequence of weak learners.
• Histogram-based Gradient Boosting (HGB): Employs discretized feature binning for efficient gradient approximation, lowering computational overhead without compromising the underlying optimization integrity.
• Enhanced Histogram Gradient Boosting (HGB+): Augments HGB through increased tree depth and specialized regularization, boosting predictive power while effectively mitigating potential overfitting.

3.1.4. Distance-Based Learners

Metric-based models allocate categories according to closeness within the attribute manifold. Provided a distance metric $d(x_i,x_j)$, prediction is derived from local spatial architecture instead of a defined parametric framework.

• k-Nearest Neighbors (KNN): Determines class assignments via majority consensus across k proximal instances, essentially executing local density approximation.

3.1.5. Kernel-Based Learners

Non-linear techniques indirectly project input vectors into a high-dimensional feature space $\varphi \left(x\right)$, facilitating the determination of linear separability. The corresponding decision function is formulated as

$$f\left(x\right)=\sum _{i=1}^n{\alpha }_{i}K(x,x_i)+b,$$

(3)

where $K(·,·)$ is a kernel function.

• Support Vector Classifier with RBF Kernel (SVC-RBF): Identifies intricate, non-linear classification boundaries utilizing radial basis functions.
• Support Vector Classifier with Polynomial Kernel (SVC-POLY): Utilizes polynomial kernels to capture feature interactions up to a defined degree.

3.2. The Proposed SEMG Approach

For a specific webpage phishing instance, the proposed framework, SEMG, is engineered to generate the most appropriate Stacking Ensemble Learner (SEL) for the target dataset. The overall architecture of SEMG is depicted in Figure 1. The workflow commences with data preprocessing, followed by the training of all base learners whose predictive outputs are subsequently archived. A multi-objective GA is then utilized to evolve an initial population from these base learners, eventually producing the optimal SEL for the dataset. This section introduces the proposed framework, an innovative approach that combines GAs and ML in a cooperative strategy. At its essence, SEMG seeks to optimize a population of individuals, each signifying an SEL model configured from several trained learners. Furthermore, the optimization is multi-objective, concurrently maximizing both the Precision and Recall of the synthesized SEL.

3.2.1. Preprocessing Step

To prepare the dataset for ML, a preprocessing phase ensures data consistency and computational compatibility. Missing values are addressed through mean imputation to preserve statistical integrity. Categorical strings are transformed into numerical format using One-Hot Encoding (OHE), which maps each unique category to a binary indicator. For example, a categorical feature with values such as “small,” “medium,” and “large” is transformed into binary codes: 001, 010, and 100, respectively. While OHE can drastically expand a dataset’s dimensions, its impact in this study is minimal because the utilized datasets consist almost entirely of numerical attributes, with little to no categorical density.

3.2.2. Precision and Recall as Objectives

Precision and Recall are essential metrics for evaluating ML models, especially in classification tasks. Precision quantifies the proportion of correctly identified positive instances among all instances predicted as positive (Equation (4)), whereas Recall measures the proportion of actual positive instances correctly identified by the model (Equation (5)). Balancing these two measures is often critical, as prioritizing one over the other depends on the specific application and its tolerance for errors. For instance, in web phishing detection, achieving high Recall is crucial to minimize the risk of overlooking true positive cases. In the present work, both Precision and Recall are regarded as equally important objectives, and the optimization process seeks to maximize them concurrently within a multi-objective framework.

3.2.3. Fitness with Multi-Objective Optimization

Within multi-objective optimization utilizing population-based heuristics like GA, the fitness function serves to assess individuals and steer the evolutionary trajectory. In this research, fitness is characterized by two objectives—Precision and Recall—which are concurrently maximized. The selection operator identifies individuals according to Pareto dominance, ensuring that merely non-dominated solutions advance to the subsequent generation. This methodology sustains an equilibrium between both objectives without collapsing them into a solitary scalar value. The replacement mechanism similarly depends on Pareto-based ranking to maintain diversity and foster convergence toward the optimal front, consequently producing Stacking Ensemble Learners (SELs) with balanced predictive efficacy.

3.2.4. Feature Selection

Feature selection represents a vital phase in ML, facilitating dimensionality reduction and enhancing model interpretability while mitigating overfitting. In this research, we utilize SHAP (SHapley Additive exPlanations) [34] to precisely quantify each feature’s contribution. Specifically, a tree-based Random Forest Classifier serves as the underlying architecture to calculate feature importance. We subsequently retain the top $80\%$ of features and prune the remaining $20\%$. This threshold is selected as a balanced compromise: it ensures that the model preserves a high density of informational cues necessary for sensitive phishing detection—avoiding the bias associated with drastic feature removal—while simultaneously filtering out low-correlation attributes that increase computational latency and noise. Although the current results demonstrate stability at this ratio, the sensitivity of the framework to varying percentile thresholds remains an area for future empirical study.

3.2.5. Initial Population

Within the SEMG algorithm, every individual in the starting population is represented as a binary vector (or string), where each bit identifies a specific base learner inside the Stacking Ensemble Learner (SEL). A bit value of 1 indicates the inclusion of the related base learner, whereas 0 signifies its exclusion. To maintain the structural validity of each SEL, a constraint is applied: any vector featuring fewer than two active learners is immediately modified by randomly enabling extra bits. This process mandates a minimum ensemble size, thus ensuring that every individual constitutes a feasible and functionally significant SEL configuration. The initial population is produced utilizing a random algorithm with a fixed value of $seed=42$.

3.2.6. Genetic Operators of SEMG

The procedure enters an iterative cycle where the SEL population is refined through successive generations. Individuals are assessed via multi-objective criteria (Precision and Recall), using Pareto dominance selection, crossover, and mutation to produce offspring. Replacement strategies safeguard non-dominated solutions to ensure convergence toward a Pareto-optimal set. This GA-driven optimization evaluates the synergy between heterogeneous learners, identifying diverse model combinations that compensate for individual weaknesses. Consequently, the framework achieves a more robust classification than standard greedy or other simple selection strategies.

(a)

Evaluation: For each individual i, predictions are retrieved from the pre-recorded outputs of base learners and aggregated via a voting mechanism to generate $y\_pred$. Unlike conventional stacking, which requires training a meta-learner, this voting strategy eliminates secondary training overhead and reduces the risk of overfitting to specific data distributions. This ensures a lightweight, generalized ensemble configuration. Performance is then evaluated as a fitness tuple (Precision, Recall) to rank individuals within the multi-objective optimization process.

(b)

Selection: Individuals for the subsequent generation are determined through the Tournament selection method. This strategy involves randomly sampling a population subset to identify the two individuals that are non-dominated with respect to the multi-objective fitness criteria (Precision and Recall). These selected individuals subsequently serve as the parent candidates for the crossover operator.

(c)

Crossover: The crossover operator enables the recombination of genetic material between two parent individuals, promoting the propagation and synthesis of advantageous traits within the population. By randomly selecting a crossover point along the binary strings and exchanging the subsequent segments, two new offspring are generated. This operation is governed by a specified crossover rate $cr$, which ensures controlled diversification while preserving high-quality genetic information from the parental generation.

(d)

Mutation: The mutation operator facilitates stochastic perturbations by inverting a single bit within each offspring based on a low, predefined probability. Governed by a specific mutation rate $mr$, this mechanism sustains population diversity and enhances search space exploration. By introducing these random variations, the operator mitigates the risk of premature convergence and promotes the discovery of globally optimal solutions.

(e)

Replacement: The replacement operator updates the population by evaluating offspring through the multi-objective criteria of Precision and Recall. While adhering to Pareto dominance, the F1-score is used as a heuristic to streamline comparisons and reduce computational overhead. Offspring replace the least fit individuals only if they demonstrate a superior balance of Precision and Recall. This ensures the population converges toward the Pareto-optimal front while maintaining the diversity and quality required for robust ensemble selection.

The evolutionary sequence—comprising evaluation, selection, crossover, mutation, and replacement—iterates until the terminal criterion is satisfied, which, in this study, is defined as a fixed number of generations. A detailed pseudocode description of SEMG is given in Algorithm 1.

3.2.7. Non-Dominated Solutions

Upon the conclusion of the iterative evolutionary process, the performance metrics for each SEL individual in the terminal population are analyzed. SEMG identifies non-dominated solutions by evaluating individuals across both Precision and Recall, ensuring no candidate is strictly outperformed in both objectives. This procedure yields one or more Pareto-optimal SEL configurations representing diverse trade-offs. These optimized solutions and their respective metrics are recorded for subsequent analytical review or practical deployment.

4. Experimental Results

To evaluate the efficacy of SEMG on the provided dataset and analyze its performance under various tuning configurations, several experiments were conducted. The dataset utilized in this research was sourced from Mendeley and Kaggle (for further details, refer to Section 4.1). The specific hyperparameter and parameter optimization strategies are detailed in Section 4.3 given their critical role. Section 3.2.3 defines the fitness function employed to assess candidate solutions. Section 4.4 introduces and analyzes several cases to visualize the Pareto frontier generated by the multi-objective optimization process. Ultimately, comparative analyses were performed against all 15 evaluated models and current state-of-the-art methodologies—detailed in Section 4.5 and Section 4.11—to validate the proposed approach. A comprehensive evaluation and interpretation of the primary results are provided throughout each experimental phase.

All experiments were conducted on a laptop featuring an Intel Core i5-4200M 2.5 GHz processor, 12 GB of RAM, and Windows 10 (32-bit), utilizing Python 3.9 and Scikit-learn 1.1.2. Given these available computational resources, an 80/20 train–test split was adopted rather than k-fold cross-validation. As illustrated in the runtime analysis, the concurrent hyperparameter tuning and training of 13 base learners represent the most time-consuming phases of the pipeline; repeating this loop for multiple folds would result in unsustainable execution times in a standard research environment. Instead, robustness was ensured by validating the framework across five independent datasets to prevent overfitting.

To overcome current scalability constraints, future implementations could utilize distributed computing, parallel processing, and resource-efficient methods like model pruning or quantization. Furthermore, the adoption of cloud platforms and hardware accelerators such as GPUs or TPUs would significantly optimize the Genetic Algorithm, allowing the SEMG framework to handle larger datasets and more demanding real-world applications.

Algorithm 1: Stacking Ensemble Models Generator.

Require: A dataset $\mathcal{D}$, a set of base models $\mathcal{M}$, population size N, number of generations G, mutation probability $p_m$ Ensure: Best ensemble $E^{best}$ and Pareto-optimal ensemble set $\mathcal{P}*$ 1: Load dataset $\mathcal{D}$ and perform the preprocessing 2: Split $\mathcal{D}$ into training and test sets 3: Perform feature selection based on SHAP 4: for each model $m\in \mathcal{M}$ do 5:    Perform $BayesSearchCV$ hyperparameter tuning 6:    Train the baseline models on the training data 7:    Generate predictions on the test set 8:    Record predictions and evaluation metrics 9: end for 10: Encode each SEL as a binary vector indicating selected models 11: Initialize population ${\mathcal{P}}_0$ of size N randomly (Ensuring each individual has at least two models) 12: for generation $g=1$ to G do 13:    for each individual $E_i\in {\mathcal{P}}_{g-1}$ do 14:       Evaluate $E_i$: 15:           Precision $\left(E_i\right)$ and Recall $\left(E_i\right)$ 16:    end for 17:    Select 2 parents using Tournament 18:    Apply single-point crossover to generate two offspring 19:    Apply mutation to offspring with probability $p_m$ 20:    Evaluate offspring fitness 21:    Compute F1-score for all individuals 22:    Identify the two worst individuals based on F1-score 23:    if offspring dominates the worst individual and is not duplicated then 24:        Replace the worst individual with the offspring 25:    end if 26: end for 27: Identify the best solution $E^{best}$ based on maximum F1-score 28: Evaluate all individuals using multi-objective metrics 29: Extract Pareto-optimal set $\mathcal{P}*$ based on Precision–Recall dominance return $E^{best}$, $\mathcal{P}*$

4.1. Datasets Description

To rigorously evaluate the efficacy and robustness of the proposed framework across heterogeneous data distributions, five distinct webpage phishing datasets were curated from the Kaggle and Mendeley repositories. These datasets, summarized in Table 2, encompass a wide range of feature dimensionalities and class balances to ensure a comprehensive characterization of model performance.

Dataset D1 consists of 11,054 samples characterized by 30 numeric features, featuring a moderate imbalance between its 4898 phishing and 6157 legitimate instances. In contrast, Dataset D2 [35] provides a perfectly balanced benchmark with 10,000 samples and 48 detailed features extracted via browser automation. Datasets D3 and D4 represent high-dimensional variants containing 111 features per instance; D3 contains 58,645 instances with a slight phishing bias, while D4 is a larger, imbalanced set containing 88,647 samples. Finally, Dataset D5 [36,37] is a large-scale repository of 100,077 instances described by 20 numerical features covering URL, domain metadata, and traffic behavior.

While these datasets exhibit moderate class imbalance, specific resampling techniques were not utilized, as the base learners demonstrated stable performance during preliminary testing. Instead, the framework inherently mitigates imbalance risks by employing a multi-objective optimization strategy based on a (Precision, Recall) fitness tuple. Unlike Accuracy, this approach ensures the selection process prioritizes models that maintain high sensitivity to the minority class, providing a more robust evaluation of phishing detection. Future iterations will explore cost-sensitive learning to handle more extreme skewness in data distributions.

Table 2. Description of the datasets.

Dataset	Instances	Features	Balance	Source
D1	11,054	30	Moderately Imbalanced	Kaggle [38]
D2	10,000	48	Balanced	Mendeley [35]
D3	58,645	111	Slightly Imbalanced	[36]
D4	88,647	111	Highly Imbalanced	[36]
D5	100,077	20	Moderately Imbalanced	Kaggle [39]

Table 2. Description of the datasets.

Dataset	Instances	Features	Balance	Source
D1	11,054	30	Moderately Imbalanced	Kaggle [38]
D2	10,000	48	Balanced	Mendeley [35]
D3	58,645	111	Slightly Imbalanced	[36]
D4	88,647	111	Highly Imbalanced	[36]
D5	100,077	20	Moderately Imbalanced	Kaggle [39]

The five datasets (D1–D5) exhibit a heterogeneous feature structure that reflects the evolution of phishing detection methodologies. Dataset D1 comprises 30 predominantly binary indicators spanning lexical URL properties (e.g., LongURL, Symbol@), host-based metadata (DomainRegLen, AgeofDomain), and content-level deception signals (IframeRedirection, DisableRightClick). Dataset D2 expands this scope with 48 features extracted via browser automation, emphasizing quantitative lexical metrics (NumDots, UrlLength) alongside DOM-based indicators (InsecureForms, EmbeddedBrandName) and real-time behavioral variants (features suffixed with RT). Datasets D3 and D4 represent the most granular approach, with 111 fine-grained counting features that decompose URLs, domains, directories, files, and parameters into character-level frequencies (e.g., qty_dot_url, qty_hyphen_domain), complemented by infrastructure-level attributes (asn_ip, qty_nameservers, tls_ss_certificate) and temporal signals (time_domain_activation). In contrast, Dataset D5 adopts a minimalist lexical strategy, relying on 20 simple character-count features (n_dots, n_slash, n_at) derived solely from the URL string. Collectively, these datasets span a spectrum from high-level semantic indicators (D1, D2) to low-level syntactic and infrastructure metrics (D3, D4, D5), enabling a comprehensive evaluation of model robustness across feature abstraction levels.

4.2. Metrics Used to Evaluate SEMG Performance

This research investigated the phishing webpage detection challenge through the implementation of SEMG. The fundamental objective is to design an optimal stacking ensemble learning model that efficiently equilibrates classification performance indicators. Specifically, our methodology prioritizes the simultaneous maximization of two essential objectives: Precision and Recall. These are vital metrics within the phishing detection domain, as they govern the framework’s capacity to accurately distinguish malicious entities while mitigating false positives and false negatives. For performance assessment, we utilize standard classification metrics including Precision, Recall (alternatively, True Positive Rate or $TPR$), Accuracy, and the F1-score, which are formally defined as follows:

$$\mathrm{Precision}={\displaystyle \frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FP}}}$$

(4)

$$\mathrm{Recall}={\displaystyle \frac{\mathrm{TP}}{\mathrm{TP}+\mathrm{FN}}}$$

(5)

$$\mathrm{Accuracy}={\displaystyle \frac{\mathrm{TP}+\mathrm{TN}}{\mathrm{TP}+\mathrm{FP}+\mathrm{TN}+\mathrm{FN}}}$$

(6)

$$\mathrm{F}1\mathrm{-score}=2\times {\displaystyle \frac{\mathrm{Precision}\times \mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}$$

(7)

Accuracy serves as a straightforward metric for classification efficacy but often proves deceptive within imbalanced datasets given its inherent indifference toward class distributions. Precision emphasizes the Accuracy of positive predictions, which is vital when false positives incur high costs, whereas Recall quantifies the capability to capture all true positive instances—a priority when false negatives necessitate minimization. The F1-score, representing the harmonic mean of Precision and Recall, offers a comprehensive equilibrium particularly advantageous for evaluating performance in skewed data environments.

4.3. Configuration and Tuning of Hyperparameters and Parameters

Hyperparameter optimization is essential for maximizing model performance. In this research, the task is particularly demanding due to the heterogeneity of datasets and the diverse learning algorithms employed, each requiring a specialized optimization process. While exhaustive techniques like Grid Search and stochastic approaches such as Random Search are viable, they often incur prohibitive computational costs. Consequently, Bayesian optimization [40] was selected as the tuning strategy across all models and datasets. The implementation utilizes BayesSearchCV, configured with 15 optimization iterations, 3-fold cross-validation, and Accuracy as the primary evaluation metric. By constructing a probabilistic surrogate model of the objective function, Bayesian optimization intelligently identifies the next hyperparameter configurations, effectively balancing exploration and exploitation to converge toward optimal settings with significantly fewer evaluations than Grid or Random Search. This tuning procedure is executed independently for each model, adhering to the hyperparameter ranges and configurations specified in

Table 3. Search spaces of hyperparameter used for tuning the base learners.

Model	Abbrev.	Hyperparameter Explored
Random Forest	RF	$n\_estimators\in \{50,100,200\}$; $max\_depth\in \{5,10,20\}$; $min\_samples\_split\in \{2,5,10\}$
Random Subspace Forest	RSF	$n\_estimators\in \{100,200\}$; $max\_samples\in \{0.6,0.8\}$; $max\_features\in \{0.6,0.8\}$
Balanced Random Forest	BRF	$n\_estimators\in \{100,200\}$; $max\_depth\in \{\mathrm{None},10,20\}$
Histogram Gradient Boosting	HGB	$max\_iter\in \{50,100,200\}$; $learning\_rate\in \{0.01,0.1,0.2\}$; $max\_depth\in \{3,5,7\}$
Enhanced Hist. Gradient Boosting	HGB+	$max\_iter\in \{200,400\}$; $learning\_rate\in \{0.03,0.1\}$; $max\_depth\in \{5,8\}$; $l2\in \{0.0,0.1\}$
Gradient Boosting	GB	$n\_estimators\in \{50,100,200\}$; $learning\_rate\in \{0.01,0.1,0.2\}$; $max\_depth\in \{3,5,7\}$
Bagging	BAG	$n\_estimators\in \{50,100,200\}$; $max\_samples\in \{0.6,0.8,1.0\}$
Decision Tree	DT	$max\_depth\in \{5,10,20\}$; $min\_samples\_split\in \{2,5,10\}$
Extra Tree (single)	ET	$max\_depth\in \{\mathrm{None},10,20\}$
Extra Trees	ETs	$n\_estimators\in \{10,50,100\}$; $max\_depth\in \{2,8,16,32,50\}$; $min\_samples\_split\in \{2,4,6\}$; $min\_samples\_leaf\in \{1,2\}$
Support Vector Classifier (RBF)	SVC-RBF	$C\in \{0.1,1,10\}$; $\gamma \in \{\mathrm{scale},\mathrm{auto}\}$
Support Vector Classifier (POLY)	SVC-POLY	$C\in \{0.1,1,10\}$; $degree\in \{2,3\}$; $\gamma \in \left\{\mathrm{scale}\right\}$
k-Nearest Neighbors	KNN	$n\_neighbors\in \{5,7,11,15\}$; $weights\in \{\mathrm{uniform},\mathrm{distance}\}$; $metric\in \{\mathrm{euclidean},\mathrm{manhattan}\}$

.

Furthermore, the GA parameters—encompassing population size, total generations (iterations), crossover probability, mutation rate, and tournament selection size—exert a substantial influence on overall performance and therefore warrant careful tuning. Optimal configurations for these parameters can be identified through diverse strategies, such as meta-optimization with other algorithms, machine learning-based tuning, adaptive mechanisms, or systematic empirical experimentation. In the present study, the GA parameters are configured using widely accepted and well-validated values drawn from the extensive literature on GA behavior, which have become established as de facto standards in many applications. The specific SEMG parameter settings adopted are as follows: The population size ($ps$) was set to 30 individuals, evolving over a total of 300 iterations ($ni$). For the evolutionary operators, a crossover rate ($cr$) of 1 was applied to maximize the recombination of genetic material, while the mutation rate ($mr$) was maintained at 0.2 to prevent premature convergence. Parent selection was conducted using a tournament size ($tour$) of 5. Finally, to ensure the reproducibility of the experimental results, the random number generator was initialized with a $seed$ of 42.

4.4. Pareto Front Analysis

The experiment assesses the SEMG approach, which optimizes the trade-off between Precision and Recall in webpage phishing detection. SEMG aims to evolve non-dominated solutions representing optimal compromises between these metrics.

Figure 2 illustrates the Pareto frontier across the five datasets, with Precision on the x-axis and Recall on the y-axis. Blue points represent dominated solutions, where at least one alternative improves both objectives. Conversely, the red point signifies the non-dominated solution residing on the Pareto frontier, marking the optimal Precision-Recall equilibrium.

The Pareto fronts show an approximately linear relationship between objectives, indicating that Precision and Recall are not antagonistic in this context; enhancements in one typically correlate with gains in the other. For datasets D1 and D2, a distinct grouping of solutions is observed, where horizontal dispersion is primarily driven by Recall while Precision levels vary. A single non-dominated solution is identified for D1, D2, D3, and D4, reflecting a compact and coherent population distribution. Conversely, D5 exhibits a wider spread with two non-dominated solutions. These variations likely stem from dataset heterogeneity regarding instance volume, feature dimensionality, and internal feature correlations.

The results indicate that improvements in Precision and Recall are generally aligned rather than conflicting, which explains why the Pareto front frequently collapses to a single non-dominated solution for datasets D1 through D4. This behavior suggests that the two objectives are not antagonistic in these cases, leading to a constrained Pareto frontier with limited diversity in optimal solutions. The exception observed in D5 can be attributed to its nature as a laboratory-generated dataset, which introduces different characteristics. Furthermore, experimental variations in genetic algorithm parameters—such as the number of generations or crossover rate—did not significantly affect the obtained solutions, influencing only the runtime.

Table 4. The non-dominated SEL solutions for each dataset obtained by SEMG.

	RF	RSF	BRF	HGB	HGB+	GB	BAG	DT	ET	ETs	SVC-RBF	SVC-POLY	KNN	MLP
D1	0	0	0	1	1	0	0	0	0	1	0	0	0	1
D2	0	0	0	0	1	1	0	0	0	1	0	0	1	1
D3	0	0	0	0	0	1	0	0	0	1	0	0	1	0
D4	0	0	0	0	1	1	1	0	0	1	0	0	1	0
D5	0	0	1	1	0	1	0	0	0	0	0	0	0	0
	1	0	1	1	0	1	0	0	0	0	0	0	0	0
Total	1	0	2	3	3	5	1	0	0	4	0	0	3	2

summarizes the non-dominated SEL solutions across datasets and highlights model selection frequencies. GB (5 selections) and ETs (4 selections) are the most frequently chosen, followed by HGB, HGB+, and KNN (3 selections each), whereas RSF, DT, ET, SVC-RBF, and SVC-POLY are not selected.

4.5. Evaluating SEMG Against Base Learners

The performance of 13 baseline models and the proposed framework was evaluated across five webpage phishing datasets using four standard metrics: Accuracy, Precision, Recall, and F1-score. Consistent results reveal that ensemble-based methods generally exceed the performance of simpler learners, while the proposed approach maintains superior efficacy across all benchmarks. Full metric recordings for the proposed method and base learners on each dataset are presented throughout this section.

Figure 3, which illustrates model performance metrics on dataset D1, reveals consistently strong results across all evaluation criteria, though minor under-performance is observed for DT, ET, SVC-RBF, and SVC-POLY. This trend is likely attributable to the dataset’s relative simplicity. Notably, MLP and HGB+ emerge as the leading base learners, whereas the SEL model selected by SEMG achieves a slight performance gain over them (Precision $=97.30\%$, Recall $=97.29\%$, Accuracy $=97.29\%$ and F1-score $=97.28\%$).

As illustrated in Figure 4, the comparative analysis on dataset D2 demonstrates that the configuration identified by SEMG outperformed all alternative models. In contrast, ET and specifically KNN exhibited suboptimal performance. Furthermore, the two SVC-based architectures were omitted from the final selection due to their prohibitive computational demands during the training phase.

The evaluation of Dataset D3, illustrated in Figure 5, highlights a substantial performance advantage for the model identified by the SEMG framework. While the MLP, KNN, SVC, ET, and DT architectures exhibited suboptimal results, the GB model achieved strong predictive capability, yielding $96.06\%$ across all evaluated metrics. These findings are corroborated by the results for Dataset D4 in Figure 6, where the proposed methodology consistently enhanced the efficacy of the constituent base models. Notably, the SVC-based configurations demonstrated the lowest overall performance.

Experimental results on dataset D5, illustrated in Figure 7, indicate a high level of performance across all participating models. The specific configuration identified by the proposed framework yields a marginal enhancement over these strong baseline figures, achieving a Precision of $89.83\%$, Recall of $89.77\%$, Accuracy of $89.77\%$, and an F1-score of $89.80\%$.

Across the five datasets and four evaluation metrics, the “best-performing” model is inconsistent, with different base learners leading in different scenarios. This lack of a clear, universal winner underscores that no single model is sufficiently generalizable for diverse phishing environments. By contrast, the SEMG framework dynamically optimizes the ensemble composition, providing a robust solution that outperforms individual models regardless of the dataset’s specific characteristics.

Collectively, these findings indicate that the proposed framework sustains a consistently high level of efficacy across heterogeneous phishing datasets. Its capacity to marginally exceed the performance of optimized base learners—specifically within more complex or volatile data distributions (e.g., $D3$ and $D5$)—underscores its inherent robustness and architectural adaptability.

4.6. Runtime Analysis

The computational efficiency of the SEMG framework was evaluated across all five datasets, as illustrated in Figure 8. The total execution time is partitioned into four primary phases: (1) data preprocessing, (2) feature selection, (3) base learner training and hyperparameter tuning, and (4) the execution of Genetic Algorithm (GA) operators.

Empirical results indicate that the initial preprocessing and feature selection stages account for a negligible fraction of the total runtime. In contrast, the majority of computational resources are consumed during the hyperparameter tuning of the base models. The duration of the GA phase is inherently parametric, scaling with the population size and the number of iterations defined in the experimental setup. Furthermore, a direct correlation was observed between dataset complexity—specifically sample size and feature dimensionality—and total processing time. These findings suggest that while the framework is computationally intensive during the offline optimization phase, its modularity allows for scalable deployment depending on the available hardware and specific GA configurations.

4.7. Matrices of Confusion

Figure 9 illustrates the confusion matrices generated by applying the proposed framework across all evaluated datasets. It is important to note that the data was partitioned into an 80% training and 20% testing split. These matrices demonstrate that the model successfully classified the vast majority of legitimate and phishing webpages, exhibiting a negligible volume of errors. Specifically, the results show that only a minimal number of legitimate sites were incorrectly categorized as phishing, while very few phishing instances evaded detection. The high degree of alignment between the predicted and actual labels signifies a robust discriminatory capacity. Furthermore, the occurrence of false positives and false negatives remained exceptionally low relative to the total number of correct predictions. Consequently, the confusion matrices confirm a highly reliable classification performance characterized by minimal error rates.

This experimental phase examines the efficacy of a stacked ensemble learning framework for URL-phishing identification across five heterogeneous datasets ($D1$–$D5$). The stacking architecture synthesizes predictive outputs from a diverse array of base learners to enhance global classification Accuracy. Performance metrics are derived via confusion matrices, which provide a visual representation of the model’s Precision in distinguishing between “Negative” (legitimate) and “Positive” (fraudulent) webpages.

The following provides a detailed analytical decomposition of the confusion matrix results obtained for each evaluated dataset:

1.

D1: The approach demonstrates superior classification fidelity, yielding 934 true negatives and 1217 true positives. With a notably low occurrence of both false positives (18) and false negatives (42), the model proves highly effective at accurately distinguishing between legitimate and phishing web entities.

2.

D2: The results reflect a performance profile comparable to D1, characterized by a high volume of true positives (1006) and true negatives (978). The minimal occurrence of false positives (6) and false negatives (10) indicates that the framework maintains consistent classification Accuracy across both distinct datasets.

3.

D3: The proposed model demonstrates consistent reliability, yielding 5379 true negatives alongside 5931 true positives. While the observed false positives (217) and false negatives (202) represent a marginal increase compared to the results for D1 and D2, these values remain relatively minimal, further substantiating the robust performance of the framework.

4.

D4: This dataset shows the most substantial volume of correctly categorized instances, achieving 5898 true negatives alongside 11,346 true positives. Conversely, it also demonstrates the peak counts for false positives (220) and false negatives (266) across the entire experimental suite, indicating heightened complexity in class discrimination within this particular data distribution.

5.

D5: The approach demonstrates solid predictive capability, identifying 11,494 true negatives and 6472 true positives. While the counts for false positives (846) and false negatives (1204) exceed those observed for D1, D2, and D3, they remain lower than the error rates in D4. These results indicate that although the model maintains effective performance, there is a distinct opportunity to further refine the system to minimize misclassifications.

The stacking ensemble architecture exhibits superior classification Accuracy in identifying web phishing across all five experimental benchmarks. The framework consistently maintains elevated true positive and true negative rates, underscoring its proficiency in distinguishing between legitimate and fraudulent domains. Although the model demonstrates robust overall efficacy, performance fluctuations observed across the datasets suggest that specific data characteristics significantly influence Accuracy levels, necessitating deeper investigative analysis. Notably, the increased false positive and false negative rates recorded for D4 and D5 highlight critical opportunities for refinement, such as targeted feature engineering or hyperparameter optimization, to bolster discriminative capabilities within these specific environments. Ultimately, this evaluation offers a thorough synthesis of the experimental phase and the performance metrics attained by the stacked ensemble paradigm across the diverse datasets.

4.8. Ablation Study and Comparison with Baseline Methods

To evaluate the effectiveness of the proposed optimization strategy and better understand the contribution of each component, SEMG was compared with two simpler ensemble approaches: (i) majority voting using all base learners, and (ii) a heuristic Top-K selection based on individual model performance. These methods serve as baselines to assess whether the observed improvements originate from the ensemble structure itself or from the optimization process. The obtained results are reported in

Table 5. SEMG vs. voting and top-k voting (k = 5) metrics.

	D1			D2			D3			D4			D5
		Top-k			Top-k			Top-k			Top-k			Top-k
	Voting	Voting	SEMG	Voting	Voting	SEMG	Voting	Voting	SEMG	Voting	Voting	SEMG	Voting	Voting	SEMG
Accuracy	96.79	96.88	97.29	98.5	98.7	99.2	96.09	96.01	96.43	96.94	97.01	97.26	89.49	89.61	89.77
Precision	97.89	96.88	97.30	98.5	98.7	99.2	96.09	96.01	96.43	96.95	97.01	97.26	89.46	89.57	89.83
Recall	96.79	96.88	97.29	98.5	98.7	99.2	96.09	96.01	96.43	96.94	97.01	97.26	89.49	89.61	89.77
F1-score	96.79	96.87	97.28	98.5	98.7	99.2	96.09	96.01	96.43	96.94	97.01	97.26	89.48	89.58	89.79

.

The comparison results show that both majority voting and Top-K selection achieve strong and consistent performance across all datasets, confirming the effectiveness of ensemble aggregation. However, SEMG systematically provides the best results for all evaluation metrics. Although the performance gains are moderate, they are consistent across datasets, indicating a stable improvement.

Building on this comparison, a component-wise analysis was conducted to isolate the contribution of each part of the framework. Majority voting evaluates the effect of ensemble aggregation without any selection mechanism, while Top-K selection introduces a simple heuristic filtering without optimization. In contrast, SEMG combines both selection and optimization through the GA, which explores the space of possible model subsets and identifies combinations of complementary learners.

The results demonstrate that the improvement achieved by SEMG is not solely due to the voting mechanism, but is primarily driven by the optimization process. By selecting subsets of models that maximize the joint objectives, the GA enhances the robustness and consistency of the predictions. This confirms that SEMG acts as an optimization layer over the ensemble rather than a standalone predictive model, ensuring reliable performance across different datasets.

4.9. Wilcoxon Signed-Rank Test

Across the five datasets, SEMG consistently achieved higher values for Accuracy, Precision, Recall, and F1-score compared to all baseline models. A Wilcoxon signed-rank test was conducted using the five datasets as paired observations to compare SEMG against each baseline. Although SEMG outperformed all baselines in every instance, the p-values (0.0625) are slightly above the conventional $0.05$ significance threshold due to the small number of datasets. This result confirms that the improvements are consistent but not statistically significant with limited data.

It is important to note that SEMG is not a prediction algorithm on its own; it does not generate new predictions but rather combines the outputs of base learners through instance-wise voting. Its strength lies in its robustness: by leveraging the diverse predictions of multiple models, SEMG consistently ensures high performance and slightly improves classification outcomes across datasets, even when individual base learners vary in Accuracy or Precision. This demonstrates that the framework enhances stability and reliability rather than raw predictive power.

4.10. Optimization Evolution

The plots displayed in Figure 10 depict the Accuracy evolution over 300 iterations for each dataset (D1–D5). In all datasets, we observe a general trend of increasing Accuracy during the initial iterations, followed by a plateauing effect as the approach converges. Datasets D1, D2, and D4 demonstrate a gradual improvement in Accuracy over the first 100–150 iterations, suggesting a progressive optimization process. D1 and D4 show a step-like increase, indicating discrete improvements in Accuracy at specific iterations, possibly due to the approach identifying better solutions through exploration or exploitation. D2 exhibits a smoother, more continuous increase in Accuracy, suggesting a more consistent optimization trajectory. D3 and D5, on the other hand, show a rapid increase in Accuracy within the first few iterations, reaching a plateau relatively quickly. This indicates that the approach efficiently finds a near-optimal solution early on for these datasets. In all datasets, the Accuracy plateaus after reaching a certain point, suggesting that the approach has converged and further iterations do not yield significant improvements. The final Accuracy values reached vary across datasets, reflecting differences in their inherent complexities and the approach’s ability to optimize for them. D2 achieves the highest final Accuracy, while D5 has the lowest, suggesting that the approach performs best on D2 and faces more challenges with D5, but this is due to the low performances of the base learners. The convergence patterns and final Accuracy values provide insights into the approach’s efficiency and effectiveness in optimizing for different datasets. These plots are valuable for understanding the approach’s learning dynamics and determining the appropriate number of iterations for optimal performance on each dataset.

4.11. Comparison with the State-of-the-Art Approaches

To evaluate the efficacy of the proposed framework, it was compared against current state-of-the-art methodologies.

Table 6. Performancecomparison of SEMG to the state-of-the-art on D1.

Metric	SEMG	[31]	[4]	[8]	[27]
Accuracy	97.29	98.12	97.16	97.47	97.16
Precision	97.31	97.31	96.86	96.98	96.85
Recall	97.29	96.33	96.83	98.19	97.62
F1-score	97.28	95.89	97.49	97.58	—

,

Table 7. Performance comparison of SEMG to the state-of-the-art on D2.

Metric	SEMG	[27]	[14]	[8]	[5]	[4]
Accuracy	99.20	98.95	99.20	98.26	98.90	98.58
Precision	99.20	98.63	98.00	98.53	98.48	98.50
Recall	99.20	99.31	98.00	97.98	99.28	98.74
F1-score	99.20	—	98.00	98.25	98.88	98.57

,

Table 8. Performance comparison of SEMG to the state-of-the-art on D3.

Metric	SEMG	[5]	[4]	[41]	[3]
Accuracy	96.43	96.79	97.35	95.18	—
Precision	96.43	96.84	96.20	—	87.50
Recall	96.43	96.70	96.14	—	95.10
F1-score	96.43	96.77	96.17	95.42	91.10

,

Table 9. Performance comparison of SEMG to the state-of-the-art on D4.

Metric	SEMG	[5]	[28]	[42]	[27]
Accuracy	97.26	98.43	96.94	96.30	97.59
Precision	97.26	97.93	95.55	96.20	97.36
Recall	97.26	98.96	95.55	96.30	97.79
F1-score	97.26	98.44	—	96.30	—

and

Table 10. Performance comparison of SEMG to the state-of-the-art on D5.

Metric	SEMG	[27]
Accuracy	89.77	89.68
Precision	89.83	88.15
Recall	89.77	91.60
F1-score	89.79	—

summarize the comparison regarding the metrics across D1, D2, D3, D4 and D5, respectively. The results for these methods were retrieved directly from their respective original publications. While hardware disparities between our experimental environment and those used in prior works preclude a fair comparison of execution speeds, the use of identical benchmark datasets ensures a rigorous evaluation of predictive metrics. By comparing results achieved on the same data distributions, we provide a transparent assessment of the framework’s classification Accuracy and robustness relative to the current state-of-the-art.

5. Discussion

The critical examination of the literature detailed in Section 2 underscores the requirement for a framework utilizing ML architectures and multi-objective optimization heuristics to improve classification generalizability across heterogeneous URL-based datasets. This study introduced SEMG, a novel framework designed to mitigate this challenge. Consequently, the experimental phase investigates whether the proposed architecture can effectively synthesize SELs that produce high-quality metrics, demonstrating robust generalization across various webpage phishing scenarios.

A primary finding is the capacity of SEMG for the automated generation of an optimal SEL model tailored to each specific dataset. This autonomous adaptation to fluctuating dataset characteristics—such as dimensionality and scale—without human intervention highlights its significant generalization potential. Furthermore, SEMG is capable of augmenting specific performance metrics, occasionally exceeding the results achieved by state-of-the-art models.

The Pareto front (Figure 2) illustrates a high degree of correlation between Precision and Recall within the final population, a direct result of the domination-based fitness function. For the majority of datasets (D1–D4), a unique non-dominated solution emerged, signifying aligned objectives and the algorithm’s proficiency in identifying a distinct optimal equilibrium. Conversely, D5 yielded two non-dominated solutions, suggesting that its specific feature distributions diminish the correlation between Precision and Recall, thereby permitting multiple trade-offs. While this emphasizes how dataset-specific traits influence the Pareto front, it also indicates a potential constraint in the optimization process regarding the consistent capture of all optimal solutions across diverse data environments.

The empirical results illustrated in Figure 3, Figure 4, Figure 5, Figure 6 and Figure 7 show that SEMG consistently outperformed the individual base learners across all evaluated datasets. This improvement can be explained by the framework’s combination of optimization-based model selection and ensemble voting. The GA identifies a subset of complementary base learners that maximizes the optimization objectives, while their predictions are aggregated for each instance using a majority voting mechanism. The class receiving the highest number of votes is assigned to the instance, and in the case of a tie, the instance is conservatively classified as phishing to reduce the risk of false negatives in the cybersecurity context. By exploiting the diversity of base learners and reducing the impact of individual model errors, this strategy leads to more robust and consistent classification performance. These findings are further supported by the confusion matrices shown in Figure 9, which confirm the improved Precision and reliability of the proposed framework.

In comparison to individual base learners, SEMG successfully identified the optimal subset of predictors. The most effective learners were frequently selected (refer to Table 4), with boosting-based methods such as GB, HGB, and HGB+ being chosen repeatedly alongside ETs and KNN. Conversely, the temporal overhead required for hyperparameter optimization and training of SVM models was substantial, while their classification results remained substandard. The inadequate performance of SVM architectures with non-linear kernels in this research stems primarily from the high dimensionality, sparsity, and inherent noise of webpage phishing datasets, which diminish the utility of kernel-based similarity metrics. Furthermore, kernel SVMs exhibit poor scalability relative to increasing sample sizes, rendering training and parameter tuning computationally prohibitive and constraining the thorough exploration of the search space. Their susceptibility to weakly informative features additionally elevates the risk of overfitting.

Across the five datasets, ensemble-based methodologies such as GB, ET, HGB, and BAG consistently exhibited superior efficacy, frequently surpassing $96\%$ in Datasets D1, D2, and D4. This performance suggests that the collective decision-making inherent in these architectures effectively encapsulates the intricate patterns indicative of phishing sites. Conversely, Dataset D3 revealed a more pronounced disparity in model effectiveness, underscoring its unique characteristics that specific base learners, including Per and SGD, failed to adequately model. While Dataset D5 exhibited a general decline in performance, the persistent strength of ensemble techniques—complemented by SEMG’s consistently top-tier outcomes across all benchmarks—highlights the robustness and generalization capacity of ensemble learning for this rigorous classification task.

The progression of $fitness$ throughout the evolutionary search indicates that SEMG achieves peak performance at approximately 100 generations for datasets D3 and D4, while requiring additional iterations for D1, D2, and D5. This behavior is attributed to the inherent characteristics of the Genetic Algorithm (GA), which is frequently associated with a protracted convergence rate due to its stochastic and semi-random operators.

The comparison to the state-of-the-art methods (Table 6, Table 7, Table 8, Table 9 and Table 10) shows that SEMG surpasses the other methods [4,5,8,27] in all metrics on D2. In D1, SEMG surpasses Precision of previous approaches [4,8,27,31]; it also surpasses the Accuracy of methods [4,27], the Recall of [4,31], and F1-score of [31]. Regarding D3, our approach shows better or competitive performances compared to the methods in [3,4,41]. This conclusion remains the same for dataset D4, where SEMG performs well with metrics above 97%. This is better than the approaches in [28,42], but the method in [5] performs better. The comparison regarding D5 shows that SEMG successfully performs better than the approach in [27].

A primary limitation of this study is the utilization of only five URL-based datasets, which restricts the breadth of phishing patterns and may insufficiently represent the heterogeneity of real-world threats, potentially resulting in an overestimation of the model’s generalization capacity. While these datasets are not identical, their collective reliance on URL-specific attributes constrains the framework’s exposure to alternative fraudulent strategies. To bolster detection efficacy, future research should integrate more expansive datasets and multifaceted feature domains, such as HTML structural patterns, JavaScript execution behaviors, and visual page analytics. Furthermore, the inclusion of user interaction dynamics, real-time behavioral indicators, DL architectures for raw data processing, and hybrid or graph-based methodologies could significantly improve system robustness. Implementing continuous dataset synchronization and more resilient defenses against adversarial evasion remains essential for sustaining long-term effectiveness.

Additionally, although the present evaluation focuses on URL-based phishing datasets, the proposed SEMG framework is not restricted to this type of information. SEMG operates at the model-selection level and is therefore independent of the underlying feature representation used by base learners. Consequently, richer signals such as HTML structural features, JavaScript behavioral indicators, DOM analysis, or visual similarity descriptors extracted from webpage screenshots could be incorporated without modifying the optimization mechanism. These additional sources would simply extend the input features used by the learning models, while SEMG would continue to optimize the subset of base learners according to the chosen objectives. Investigating such multi-source feature integration constitutes a promising direction for future work.

The current version of the approach does not natively handle data of varying dimensionality. To address this limitation and improve the prediction of diverse webpage phishing attacks, we propose incorporating a feature engineering preprocessing step. This step will extract a fixed-length feature vector from the raw input data (e.g., URL lexical features, DOM structure metrics, and security certificate attributes). By mapping variable-length webpage structures to a consistent feature space, the model can process heterogeneous data without requiring architectural changes. While this abstraction simplifies the raw input, it ensures that the feature dimensionality remains independent of the original data size, allowing for scalable and uniform classification.

Although evaluated on offline datasets, the framework is architecturally suited for real-time deployment. The computationally heavy optimization occurs offline, ensuring that the online prediction phase remains low-latency and suitable for live URL classification. Its modular design facilitates adaptability, allowing for the periodic replacement of underperforming base learners with more sophisticated architectures to counter evolving phishing tactics. This approach provides a balance between high-performance ensemble selection and the rapid execution required for real-time security systems.

Cross-dataset validation is currently restricted by the heterogeneous and disjoint feature schema of the available benchmarks. Because models are feature-dependent, they cannot be directly applied across different datasets without a unified extraction process. While this study ensures robustness by evaluating SEMG across five distinct distributions, achieving true schema-agnostic interoperability through a standardized extraction layer is a primary objective for future research.

6. Conclusions

This research was designed to introduce a framework that generates optimal stacking ensemble learning models for webpage phishing detection. A principal finding to emerge from this study is that the framework successfully selected a unique SEL configuration for each dataset without manual intervention. These results support the premise that generative ensemble learning remains effective across diverse scenarios, even as data volume and complexity fluctuate. This work contributes to the burgeoning field of generative ensemble models by introducing a novel methodology grounded in multi-objective optimization heuristics.

The generalizability of these findings is subject to specific constraints. For instance, the Pareto front identifies a single optimal solution, and the total training duration is considerable for certain base learners due to the necessity of hyperparameter tuning. Notwithstanding these limitations, this study provides significant insights into the generalizability of ensemble architectures. This investigation has raised several questions warranting further research. Minimizing computational overhead, enhancing base learner performance prior to integration, and refining the GA mechanism could further bolster prediction quality and facilitate the application of this approach to broader domains.