EVALUATING AI-BASED TECHNIQUES FOR MALICIOUS DOMAIN DETECTION USING OPEN-SOURCE CYBERSECURITY DATASETS

Abstract

The rapid growth of internet-based services has increased reliance on domain name infrastructure and created new opportunities for phishing, spoofing, and malicious domain activity. This study evaluates artificial intelligence based techniques for malicious domain detection using an opensource phishing URL dataset containing 3,772 balanced samples and 89 engineered features. Logistic Regression, Random Forest, and XGBoost were trained and evaluated using an 80:20 stratified split, cross-validation, and metrics including accuracy, precision, recall, F1-score, and ROC-AUC. XGBoost achieved the strongest overall performance, with 96.29% accuracy, 98.14% phishing recall, and 0.994 ROC-AUC. SHAP analysis showed that reputation and structural URL features, including indexing status, page rank, domain age, and hyperlink patterns, were dominant contributors to model decisions. The findings indicate that ensemble learning combined with explainable AI can support accurate and transparent malicious domain detection.