In the age of digital communication, scams such as phishing continue to be a problem, necessitating the need for ever-more-advanced detection techniques to safeguard sensitive data. Examining several methods now in use, this review article groups them according to the application (email, web server, mail server, or browser-based). It explores the advantages and disadvantages of behavior-based, heuristic-based, machine learning (ML)-based, and signature-based techniques and offers a comparative evaluation of their efficacy. The essay delves deeper into the latest developments in phishing detection research, such as ML-powered social media exploration and real-time website analysis. The evaluation goes beyond just identifying detecting techniques; it also includes a data-driven analysis. In particular, random forest and support vector machines are ML algorithms that regularly produce results with high accuracy for detecting phishing attempts. Metrics like as recall, F1-score, and precision show how well these algorithms. Furthermore, specialised techniques such as heuristic-based and cantina-based approaches provide remarkable performance, underscoring the possibility of additional research in this field. Future research explores improved phishing detection through: better accuracy with ML, integrating new technologies, analyzing user behavior. A hybrid approach combining these techniques offers a stronger defense.

Phishing attacks remain a significant and evolving threat in the digital landscape, demanding continual advancements in detection methodologies. This paper emphasizes the importance of interpretable machine learning models to enhance transparency and trustworthiness in phishing detection systems. It begins with an overview of phishing attacks, their increasing sophistication, and the challenges faced by conventional detection techniques. A range of interpretable machine learning approaches, including rule-based models, decision trees, and additive models like Shapley additive explanations (SHAP), are surveyed. Their applicability in phishing detection is analyzed based on computational efficiency, prediction accuracy, and interpretability. The study also explores ways to integrate these methods into existing detection systems to enhance functionality and user experience. By providing insights into the decision-making processes of detection models, interpretable machine learning facilitates human supervision and intervention, strengthening overall system reliability. The paper concludes by outlining future research directions, such as improving the scalability, accuracy, and adaptability of interpretable models to detect emerging phishing techniques. Integrating these models with real-time threat intelligence and deep learning approaches could boost accuracy while preserving transparency. Additionally, user-centric explanations and human-in-the-loop systems may further enhance trust, usability, and resilience in phishing detection frameworks.

This study introduces a hybrid phishing detection framework that combines machine learning with heuristic rule-based techniques to provide accurate, scalable, and policy-compliant detection across a variety of phishing types. The proposed method uses diverse datasets, including URL patterns, email headers, and HTML content, organized in a layered manner, allowing flexible analysis even when some features are missing. Feature selection techniques, such as variance thresholding and Recursive Feature Elimination (RFE), are applied to improve learning efficiency and reduce noise. Several classifiers, including Random Forest (RF), XGBoost, Gradient Boosting (GB), and CatBoost, are trained on optimized features, and their outputs are combined using voting to boost overall reliability. The system also includes a rule-based engine aligned with India's national Email Policy, incorporating heuristic checks such as non-government domains, missing authentication (SPF/DKIM/DMARC), use of insecure protocols, foreign IPs, phishing URLs, and other threat indicators. Each rule is weighted and contributes to a composite suspicion score, which is explainable and policy-mapped. These heuristic signals are used both directly and as features for the machine learning models, allowing for layered, interpretable AI. The final phishing score balances the contribution of both heuristic and ML predictions and is compared against an optimized threshold to determine whether an input is phishing or safe. Experimental results on benchmark datasets demonstrate that heuristic-guided feature selection, combined with hybrid data integration, significantly improves performance, achieving an average accuracy exceeding 95% in real-world datasets. Individual models, including CatBoost and XGBoost, demonstrated outstanding performance, achieving training accuracies of up to 100% and testing accuracies of 96.7% and 96.4%, respectively, for URL datasets. For email header analysis, RF achieved the highest accuracy at 99.85%. The findings underscore the significance of feature engineering in developing scalable and reliable phishing detection systems.