A performance analysis of SHAP and LIME for interpreting boosting models in phishing URL detection
- 1Department of Computer Science and Engineering, Parul Institute of Engineering and Technology, (Parul University)
- 2Department of Electronics and Communication Engineering, Parul Institute of Engineering and Technology, (Parul University)
- 3Department of Computer Science and Engineering, MM Engineering College, Maharishi Markandeshwar (Deemed to be University)
Abstract
Phishing websites remain a common and unresolved problem in web security. Despite continuous improvements in detection techniques, attackers continue to exploit URL-level characteristics and social engineering cues to deceive users. As a result, phishing detection systems are increasingly expected not only to achieve high accuracy but also to provide explanations that can be understood and trusted in real-world use. This work presents a comparative analysis of two Explainable Artificial Intelligence frameworks, SHAP and LIME, for interpreting gradient boosting models applied to phishing URL detection. Three boosting models, Gradient Boosting Machine, XGBoost, and LightGBM were trained and evaluated. A publicly available phishing URL dataset consisting of 11,054 instances and 30 URL-based features was used. Model performance was evaluated through 10-fold cross-validation. Model interpretability was analyzed under the same experimental conditions using both explanation techniques. LightGBM showed the strongest predictive performance with an accuracy of 97.60% and a phishing URL detection precision of 98.23%. The explanation patterns produced by SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) differed in both stability and scope. SHAP produced stable feature attributions that were consistent at the global level and useful for model inspection and validation where LIME provided explanations at the individual instance level.
Related
- Interpreting antiretroviral therapy loss to follow-up predictive models using LIME and SHAP
- Interpreting the 2025 Impact Factor of Neurointervention in the Context of 3 Years of Citation Performance
- Bridging trust and performance in intelligent systems: Hybrid explainable AI approaches for interpreting large language models
- Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting
- Hybrid rank fusion of a group-token transformer with gradient boosting improves detection of evasive and novel-family malware
BibTeX
@article{panthi2026performance,
title = {{A performance analysis of SHAP and LIME for interpreting boosting models in phishing URL detection}},
author = {Sabin Panthi and Mukesh Patidar and Khyati Zalawadia and Daxa Vekariya and Vipul Vekariya},
journal = {Scientific Reports},
year = {2026},
month = aug,
doi = {10.1038/s41598-026-66800-x},
url = {https://doi.org/10.1038/s41598-026-66800-x},
note = {CC BY},
}
RIS
TY - JOUR
TI - A performance analysis of SHAP and LIME for interpreting boosting models in phishing URL detection
AU - Sabin Panthi
AU - Mukesh Patidar
AU - Khyati Zalawadia
AU - Daxa Vekariya
AU - Vipul Vekariya
PY - 2026
DA - 2026/08/01
JO - Scientific Reports
DO - 10.1038/s41598-026-66800-x
UR - https://doi.org/10.1038/s41598-026-66800-x
AB - Phishing websites remain a common and unresolved problem in web security. Despite continuous improvements in detection techniques, attackers continue to exploit URL-level characteristics and social engineering cues to deceive users. As a result, phishing detection systems are increasingly expected not only to achieve high accuracy but also to provide explanations that can be understood and trusted in real-world use. This work presents a comparative analysis of two Explainable Artificial Intelligence frameworks, SHAP and LIME, for interpreting gradient boosting models applied to phishing URL detection. Three boosting models, Gradient Boosting Machine, XGBoost, and LightGBM were trained and evaluated. A publicly available phishing URL dataset consisting of 11,054 instances and 30 URL-based features was used. Model performance was evaluated through 10-fold cross-validation. Model interpretability was analyzed under the same experimental conditions using both explanation techniques. LightGBM showed the strongest predictive performance with an accuracy of 97.60% and a phishing URL detection precision of 98.23%. The explanation patterns produced by SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) differed in both stability and scope. SHAP produced stable feature attributions that were consistent at the global level and useful for model inspection and validation where LIME provided explanations at the individual instance level.
SN - 2045-2322
ER -