Performance Analysis of Random Forest, Decision Tree, and Naive Bayes for Phishing Link Detection Based on URL Features

Abstract

Phishing attacks through fake links remain one of the most common cybersecurity threats and can lead to data breaches for computer network users. Manual detection is often ineffective because phishing methods continue to evolve, with link patterns that closely resemble legitimate domains. This experiment aims to analyze the performance of three classification algorithms—Random Forest, Decision Tree, and Naive Bayes—in detecting phishing links based on basic URL features. The experiment is expected to assist in the automatic recognition of phishing URLs based on link characteristics analyzed using machine learning methods. The process involves collecting a dataset containing both phishing and legitimate links, followed by feature extraction such as URL length, hostname length, number of specific symbols, detection of IP addresses in the domain, use of URL shortening services, and prefix-suffix patterns in the hostname. The dataset is divided into training and testing data with an 80:20 ratio. The models are trained using the three algorithms and tested to compare their accuracy, precision , recall, and F1-score. The testing results show that the Random Forest algorithm achieved the highest accuracy of 80.75%, with balanced precision and recall. Meanwhile, the Decision Tree achieved an accuracy of 77.73%, and Naive Bayes only reached 68.15%. These findings indicate that Random Forest is the most suitable for detecting phishing links based on simple URL feature analysis. Therefore, this model can be applied as an early detection system to minimize phishing attack risks in various environments.