{"id":"https://openalex.org/W7128925885","doi":"https://doi.org/10.3390/fi18020101","title":"A Temporally Dynamic Feature-Extraction Framework for Phishing Detection with LIME and SHAP Explanations","display_name":"A Temporally Dynamic Feature-Extraction Framework for Phishing Detection with LIME and SHAP Explanations","publication_year":2026,"publication_date":"2026-02-14","ids":{"openalex":"https://openalex.org/W7128925885","doi":"https://doi.org/10.3390/fi18020101"},"language":"en","primary_location":{"id":"doi:10.3390/fi18020101","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18020101","pdf_url":"https://www.mdpi.com/1999-5903/18/2/101/pdf?version=1771059205","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/18/2/101/pdf?version=1771059205","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126025353","display_name":"Chris Mayo","orcid":null},"institutions":[{"id":"https://openalex.org/I178535277","display_name":"University of the West of England","ror":"https://ror.org/02nwg5t34","country_code":"GB","type":"education","lineage":["https://openalex.org/I178535277"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Chris Mayo","raw_affiliation_strings":["School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK"],"raw_orcid":"https://orcid.org/0009-0006-2630-045X","affiliations":[{"raw_affiliation_string":"School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK","institution_ids":["https://openalex.org/I178535277"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123883068","display_name":"Michael Tchuindjang","orcid":null},"institutions":[{"id":"https://openalex.org/I178535277","display_name":"University of the West of England","ror":"https://ror.org/02nwg5t34","country_code":"GB","type":"education","lineage":["https://openalex.org/I178535277"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Michael Tchuindjang","raw_affiliation_strings":["School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK"],"raw_orcid":"https://orcid.org/0009-0008-7703-9911","affiliations":[{"raw_affiliation_string":"School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK","institution_ids":["https://openalex.org/I178535277"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126001567","display_name":"Sarfraz Brohi","orcid":null},"institutions":[{"id":"https://openalex.org/I178535277","display_name":"University of the West of England","ror":"https://ror.org/02nwg5t34","country_code":"GB","type":"education","lineage":["https://openalex.org/I178535277"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Sarfraz Brohi","raw_affiliation_strings":["School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK"],"raw_orcid":"https://orcid.org/0000-0003-3463-0484","affiliations":[{"raw_affiliation_string":"School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK","institution_ids":["https://openalex.org/I178535277"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054622986","display_name":"Nikolaos Ersotelos","orcid":"https://orcid.org/0000-0001-7699-9998"},"institutions":[{"id":"https://openalex.org/I178535277","display_name":"University of the West of England","ror":"https://ror.org/02nwg5t34","country_code":"GB","type":"education","lineage":["https://openalex.org/I178535277"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Nikolaos Ersotelos","raw_affiliation_strings":["School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK"],"raw_orcid":"https://orcid.org/0000-0001-7699-9998","affiliations":[{"raw_affiliation_string":"School of Computing and Creative Technologies, University of the West of England, Bristol BS16 1QY, UK","institution_ids":["https://openalex.org/I178535277"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5126001567"],"corresponding_institution_ids":["https://openalex.org/I178535277"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1782},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1782},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.11947193,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"18","issue":"2","first_page":"101","last_page":"101"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9340999722480774,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9340999722480774,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.011900000274181366,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.00839999970048666,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.6474999785423279},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.6061000227928162},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.5292999744415283},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5256999731063843},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.4878999888896942},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.4645000100135803},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.4027000069618225},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.38920000195503235},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.37389999628067017}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.90420001745224},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.6474999785423279},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.6061000227928162},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5579000115394592},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.546999990940094},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5292999744415283},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5256999731063843},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.4878999888896942},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4645000100135803},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.4027000069618225},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.38920000195503235},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.37389999628067017},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.36730000376701355},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.364300012588501},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.34619998931884766},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3407999873161316},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.32910001277923584},{"id":"https://openalex.org/C2778924833","wikidata":"https://www.wikidata.org/wiki/Q7064603","display_name":"Novelty detection","level":3,"score":0.3206000030040741},{"id":"https://openalex.org/C2778738651","wikidata":"https://www.wikidata.org/wiki/Q16546687","display_name":"Novelty","level":2,"score":0.30660000443458557},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3003000020980835},{"id":"https://openalex.org/C45942800","wikidata":"https://www.wikidata.org/wiki/Q245652","display_name":"Ensemble learning","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.28299999237060547},{"id":"https://openalex.org/C2779391423","wikidata":"https://www.wikidata.org/wiki/Q17009728","display_name":"Dynamic pricing","level":2,"score":0.28299999237060547},{"id":"https://openalex.org/C2777601683","wikidata":"https://www.wikidata.org/wiki/Q6499736","display_name":"Vocabulary","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C172195944","wikidata":"https://www.wikidata.org/wiki/Q541265","display_name":"Ubiquitous computing","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2687000036239624},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.25999999046325684},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.25690001249313354}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/fi18020101","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18020101","pdf_url":"https://www.mdpi.com/1999-5903/18/2/101/pdf?version=1771059205","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:08452389c2bc43c0b284d08a4e1187f5","is_oa":false,"landing_page_url":"https://doaj.org/article/08452389c2bc43c0b284d08a4e1187f5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 18, Iss 2, p 101 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/fi18020101","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18020101","pdf_url":"https://www.mdpi.com/1999-5903/18/2/101/pdf?version=1771059205","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5291611552238464,"display_name":"Quality Education","id":"https://metadata.un.org/sdg/4"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7128925885.pdf","grobid_xml":"https://content.openalex.org/works/W7128925885.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Phishing":[0],"remains":[1],"one":[2],"of":[3,82,124,200,219],"the":[4,76,196,214],"most":[5],"pervasive":[6],"social":[7],"engineering":[8],"threats,":[9],"exploiting":[10],"human":[11],"vulnerabilities":[12],"and":[13,40,44,72,104,114,127,134,145,158,198,209,216],"continuously":[14],"evolving":[15,38],"to":[16,37,75,111,136],"bypass":[17],"static":[18],"detection":[19,60,179,202,221],"mechanisms.":[20],"Existing":[21],"machine":[22],"learning":[23,193,211],"models":[24,149],"achieve":[25],"high":[26,178],"accuracy":[27,157],"but":[28],"often":[29],"act":[30],"as":[31],"opaque":[32],"systems":[33,222],"that":[34,61,92,187,205],"lack":[35],"robustness":[36],"tactics":[39],"explainability,":[41],"limiting":[42],"trust":[43],"real-world":[45],"deployment.":[46],"In":[47],"this":[48,83],"research,":[49],"we":[50],"propose":[51],"a":[52,87,94,100,106],"dynamic":[53,89,130,188],"Explainable":[54],"AI":[55],"(XAI)":[56],"approach":[57],"for":[58],"phishing":[59,126,201,220],"integrates":[62],"temporally":[63,88,206],"aware":[64],"feature":[65,90],"extraction":[66],"with":[67,153,174,191],"dual":[68],"interpretability":[69],"through":[70],"LIME":[71],"SHAP":[73],"applied":[74],"resulting":[77],"window-level":[78],"features.":[79],"The":[80],"novelty":[81],"research":[84,163],"lies":[85],"in":[86],"framework":[91],"simulates":[93],"plausible":[95],"email":[96,118],"reading":[97],"progression":[98],"using":[99],"heuristic":[101],"temporal":[102,115,172,189],"model":[103],"employs":[105],"sliding":[107],"window":[108],"aggregation":[109],"method":[110],"capture":[112],"behavioural":[113],"patterns":[116],"within":[117],"content.":[119],"Using":[120],"an":[121,165],"aggregated":[122],"dataset":[123],"82,500":[125],"legitimate":[128],"emails,":[129],"features":[131,173,208],"were":[132],"extracted":[133],"used":[135],"train":[137],"four":[138],"classifiers:":[139],"Random":[140,159],"Forest,":[141],"XGBoost,":[142],"Multi-Layer":[143],"Perceptron,":[144],"Logistic":[146],"Regression.":[147],"Ensemble":[148],"demonstrated":[150],"strong":[151],"performance":[152,180],"XGBoost":[154],"achieving":[155,177],"94%":[156],"Forest":[160],"93%.":[161],"This":[162],"addresses":[164],"important":[166],"gap":[167],"by":[168],"combining":[169],"dynamically":[170],"constructed":[171],"transparent":[175],"explanations,":[176],"while":[181],"preserving":[182],"interpretability.":[183],"These":[184],"findings":[185],"demonstrate":[186],"modelling":[190],"explainable":[192,210],"can":[194,212],"enhance":[195,213],"trustworthiness":[197,215],"practicality":[199],"systems,":[203],"highlighting":[204],"structured":[207],"practical":[217],"deployability":[218],"without":[223],"incurring":[224],"excessive":[225],"computational":[226],"overhead.":[227]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-02-15T00:00:00"}