A performance analysis of SHAP and LIME for interpreting boosting models in phishing URL detection

A comparative analysis was conducted on two Explainable Artificial Intelligence methods, SHAP and LIME, for interpreting boosting models used in phishing URL detection. The study utilized three boosting models, Gradient Boosting Machine, XGBoost, and LightGBM, which were trained and evaluated using a publicly available phishing URL dataset containing 11,054 instances and 30 URL-based features.

Model performance was assessed via 10-fold cross-validation. SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-Agnostic Explanations) were employed for model interpretation under identical experimental conditions. The results revealed that LightGBM exhibited the most robust predictive performance, achieving an accuracy of 97.60% and a phishing URL detection precision of 98.23%.

However, the explanation patterns generated by SHAP and LIME differed significantly, exhibiting variations in stability and scope. SHAP produced stable feature attributions that remained consistent at the global level, making it suitable for model inspection and validation purposes. On the other hand, LIME provided explanations at the individual instance level, offering insights into specific cases.