<![CDATA[URLs are common indicators in smishing messages, yet their treatment during text preprocessing can alter the information available to a classifier. Existing studies often use URLs as features or additional security evidence, while the effect of retaining, removing, or abstracting URLs within the same text-classification pipeline remains less clearly isolated. Objective: This study evaluates how three URL preprocessing strategies affect three-class SMS classification and smishing recognition. Methods: A public SMS phishing dataset containing 5,971 messages was audited for label inconsistencies and duplicates, resulting in 5,797 messages classified as ham, spam, or smishing. URLs were processed under three scenarios: retained in their original form, removed, or replaced with urltoken. All scenarios used identical word-level TF-IDF features, Linear SVM parameters, and five-fold group-aware cross-validation. Macro-F1 was the primary metric, complemented by class-specific smishing measures, URL-bearing subset analysis, prediction-transition analysis, and exact McNemar tests. Results: URL abstraction achieved the highest overall Macro-F1 of 0.9007, while URL retention produced the highest smishing F1 of 0.9082. Among 206 URL-bearing messages, URL retention achieved the highest Macro-F1 of 0.7422 and smishing F1 of 0.8466. Removing URLs reduced smishing recall from 0.8421 to 0.7684 and increased smishing-to-ham errors. Pairwise differences in classification correctness were not statistically significant. Conclusions: URL preprocessing has limited effect on aggregate performance but more clearly influences smishing recognition among messages containing URLs. Complete URL removal discards useful link-related information, whereas URL abstraction preserves link presence and raw retention preserves additional lexical cues. URL handling should therefore be treated as an explicit experimental design choice rather than a routine cleaning step.]]>
Copyrights © 2026
