Explainable AI for URL Threat Detection in Healthcare Cybersecurity: A Case Study Using LIME and SHAP

Automated filtering of malicious URLs is vital for safeguarding hospital networks, yet the opaque behaviour of high-performing machine-learning detectors can erode security teams' trust under strict data-protection regulations. We combine a Random-Forest URL classifier with two model-agnostic explainability tools-LIME and SHAP-to test whether interpretable rationales can be provided without sacrificing detection performance. Trained on 110 k links from the public PhishTank and OpenPhish repositories and evaluated on a held-out test set, the classifier achieves Accuracy 0.985, Recall 1.000, Precision 0.985, F1 0.992 and ROC-AUC 0.970. Explanations from both LIME and SHAP show that three lexical cues-special-character count, digit count and atypical URL length-account for > 80 % of malicious predictions. Although the datasets are generic, these cues align with NIST HICP "Network Security" recommendations, underscoring their relevance to hospital security playbooks. The study thus provides a proof-of-concept that high-recall URL threat detection can be paired with human-readable explanations, laying groundwork for future validation with healthcare cybersecurity professionals.