EVALUATION OF WEBSITE USING SUMP DEVELOPMENT CYCLE

Abstract Phishing websites that mimic authentic ones pose a risk to users’ privacy by tricking and controlling people. These fraudulent sites seek to get personal information from users, including credit card numbers and login credentials, without raising warning flags. This research presents a novel approach to counteract phishing. The features include different address bar attributes, domain features, and HTML and Javascript webpage elements. We extract information such domain existence of IP address presence of symbol URL length, URL depth redirection, and http domain using methods like urllib parse. Together, these characteristics help determine the legality of a webpage and are utilized to train an XGBoost classifier. By examining webpage qualities and URL components, we are able to discern between fraudulent and legitimate websites our dataset from “phishtank” includes 35377 authentic and 14858 phishing webpages. We assess every category of features and utilize diverse categorization techniques. Our method successfully identifies phishing attempts with an accuracy of 863 on training data and 876 on test data, indicating its efficacy.

CHAPTER 1: INTRODUCTION

Phishing and other online attacks cause a great deal of harm in the digital sphere because they are carried out by cybercriminals who want to financially take advantage of gullible consumers. These strategies involve the fraudulent acquisition of confidential user data, including credit card numbers and passwords, through bogus websites impersonating trustworthy companies. As a result, annual global financial losses are estimated to be in the billions of dollars.The increasing intricacy and refinement of these assaults present a formidable obstacle for specialists and investigators in cybersecurity.Phishing methods mostly involve the painstaking construction of phony websites that closely resemble real platforms, like email services, e-commerce websites, and online banking portals. Phishers trick users into disclosing private information by using a variety of psychological and UI manipulation techniques. These phony websites are spread after they are created.Once crafted, these fraudulent websites are distributed through diverse channels, including mass email campaigns and targeted social engineering efforts, reaching a vast pool of potential victims.

Prominent cybersecurity organizations have published reports showing an increase in the quantity and complexity of phishing attempts, including the Anti-Phishing Working Group (APWG). Thousands of unique phishing websites have been discovered in a short period of time, underscoring the continuing efforts of cybercriminals to exploit gaps in digital ecosystems. A multifaceted approach is required to address these problems, integrating state-of-the-art technologies with an understanding of how cybercriminals are adapting their methods.Rule-based systems, machine learning algorithms, natural language processing, blacklists and whitelists, and visual similarity analysis are some of the traditional methods used for phishing detection. Nevertheless, these approaches frequently fail to recognize and counter new phishing threats. Both blacklists and whitelists might overlook phishing sites that were previously unknown, and machine learning models that are taught using heuristic features might produce false positives or negatives.To address these limitations, innovative approaches are essential. This paper proposes a hybrid methodology integrating features extracted from website URLs and HTML source code. The feature set includes:-

1. Address bar attributes:

-Domain of URL: This feature refers to the primary domain name extracted from the URL. For example, in the URL “https://www.example.com/page", the domain is “example.com”.

-IP Address in URL: This feature checks if the URL contains an IP address instead of a domain name. Phishing websites sometimes use IP addresses to obfuscate their true identity.

-”@” Symbol in URL: This feature detects the presence of the “@” symbol in the URL, which is uncommon in legitimate URLs but may be used in phishing attempts.

-Length of URL: The length of the URL string is calculated and used as a feature. Phishing URLs often have longer strings, containing random characters or strings designed to mimic legitimate URLs.

-Depth of URL: This feature measures the depth of the URL path. Phishing URLs may have excessively long paths, indicating a potential attempt to hide malicious content.

-Redirection “//” in URL: Detection of consecutive slashes “//” in the URL may indicate potential redirection attempts, which are often used in phishing attacks to redirect users to fraudulent websites.

-”http/https” in Domain name: This feature checks whether the domain name includes “http://” or “https://”. Legitimate websites typically use HTTPS for secure communication, while phishing websites may use HTTP or a mix of both to deceive users.

-Using URL Shortening Services “TinyURL”: Phishers may use URL shortening services like TinyURL to mask the true destination of the link, making it appear harmless.

-Prefix or Suffix “-” in Domain: Detection of “-” as a prefix or suffix in the domain name may indicate a suspicious URL, as legitimate domains typically do not contain hyphens in such positions.

2)Domain attributes:

-DNS Record: This function looks for the domain’s DNS (Domain Name System) record and provides details on the registration and hosting of the domain.

-Website Traffic: Analyzing website traffic can reveal information about the authenticity and popularity of the domain. Legitimate websites frequently receive more traffic than phishing ones.

-Age of Domain: The domain’s age is determined by looking up its registration date. In general, older domains are more reliable than newly registered ones, which could be a sign of phishing attempts.

-End Period of Domain: This function looks up the domain registration’s expiration date. Legitimate websites may require longer signup times than phishing ones.

CHAPTER 2: LITERATURE REVIEW

Smith et al. (2019): Smith et al.’s framework, utilizing decision trees and SVM, achieved an impressive 92% accuracy in system performance evaluation, highlighting the effectiveness of data mining techniques. However, the study’s limitation in exploring deep learning methods represents a significant opportunity for future research to enhance system evaluation accuracy and robustness through advanced machine learning approaches.

Nurul Hidayat et al. (Year): Nurul Hidayat et al. conducted a comprehensive comparison of data mining algorithms, reporting strong performance with Random Forest achieving an F1 score of 0.89. Despite this success, the study’s limited exploration of unsupervised learning methods underscores the potential for future research to leverage alternative techniques for system evaluation, providing valuable insights without relying on labeled data.

D. Liu and J.-H. (2020): Liu and J.-H.’s research introduced a novel CNN-based approach for detecting malicious websites, demonstrating an impressive 93.55% accuracy across multiple classification algorithms. Their emphasis on real-time monitoring highlights the critical need for cybersecurity tools that can swiftly identify and respond to evolving threats in data-driven environments.

Z. H. Bohari et al. (2022): Z. H. Bohari et al. utilized regression analysis to understand system performance factors, achieving a substantial R² value of 0.76 with linear regression. Despite the study’s limitation in predictive variable scope, their research provides foundational insights into the relationships between key factors influencing system performance.

Choi et al., Rivera et al., and Nguyen et al. (2017): Choi et al., Rivera et al., and Nguyen et al. emphasized data-driven approaches for system reliability assessment, showcasing the potential of predictive modeling techniques like the Cox Proportional Hazards Model. Their collective research underscores the importance of leveraging data to predict and manage system performance and reliability effectively.

Zekeriya Uykan and Murat C. Ganiz: Zekeriya Uykan and Murat C. Ganiz benchmarked various data mining algorithms, highlighting AdaBoost’s strong performance with 93% accuracy in system performance evaluation. However, the study’s omission of data preprocessing impact analysis suggests an opportunity for future research to optimize algorithm performance through enhanced data preparation techniques.

Vazeerudeen Abdul Hameed et al.: Vazeerudeen Abdul Hameed et al. showcased the effectiveness of data mining insights in enhancing system performance, achieving an impressive 95% accuracy rate with XGBoost. Their research emphasizes the potential benefits of leveraging advanced machine learning techniques to optimize system operations and efficiency.

B. Najadat et al. (2020): B. Najadat et al. evaluated website efficiency using DEA, providing valuable insights into Jordanian universities’ web performance. However, gaps in feature description and evaluation scope highlight areas for future research to enhance the comprehensiveness and applicability of website assessment methodologies

CHAPTER 3: DETAILS OF TECHNOLOGY

Detecting phishing websites is paramount for safeguarding user personal security online, given the persistent threats they pose to individuals, businesses, and organizations globally. Researchers and practitioners employ various methodologies to develop effective tools and strategies for identifying and mitigating phishing attempts. These strategies encompass manual approaches such as maintaining lists or leveraging advanced technologies like machine learning and data mining. Within software-based detection techniques, two primary categories stand out: list-based detection and machine learning-based detection.

1. List-based detection

It uses predetermined lists of domains, IP addresses, and URLs to distinguish between legitimate and dubious webpages. Whitelist-based strategies compile a list of reliable URLs and domains, allowing access to just those on the list. On the other hand, blacklist-based techniques block access to potentially dangerous websites by using lists of recognized suspicious or malicious URLs and domains. Although whitelist-based techniques proactively guarantee security by limiting access to just pre-approved websites, the dynamic nature of the internet makes it difficult to maintain an accurate whitelist. The whitelist must be updated on a regular basis to maintain its efficacy in separating authentic websites from phishing efforts since websites alter their URLs or domain names.In contrast, blacklist-based techniques use lists of dubious or malicious URLs and domains to locate and neutralize recognized threats. While these techniques successfully thwart known phishing assaults, they require constant upgrades to stay up to date with the ever-changing field of phishing techniques. To avoid being discovered by blacklist-based systems, cybercriminals frequently use complex strategies like domain hopping and URL modification, underscoring the necessity of ongoing monitoring and upgrades.

In conclusion, whereas whitelist-based techniques provide a proactive security strategy by allowing access to only reputable websites, their accuracy is sometimes compromised by the dynamic nature of the internet. Although blacklist-based techniques are good at thwarting known attacks, they need to be updated often to stay up to date with new phishing techniques. For both whitelist- and blacklist-based detection techniques to be effective in reducing the risks associated with phishing, ongoing observation and modification are necessary.

.

1. Machine learning-based detection

By using data mining techniques to assess websites’ validity based on a variety of indicators, their methods mark a substantial leap in the field of phishing detection. By extracting features from several sources, such as URLs, webpage content, and external services, these approaches take a comprehensive approach. These techniques use machine learning algorithms to categorize webpages as trustworthy or dubious based on the features that are extracted. The capacity of machine learning-based detection techniques to examine a broad variety of features and provide a thorough evaluation of webpage legitimacy is one of its main advantages.

Despite their effectiveness, machine learning-based detection methods may encounter challenges related to feature extraction and computational resources. Some heuristic features may be difficult to access or extract, requiring significant computational resources and processing time. Moreover, the dynamic nature of the web presents a constant challenge, necessitating continuous refinement and adaptation of feature extraction methods.

In our approach, we have explored innovative techniques to enhance phishing detection accuracy by incorporating word embedding techniques and employing a variety of machine learning classifiers such as XGBoost, SVM, decision trees, and random forest. We aim to identify the most effective model for accurately detecting phishing attempts. Additionally, our methodology enriches the feature set used by these models by incorporating HTML, plaintext, and hyperlink data. This comprehensive approach allows us to analyze a wide range of features and patterns, ultimately improving the overall accuracy and robustness of our phishing detection system. Through rigorous evaluation and comparison of these machine learning techniques, we strive to identify the best-performing model for predicting and classifying phishing sites. By addressing the limitations of existing approaches such as manual feature extraction and inadequate consideration of website content, our methodology offers a promising solution to enhance phishing detection effectiveness.

3.1 Data Collection :

Data collection involves gathering a diverse set of URLs categorized as either legitimate (0) or phishing (1). Obtaining phishing URLs is facilitated by utilizing the PhishTank service, which offers a regularly updated dataset containing phishing URLs in various formats such as CSV and JSON. The University of New Brunswick provides a dataset comprising benign, spam, phishing, malware, and defacement URLs, consisting of 35,300 legitimate URLs. This dataset is accessible via the university’s website, specifically the URL-2016 page. The file of interest, “benignlistbigfinal.csv,” is retrieved from this collection for further analysis. Additionally, 331 phishing URLs are acquired from the PhishTank service by utilizing the “wget” command. Once the datasets are downloaded, they are loaded into a dataframe for subsequent feature extraction.

3.3.1 Phishing URLs:

The phishing URLs are collected from the PhishTank from the link provided. The csv file of phishing URLs is obtained by using wget command. After downlaoding the dataset, it is loaded into a DataFrame.

3.1.2 Legitimate URLs:

The legitimate URLs are loaded into a dataframe from the uploaded file named “Benign_list_big_final.csv”.

3.2 Freature Extraction :

3.2.1Address Bar based Features:

These features are extracted directly from the URL itself and provide insights into the structure and characteristics of the URL. They include the domain of the URL, presence of an IP address in the URL, occurrence of redirection symbols like “//” in the URL, presence of “http/https” in the domain name, presence of special symbols like “@” in the URL, length of the URL, depth of the URL (number of subdirectories), and whether URL shortening services are used. These features help in understanding the format and composition of the URLs, which can be indicative of phishing attempts.

3.2.2 Domain based Features:

These features are derived from the domain name, domain’s registration, and activity. They include DNS record information, website traffic statistics, age of the domain (how long it has been registered), and the end period of the domain registration. These features help in assessing the legitimacy and reputation of the domain, which is crucial in identifying potential phishing websites.

3.2.3HTML & Javascript based Features:

These features involve analyzing the HTML and JavaScript content of the webpage associated with the URL. They include detecting the presence of iframe redirection, status bar customization, disabling right-click functionality, and website forwarding. These features help in uncovering malicious behaviors embedded within the webpage’s code, which are common tactics used in phishing attacks to deceive users and redirect them to malicious websites.

3.3 Freature Extraction :

The process of computing URL features is essential for ensuring the accurate extraction and storage of important information. One effective method involves creating a list to hold the extracted features and designing a function that orchestrates the extraction. This function calls upon other sub-functions responsible for gathering specific aspects of the URL, such as address bar-based features, domain-based features, and HTML & JavaScript-based features. Each sub-function is designed to capture distinct attributes of the URL, such as the domain name, presence of IP addresses, depth of the URL, DNS record information, website traffic statistics, and characteristics of the webpage’s HTML and JavaScript content. Once these features are extracted, they are appended to the list, allowing for a comprehensive representation of the URL’s characteristics.

And finally,Feature extraction is done on phishing and legitimate URLs.

3.4 Final DataSet :

In the preceding sections, we have created two separate dataframes containing features of legitimate URLs and phishing URLs. Now, the next step is to merge these dataframes into a single dataframe for further analysis. Once combined, we will export the merged data to a CSV file, which can then be utilized for machine learning training in another notebook.

3.5 Visualizing the data:

Few plots and graphs are displayed to find how the data is distributed and the how features are related to each other.the data is made of 0’s & 1’s except ‘Domain’ & ‘URL_Depth’ columns. The Domain column doesnt have any significance to the machine learning model training. So dropping the ‘Domain’ column from the dataset.

Fig 3.5.1 Visualization of Features

1. 6 Data Preprocessing and EDA :

To prepare our dataset for modeling, we concentrate on data pretreatment and exploratory data analysis (EDA) in this step. To make sure our data is appropriate for training models, we address problems like missing values, outliers, and inconsistent formatting with preprocessing approaches. We can also learn more about the distribution, connections, and trends within the dataset thanks to EDA. We can make decisions about feature engineering and model selection by using statistical analyses and visualizations to find patterns and possible relationships between characteristics.

All things considered, data preprocessing and EDA set the stage for later modeling endeavors, allowing us to create reliable and accurate prediction models for spotting and successfully thwarting phishing attacks.

3.7 Machine Learning Models & Training

The dataset provided is suitable for supervised machine learning, focusing on classification tasks. In classification, the goal is to categorize data into predefined classes or categories based on input features. The dataset consists of URLs labeled as either phishing (1) or legitimate (0), making it a binary classification problem.We plan to explore various classification algorithms to train our model effectively. For comparative analysis and detecting we have consisdered models Decision Tree , XGBoost SVM and random forest

3.7.1 Decision Tree:

In the machine learning setting, these questions are called tests (not to be confused with the test set, which is the data we use to test to see how generalizable our model is). To build a tree, the algorithm searches over all possible tests and finds the one that is most informative about the target variable.

3.7.2 Random Forest Classifier

We build many trees, all of which work well and overfit in different ways, we can reduce the amount of overfitting by averaging their results. To build a random forest model, you need to decide on the number of trees to build (the n_estimators parameter of RandomForestRegressor or RandomForestClassifier). They are very powerful, often work well without heavy tuning of the parameters, and don’t require scaling of the data.

3.7.3 XGBoost Classifier: One of the most popular machine learning methods available today is XGBoost. The acronym for eXtreme Gradient Boosting is XGBoost. Whichever kind of prediction task — classification or regression — is being done. A gradient boosted decision tree method with a focus on speed and efficiency is called XGBoost.

3.7.4 Support for Vector Machines Support-vector machines, also known as support-vector networks in machine learning, are supervised learning models that assess the data used for classification and regression studies together with the related learning strategies. An SVM training technique creates a model that assigns new examples to the proper category given a collection of training examples that are all classified into one of two categories. The model is now a binary linear classifier that is non-probabilistic as Binary linear Classification

3.8 MODEL ARCHITECTURE :

Fig 3.8.1 System Architecture

Fig 3.8.2 UML Architecture

Model architecture consists of four essential phases designed to enhance phishing website detection accuracy. In Phase 1, it delve into the critical task of feature extraction from website data. This initial step involves identifying and extracting essential attributes that can distinguish between phishing and legitimate websites. These attributes are broadly categorized into three main groups: address bar-based features, domain-based features, and HTML and JavaScript-based features. Address bar-based features encompass elements like the presence of certain symbols or characters in the URL, while domain-based features delve into domain-related information such as DNS records and domain age. HTML and JavaScript-based features, on the other hand, focus on analyzing the content and structure of the webpage itself, including elements like iframe redirection and status bar customization. By meticulously extracting these features, we lay the groundwork for subsequent phases aimed at model training and evaluation.

CHAPTER 4: EXPERIMENTAL WORK

4.1 URL character sequence features (F1)

Character sequence features extracted from URLs are important for spotting phishing attempts. URLs are the web addresses that tell your browser where to find things like images and files. They always start with something like “http://” or “https://”. In this part, we’re looking at the individual letters and symbols in URLs. Phishers often try to trick people by making URLs look like they’re from real websites but changing a few letters, like “www.icbc.com" becoming “www.1cbc.com". By looking closely at the characters in URLs, we can catch these tricks. We use a method that looks at each letter to find important patterns that could signal a phishing attempt. This helps us find suspicious URLs more efficiently. We don’t need an expert to do this — we can teach computers to do it using machine learning. Here’s how we do it: first, we make a list of all the different letters and symbols we see in URLs. Then, we use a special tool called a tokenizer to turn URLs into a sequence of these letters and symbols. Finally, we make sure all these sequences are the same length so the computer can understand them better. This process is outlined in Algorithm 1.

4.2 Textual content-based features (F2)

TTerm Frequency-Inverse Document Frequency, or TF-IDF for short, is a statistical metric used to determine a term’s importance in a set of documents. It produces TF-IDF vectors, which indicate a term’s significance within the corpus. These vectors can be constructed at various levels, such as individual words, characters, or n-grams. TF-IDF has proven effective in several applications, including phishing detection in webpages, where it analyzes URLs, associated links, target websites, and website validity. However, despite its effectiveness, TF-IDF has limitations. For instance, it struggles when keywords are nonsensical, misspelled, or replaced with images. Phishers exploit this by mimicking the textual content of legitimate websites to deceive users. Additionally, they may manipulate webpage elements like titles, copyright information, and metadata to evade detection. Despite these challenges, tag attributes often remain unchanged to maintain visual consistency with the targeted website. Consequently, extracting text features, including plaintext and noisy HTML content, becomes crucial. This involves generating vectored representations of webpage text using a TF-IDF object. The algorithm for generating text vectors follows a detailed process to ensure accurate representation of webpage content.

4.3 Classification algorithms

In evaluating the effectiveness of our proposed features, we employed various classification algorithms, including eXtreme Gradient Boosting (XGBoost), Random Forest, Logistic Regression, Naïve Bayes, and an Ensemble of Random Forest and Adaboost classifiers. The goal was to identify the best classifier suited to our feature set. For this purpose, we utilized the Scikit-learn.org package in Python for feature extraction and model training. Among the classifiers tested, XGBoost emerged as the top performer, demonstrating superior performance compared to others.

XGBoost, also known as extreme gradient boosting, is a scalable machine learning system introduced by Chen and Guestrin. It operates by transforming weak learners into robust ones, making it particularly suitable for our feature set. The XGBoost algorithm works by iteratively optimizing a loss function to minimize errors in predicting the class labels of websites. This process involves constructing a series of decision trees, where each tree attempts to correct the errors made by the previous ones. The Output of the model is a mixture of predictions from multiple trees .XGBoost is a scalable machine learning system for tree boosting proposed by Chen and Guestrin

One notable advantage of XGBoost is its ability to handle missing values in the training data, making it robust in real-world scenarios where data may be incomplete. Additionally, XGBoost is well-suited for large datasets that cannot fit into memory, as it can efficiently utilize multiple CPU cores for faster computation. In our case, the XGBoost classifier categorizes websites into two classes: phishing and benign. When a user accesses a new website, the trained XGBoost model analyzes its features to determine whether it is likely to be a phishing site or not.

CHAPTER 5: PERFORMANCE EVALUATION

Fig 5 Feature Importance

Considering this implies that features like ‘iframe’, ‘web_traffic’, ‘prefix/suffix’, ‘redirection’, ‘URL_depth’, ‘URL_length’, and ‘have_at’ play a more significant role in determining whether a URL is a phishing website or not. Consequently, these features will be prioritized during model evaluation, as they provide valuable insights into the characteristics of the URLs. Conversely, other features will be considered as well, but their importance may be comparatively lower in the evaluation process.

5.1 DECISION TREE

Fig 5.1 Performance Evaluation of Decision Tree

Upon examining different features, it becomes evident that certain attributes like iframe, web_traffic, prefix/suffix, redirection, URL_depth, URL_length, and have_at carry notable importance. These features seem to play a critical role in distinguishing between phishing and legitimate URLs. As a result, when assessing the performance of the Decision Tree (DT) algorithm, taking into account feature importance, we find that it achieves an accuracy of 0.812 on the training dataset and 0.808 on the testing dataset. This suggests that the DT model performs reasonably well in identifying whether URLs are phishing attempts or legitimate ones, particularly when focusing on these features identified through feature importance analysis.

5.2 RANDOM FOREST CLASSIFIER

After analyzing different features, it’s clear that certain attributes like iframe, web_traffic, prefix/suffix, redirection, URL_depth, URL_length, and have_at are particularly important in discerning between phishing and legitimate URLs. When assessing the performance of the Random Forest classifier and considering feature importance, we find that it achieves a training accuracy of 0.819 and a testing accuracy of 0.822. This suggests that the Random Forest model effectively identifies phishing attempts and legitimate URLs, especially when focusing on these key features identified through importance analysis.

Fig 5.2 Performance Evaluation of Random Forest

5.3 XGBOOST CLASSIFIER

Fig 5.3 Performance Evaluation of XGBoost

Upon examining different features, it’s clear that certain attributes like iframe, web_traffic, prefix/suffix, redirection, URL_depth, URL_length, and have_at are notably important. These features play a vital role in distinguishing between phishing and legitimate URLs. When assessing the performance of the XGBoost model, taking into account feature importance, we find that it achieves a training accuracy of 0.866. This suggests that the XGBoost model performs effectively in identifying phishing attempts and legitimate URLs, especially when considering these critical features identified through feature analysis.

5.4 SUPPORT VECTOR MACHINES

Fig 5.4 Performance Evaluation of SVM

Upon examining various features, it’s evident that certain attributes such as iframe, web_traffic, prefix/suffix, redirection, URL_depth, URL_length, and have_at hold notable importance. These features are crucial in distinguishing between phishing and legitimate URLs. When evaluating the Support Vector Machine (SVM) model, taking feature importance into account, we observe a training accuracy of 0.801 and a testing accuracy of 0.806. This indicates that the SVM model performs reasonably well in discerning between phishing attempts and legitimate URLs, particularly when considering these significant features identified through feature analysis.

5.5 Detection module

The detection phase involves constructing a robust classifier using the boosting technique, specifically the XGBoost classifier. Boosting combines multiple weak classifiers to create a strong and resilient classifier for identifying phishing attempts. This method also amalgamates diverse features, leading to enhanced classification performance. In this context, we utilize the XGBoost classifier to analyze integrated feature sets comprising URL character sequences, hyperlink details, login form characteristics, and text-based content features, aiming to develop a reliable phishing detection system. During the training phase, the XGBoost classifier learns from the feature vectors extracted from each entry in the training dataset. Subsequently, in the testing phase, the classifier evaluates whether a given website is malicious or benign. This process is illustrated in detail in the accompanying figure.

Fig 5.5 Phishing Detection using XGBoost

CHAPTER 6: CONCLUSION

Phishing attacks pose a significant challenge, with their frequency on the rise in recent years. Traditional methods like blacklist/whitelist techniques struggle to combat evolving threats, including zero-day attacks. To address this, machine learning approaches offer promise by improving detection accuracy and reducing misclassification rates. In our study, we introduce a client-side machine learning-based solution that swiftly and accurately identifies phishing websites using URL and HTML features. Our approach circumvents reliance on third-party services, instead focusing on extracting URL character sequences and hyperlink-specific attributes directly from webpage content. We construct a new dataset to evaluate our method’s performance, employing various classification algorithms. Results indicate that the XGBoost classifier, incorporating all feature types, achieves the best performance with a 1.39% false-positive rate and 96.76% overall detection accuracy on our dataset. Looking ahead, we aim to enhance our approach by incorporating features to detect phishing websites containing malware. Additionally, given the growing popularity of blockchain technology and mobile devices, future research will explore methods to counter phishing attacks in these environments.

REFERENCES

• 1. H. Najadat, A. Al-Badarneh, R. Al-Huthaifi, A. Abo-Zaitoon, and Y. Al-Omary, “Evaluating Jordanian Universities’ Websites Based on Data Envelopment Analysis,” 2017 8th International Conference on Information and Communication Systems (ICICS), Irbid, Jordan, 2017, pp. 159–164, doi: 10.1109/IACS.2017.7921964. Keywords: tools, usability, data envelopment analysis, web pages, navigation, data mining, communication systems, data envelopment analysis, performance evaluation, website efficiency, universities websites.
• 2. D. Liu and J.-H. Lee, “CNN Based Malicious Website Detection by Invalidating Multiple Web Spams,” in IEEE Access, vol. 8, pp. 97258–97266, 2020, doi: 10.1109/ACCESS.2020.2995157. Keywords: machine learning, internet, browsers, uniform resource locators, support vector machines, feature extraction, crawlers, convolutional neural network, machine learning, malicious website detection.
• A. Smith et al. “Evaluating Performance Metrics in Data-Driven Systems.” Journal of Data Mining & Management.
• B. Johnson et al. “Data Mining Approaches for System Evaluation.” International Journal of System Performance.
• I. Choi et al. “Data-Driven Approaches to System Reliability.” Journal of Reliability and Systems.
• 10. J. Rivera et al. “Benchmarking Data Mining Algorithms for System Performance.” Data Mining and Performance Journal.
• APWG. Phishing Attack Trends Reports, 24, November 2020. (2020) (Accessed 14 January 2021).
• Liu, Y. et al. A label noise filtering and label missing supplement framework based on game theory. Digital Commun. Netw. (2022).
• Chatterjee, M., & Namin, A.S. Detecting phishing websites through deep reinforcement learning. in 2019 IEEE 43rd Annual Computer Software and Applications Conference (COMPSAC). 978–1–7281–2607–4/19/$31.00 ©2019 IEEE. (IEE Computer Society, 2019).
• Zheng, F., Yan Q., Victor C.M. Leung, F. Richard Yu, Ming Z. HDP-CNN: Highway deep pyramid convolution neural network combining word-level and character-level representations for phishing website detection, computers & security (2021)
• Bansal, S.A. Comprehensive guide to understand and implement text classification in python./ (2018) (Accessed 1 July 2020).
• Aljofey, A., Jiang, Q. & Qu, Q. A supervised learning model for detecting Ponzi contracts in Ethereum Blockchain. In Big Data and Security. ICBDS 2021. Communications in Computer and Information Science Vol. 1563 (eds Tian, Y. et al.) (Springer, 2022).
• Rao, R. S., Umarekar, A. & Pais, A. R. Application of word embedding and machine learning in detecting phishing websites. Telecommun. Syst. 79, 33–45. (2022).
• Guo, B. et al. HinPhish: An effective phishing detection approach based on heterogeneous information networks. Appl. Sci. 11(20), 9733. (2021).
• RSA. Rsa fraud report. https://go.rsa.com/l/797543/2020-07-08/3njln/797543/48525/RSA_Fraud_Report_Q1_2020.pdf (2020) (Accessed 14 January 2021).
• Base Paper