In the article is presented the problem of classifying domains that may be phishing by using parameters and information extracted from sample pages. Presented tests are using various ML classifications models which we used from open libraries in selected programming language. Presented methods are implemented in simple way just to test selected models and compare them in standard metrics. To my tests i have selected neural networks, decision tree, svm, logistic regression and random forest. I have tested their efectiveness to select the best option for phishing.
important in the classification of phishing. An anchor is an element defined by the <a> tag. This feature is treated exactly as “Request URL”. However, for this feature we examine: 1. If the <a> tags and the website have diferent domain names. This is similar to request URL feature. 2. If the anchor does not link to any webpage, e.g.: a) <a href=“#”> b) <a href=“#content”> c) <a href=“#skip”> d) <a href=“JavaScript::void(0)”>
% of URL Of Anchor <31% → Legitimate % of URL Of Anchor ≥ 31% And ⩽ 67% → Suspicious Otherwise→ Phishing
Given that our investigation covers all angles likely to be used in the webpage source code, we find that it is common for legitimate websites to use <Meta> tags to ofer metadata about the HTML document; <Script> tags to create a client side script; and <Link> tags to retrieve other web resources.
The number of links pointing to the webpage indicates its legitimacy level, even if some links are of the same domain. In our datasets and due to its short life span, we find that 98% of phishing dataset items have no links pointing to them. On the other hand, legitimate websites have at least 2 external links pointing to them. Of Link Pointing to The Webpage = 0 → Phishing Of Link Pointing to The Webpage > 0 and <= 2 →Suspicious Otherwise → Legitimate
In this work some selected models were tested. Presented results are from open libraries that were available for student tests in online services. Data for the experiments were collected from https://archive.ics.uci.edu/ml/datasets.php.
Logistic regression developing the concept of a perThe dash symbol is rarely used in legitimate URLs. ceptron using a nonlinear activation function and Phishers tend to add prefixes or sufixes separated by updating the weights with the logistic regression (-) to the domain name so that users feel that they cost function,. In experiments i have used model are dealing with a legitimate webpage. For example from https://machinelearningmastery.com/logistichttp://www.Confirme-paypal.com. regressionfor- machine-learning/. This model can be extended with regularization to prevent too high Rule: variance. Using the sigmoid activation function, model Domain Name Part Includes (-) Symbol → Phishing returns the probability of class, in our case we use the Otherwise → Legitimate tanh activation function because it returns values from -1 to 1 and this is exactly how it is presented in our dataset.
This feature measures the popularity of the website by determining the number of visitors and the number of pages they visit. However, since phishing websites live for a short period of time, they may not be recognized by the Alexa database. Furthermore, if the domain has no trafic or is not recognized by the Alexa database, it is classified as “Phishing”. Otherwise, it is classified as “Suspicious”.
Website Rank<100,000 → Legitimate Website Rank>100,000 →Suspicious Otherwise → Phish 4.2. SVM SVM is very similar to logistic regression, but it uses a diferent method of determining the decision boundary, it consists in finding such a boundary whose distance to, samples of diferent classes, is as large as possible. Applied model is from https://paperswithcode. com/method/svm. This algorithm also has the ability to correct variations with the help of the C parameter (expanded regularization) as well as solving problems with classes, linearly non-separable with the help of kernel functions, by increasing the dimensions and finding a hyperplane.
The next classifier is the decision tree [ 13], its activity is about creating a decision boundary by asking questions 45–50
about the data, answering them assigns the data to the next branches of the tree (there may be a lot of them, but in practice, it is usually divided into two sub-trees). In theory, such a tree can distribute data until there is only one class in each leaf, which means that the classifier will be over-trained and will not cope with the new data to prevent such a high variance when pruning the tree at a given height. In our case, the tree will work great because the features in our data set are binary ages and represent answers to the questions about domain metadata. The model of this section is from https://www.geeksforgeeks. org/decision-tree-implementation-python/.
Random forest is the use of many decision trees and averaging their results, thanks to this solution we can use very tall trees and thus with a large variance (too high accuracy), because after averaging with other trees it ceases to be a problem and the model is eficient and accurate
The multi-layer neural network, a model of a neural net- Our own implementation of logistic regression obtained work with a layer of input neurons with an amount equal a decent result of 0.9, while the error matrix shows that to the number of features of our data, layers of neurons the model has a tendency to falsely classify websites as which in our case is 50 and output neurons with the phishing: Accuracy: 0.9, Precision: 0.87, Recall: 0.974, F1: number of our classes 0.919.
The SVM model with complementary variable and regularization be scored very high: Accuracy: 0.97, Precision: 5. Accuracy measure parameter 0.97, Recall: 0.99, F1: 0.98.
Tree decision tree obtained very good results at a depth After creating all classifications, it turns out that all mod- of about 15, increasing by higher values will not improve els have proven themselves. However, they had diferent much, and reaching very high values caused that the operating times and unfortunately for some real-time accuracy was decreasing - it resulted from the previously learning is not possible. But, for example, thanks to a de- discussed too large variance: Accuracy: 0.964, Precision: cision tree, we can visualize the decision-making process 0.966, Recall: 0.969, F1: 0.968. and check based on the features it is made. Presentation of an example tree with a depth of 3 so
Formulas for determining parameters for model that it is relatively clear, such a tree also achieves a satisevaluation: factory result of about 93
The Random Forest, achieves practically the same result as properly trimmed random tree: Accuracy: 0.965, Precision: 0.966, Recall: 0.969, F1: 0.968.
The multi-layer neural network obtained a very high result as one might expect: Accuracy: 0.975, Precision: 0.971, Recall: 0.984, F1: 0.977.
TP - true positive (the phishing sample is classiifed as phishing) FN - false negative (the phishing sample is classified as non-phishing) FP - false positive (the non-phishing sample is classified as phishing) TN - true negative (the non-phishing sample is classified as non-phishing) 7. Conclusion = =
+
+
(
Most classifiers work well in predicting whether a given domain is a phishing attack, the efectiveness of prediction is at a very, level, and thanks to algorithms such as the decision tree, we are able to extract from the model very similar results, making the choice appropriate to the features that are most important to recognize this our needs should be based on the assessment of eficiency, type of attack, thanks to which you can defend yourself lfexibility for learning with new data and transparency more efectively . And the learned model can be used of operation. in user protection programs. As the models obtained