Documentation

URL components

A Uniform Resource Locator (URL) is designed to locate web pages. The diagram below outlines the structure of a common URL and its key components.

A phisher has complete control over the subdomain sections and can assign any value to them. The URL might also include a path and file elements that can be manipulated by the phisher as desired. The path is entirely under the phisher's control. In the rest of this article, we refer to these portions of the URL as FreeURL.

Machine Learning Techniques

Algorithm : Random Forest

The Random Forest algorithm can be utilized to enhance accuracy and mitigate overfitting in URL classification. The algorithm combines the outputs of multiple decision trees to categorize URLs. By using random subsets of features, each decision tree focuses on different combinations of URL features. The diverse set of decision trees creates a robust ensemble model that effectively analyzes and classifies URLs. A final decision is made through majority voting based on the predictions from each tree, resulting in more reliable and precise classifications compared to a single decision tree model.

Features selection method : Particle Swarm Optimization

The purpose of feature selection is to select a subset of relevant features from a large number of available features to achieve similar or even better classification performance than using all features. By eliminating/reducing irrelevant and redundant features, feature selection could reduce the number of features, shorten the training time, simplify the learned classifiers, and/or improve the classification performance.

Particle Swarm Optimization is a population based technique to address feature selection problems in this project due to better representation, capability of searching large spaces, being less expensive computationally, being easier to implement, and fewer parameters being required. PSO simulates social behavior such as birds flocking and fish schooling. In PSO, a population, also called a swarm, of candidate solutions are encoded as particles in the search space. PSO starts with the random initialisation of a population of particles. Particles move in the search space to search for the optimal solution by updating the position of each particle based on the experience of its own.

After performing feature selection using PSO, 19 features were selected, resulting in the highest accuracy of 96.12 percent. The following are the features used for the model.

Model Results

In this study, we developed a phishing URL detection model and evaluated its performance across key metrics, achieving highly promising results. The model's overall accuracy was 95.07%

Precision, Recall, and F1-Score

To further assess the model's reliability, we considered additional performance metrics:

• Precision: The model achieved a precision of 96.00%, meaning that of all the URLs flagged as phishing, 96% were actual phishing URLs. A high precision score is essential in this context, as it reduces false positives, ensuring that legitimate URLs are not misclassified as phishing.
• Recall: The recall was measured at 94.05%, indicating the model's ability to detect most phishing URLs correctly. High recall ensures that phishing attacks are not missed, which is critical for minimizing the risk of undetected security threats.
• F1-Score: The F1-score, which balances precision and recall, was 95.07%, demonstrating that the model maintains a strong balance between minimizing false positives and false negatives. This metric highlights the overall reliability of the model in a real-world application where both accuracy and coverage are important.

• Accuracy
  96.13%
• Precision
  96.28%
• Recall
  95.97%
• F1-Score
  96.13%

Information About Each Features

Feature Importance

The success of this model is largely due to its careful selection and weighting of relevant features. In phishing URL detection, the following features proved to be most influential: