Employing cluster-based class decomposition approach to detect phishing websites using machine learning classifiers

Abstract

Phishing is an attack by cybercriminals to obtain sensitive information such as account IDs, usernames, and passwords through the use of the anonymous structure of the Internet. Although software companies are launching new anti-phishing tools that use blacklists, heuristics, visual methods, and machine learning-based methods, these products cannot prevent all phishing attacks. This research offers an opportunity to increase accuracy in the detection of phishing sites. This study develops a model using machine learning algorithms, specifically the decision tree and the random forest, due to their outperforming the rest of the classifiers and being accredited by researchers in this field to achieve the highest accuracy. The study is based on two phases: the first phase is to measure the accuracy of classifiers on the dataset in the usual way before and after feature selection. The second phase uses the class decomposition approach and measures the accuracy of classifiers in the dataset before feature selection and after feature selection to detect phishing sites. The class decomposition approach is a technique to improve the performance of classifiers by distributing each class into clusters and renaming the examples of each cluster with a new class. This provides a specific metric that more accurately predicts the level of phishing. Testing on a dataset containing 11,055 instances, 4,898 phishing, and 6,157 legitimate, each instance has 30 features. It achieved the highest accuracy in the first phase through the random forest algorithm by 96.9% before feature selection, and after feature selection, it was by 97.1%. In the second phase, the highest accuracy of both the decision tree and random forest classifiers was achieved by 100% with the two and four classes after feature selection. While before feature selection, the random forest algorithm achieved 100% with only the two classes.