Analysis of feature selection methods and learning algorithms for phishing websites detection based on URL

Phishing attacks are attacks in which phishers deceive internet users by making a fake website look like a legitimate one. Phishing attacks are especially used to capture financially sensitive information, hence pose a critical threat to users and the losses from phishing attacks continue to increase. When the studies and the gathered statistics are evaluated in general, phishing attacks continue to be one of the critical cyber security issues that need to be tackled both globally and throughout Turkey. Before starting the studies on the blocking of phishing sites, the distinctive and common features of these sites should be determined in order to increase success rate of the detection. In this study, URL content, which is one of the most distinctive detectable features of phishing sites, is emphasized. For this purpose, it is aimed to propose a classifier workflow model with a high success rate, depending on the performance metrics accepted in the literature. Two different models were used in this study to detect URL addresses used for phishing purposes. In the first model of the study, the performance of some special feature selection and classification algorithms on the dataset created for the detection of the phishing attack websites was analyzed. The main purpose of the research is to maximize the fake website detection accuracy by finding the best compatibility between different classification algorithms and different feature selection methods. In this study, four types of feature selection methods and five types of classification algorithms were studied, namely CFS (Correlation-based Feature Selection) subset based, Consistency subset based, Gain Ratio attribute based, Relief-F attribute based feature selection methods and Naïve Bayes, SMO (Sequential Minimal Optimization), CART (Classification and Regression Tree), J48 (Decision Tree) and Random Forest classification algorithms. These algorithms were analyzed using WEKA software. The Random Forest algorithm showed the best performance in all feature selection methods. In addition, the J48 algorithm stood out as the second-best classification algorithm and the CART algorithm as the third-best classification algorithm. In the other model of the study, the use of feedforward deep neural networks was preferred as a deep learning model for detecting phishing sites. Feedforward deep neural networks are basically based on the infrastructure of multilayer neurons. In order to investigate the effect of layers and nodes on the success of this model, 6 different experimental architectures were prepared. In total, these 6 deep learning models with different architectures were trained with the phishing dataset and the most optimum solution was determined. In this study, a multidimensional phishing detection approach based on a rapid detection method using deep learning is proposed. As a result of tests on a dataset containing phishing and legitimate URLs, an accuracy rate of 99.46% was obtained. Considering the studies in the literature, it is proven that the use of a deep learning model is an appropriate approach to detect phishing URL addresses.