HinPhish: An Effective Phishing Detection Approach Based on Heterogeneous Information Networks

Round 1

Reviewer 1 Report

I had the pleasure of reading an extremely comprehensive explanation of the new approach to discovering phishing domain names. The authors wrote a well-structured paper, starting with an informative introduction followed by a detailed review of existing techniques. Their own method is well explained, and tests and comparisons have been made on huge data sets. I especially encourage the "cleaning" of the database and comparing the results with the original (unprocessed) database.

My comments are minor:

Definitions of TP, FP, and other statistical measures are probably superfluous, but it is good to keep them, for the sake of completeness.

It is too colloquial to write "and so on" in the "… method of classification, regression and so on". It would be better to use a more diplomatic phrase as "and similarly processed".

Figure 8 could be more convincing if the i-axis scale is changed. Try running i-axes of 0.4 (instead of 0.0) or logarithmic scaling.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

An interesting approach to detect / identify phishing websites. I have only some minor remarks.

Page 9 Table 1: Below the table there is a text in italics. Is it part of the table? If yes, I suggest it to be typeset in a smaller font type, and not in italics.

Line 336: the discussion of parameter "alpha" says that it has been chosen to be 0.6 in the experiments. It would be interesting to see the effect of different choices, or at least some discussion why it was set to this particular value.

Algorithm 1, step 12, 13, 15: letters R  and D should be in italics.

Table 2: I suggest to delete the "Type" column

Page 12: the notation TPR, etc. are quite standard; I suggest to compress the description on this page, or even omit it.

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf