Next Article in Journal
Non-Intrusive Load Monitoring Based on the Combination of Gate-Transformer and CNN
Previous Article in Journal
YOLO-MBBi: PCB Surface Defect Detection Method Based on Enhanced YOLOv5
 
 
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

Hybrid Phishing Detection Based on Automated Feature Selection Using the Chaotic Dragonfly Algorithm

by
Gharbi Alshammari
*,
Majdah Alshammari
,
Tariq S. Almurayziq
,
Abdullah Alshammari
and
Mohammad Alsaffar
Department of Information and Computer Science, College of Computer Science and Engineering, University of Ha’il, Ha’il 81481, Saudi Arabia
*
Author to whom correspondence should be addressed.
Electronics 2023, 12(13), 2823; https://doi.org/10.3390/electronics12132823
Submission received: 27 April 2023 / Revised: 13 June 2023 / Accepted: 21 June 2023 / Published: 26 June 2023
(This article belongs to the Section Artificial Intelligence)

Abstract

:
Due to the increased frequency of phishing attacks, network security has gained the attention of researchers. In addition to this, large volumes of data are created every day, and these data include inappropriate and unrelated features that influence the accuracy of machine learning. There is therefore a need for a robust method of detecting phishing threats and improving detection accuracy. In this study, three classifiers were applied to improve the accuracy of a detection algorithm: decision tree, k-nearest neighbors (KNN), and support vector machine (SVM). Selecting the relevant features improves the detection accuracy for a target class and determines the class label with the greatest probability. The proposed work clearly describes how feature selection using the Chaotic Dragonfly Algorithm provides more accurate results than all other baseline classifiers. It also indicates the appropriate classifier to be applied when detecting phishing websites. Three publicly available datasets were used to evaluate the method. They are reliable datasets for training the model and measuring prediction accuracy.

1. Introduction

The Internet has become an indispensable tool for everyday communication. Users may find it difficult to protect their sensitive information because the Internet’s infrastructure is unstable. Recently, phishing attacks have become a significant issue. Intrusion detection algorithms are thus necessary to make networks more secure from such threats [1].
Phishing attack detection is a vital requirement when securing online activity [2]. Users will assume that they are protected from phishing attacks when using anti-phishing tools. Various methods have been proposed to thwart phishing attacks, but the accuracy of detection remains inadequate [3].
Feature selection is a way to reduce the computational cost, and it works by minimizing the size of a dataset. The algorithms for feature selection are categorized according to three main methods: the filter model, the wrapper model, and the hybrid model. The first method is the filter method, which relies on the subset selection’s features instead of applying an algorithm related to machine learning. Second, the wrapper method applies machine learning to estimate the level of relevance of the selected features. In the third method, the wrapper and filter methods are combined to create the hybrid method which is more effective [4]. The wrapper and hybrid methods are applied mostly to achieve better feature selection [5].
Various metaheuristic algorithms have been used to select the most discriminative features to overcome the challenges of the optimization problem. The Dragonfly Algorithm (DA) is considered to be a successful algorithm that outperforms other well-known optimizers due to its simplicity and efficiency [5,6]. Yet, the Chaotic Dragonfly Algorithm (CDA) is found to be useful when opting for a large percentage of the discriminating characteristics, as the DA’s searching iterations assist in embedding the so-called chaotic maps. Chaotic maps help to enhance the DA movements’ main parameters with the use of the optimization process so that the DA’s efficacy is increased and convergence is quickened. CDA is used as a wrapper method for feature selection.
Researchers have developed a wide range of techniques related to machine learning in order to detect phishing websites [7,8]. K-nearest neighbors (KNN) is one of the most popular classifiers, and it is used to find the closest point (or neighbor) by calculating the similarity between two points. It applies a different number of neighbors (k), which can be assigned as 3, 5, 10, 50, 100, and so on. The optimal neighbor is obtained by changing the size and observing the results produced using various validation sets. It has been widely used in making predictions in different domains [9]. In addition, a classifier that is based on a set of decision trees is built using a bootstrap sample from the training phase. Each tree is independent in terms of the selection, using a random subset from the training data. Decision trees have been successfully applied as learning classifiers, by changing the number of trees using different ranges [5]. Furthermore, Random Forests (RF) were used in intrusion detection and outperformed Naïve Bayes and J48 in terms of detection accuracy [8].
Deep learning is a subfield of machine learning that has been applied recently in areas such as health care and natural language processing [7]. It is suited to dealing with a large volume of data and complicated cases by identifying a matching pattern through a learning technique using available data. It also helps in decision-making by modeling the data toward the appropriate target.
Because there is some debate concerning whether RF or KNN works better in detecting phishing attacks, the authors in [8] compared different classifiers and investigated their detection accuracy. They found that RF is the more accurate classifier. The present study represents a great opportunity to apply RF with CDA to detect phishing websites and improve prediction accuracy.
The main contributions of this research are that it fulfils the following:
  • Determines the most effective and robust way to detect phishing websites using different classifiers, and compares major machine learning classifiers.
  • Applies feature selection to obtain the most discriminative features using CDA.
  • Uses selected features from CDA to feed the most accurate machine-learning algorithm.

2. Related Work

The dramatic increase in phishing attacks is due to Internet availability and the subsequent dependence on online platforms. As a type of cyberattack, phishing involves malicious actors mimicking genuine entities and bodies to drive users to disclose sensitive information such as financial data and login credentials. Said attacks are a threat to groups and individuals and also to the entire Internet security process.
The mitigation and detection of phishing attacks necessitate the adoption of precise and vigorous techniques capable of analyzing huge volumes of data to efficiently identify malicious patterns. The emergence of machine learning methods is the outcome of a novel approach to detect phishing. Machine learning is capable of recognizing complex patterns and processing very large datasets.
The existence of unsuitable and useless features in the data is among the new problems encountered when using machine learning algorithms for phishing detection, and can negatively affect the competency and accuracy of the detection process. Thus, methods of efficient feature selection are necessary to identify the most useful and relevant features and enhance the general performance of phishing detection algorithms. Challenges related to the selection and detection of features have been covered in many studies. The authors in [10] provided an insight into two interesting techniques for feature reduction. The first technique, adopted in [11], encompasses the use of feature selection methods such as Relief-F, Gain Ratio, Information Gain, and Recursive Feature Elimination (RFE) to analyze a phishing dataset. Using this approach, it is important to propose two features that include the weakest and strongest attributes. The principal component analysis includes the use of various algorithms related to machine learning, namely KNN, naïve Bayes, RF, bagging, neural networks (NN), and support-vector machines. This analysis is applied to the remaining and proposed features. The next step is to apply two stacking models as follows: Stacking1 (RF + NN + bagging) and Stacking2 (KNN + RF + bagging) by incorporating the highest-scoring classifiers to increase the degree of accuracy of the classification. This study is novel in that no previous research had used feed-forward NN and ensemble learners to detect phishing websites. The phishing website dataset is freely available for research purposes (https://www.kaggle.com/akashkr/phishing-website-dataset#dataset.csv, accessed on 8 January 2019). It comprises 11,055 websites, and 32 attributes have been used in earlier studies, including [12,13,14]. The classifiers’ accuracy is improved due to the fundamental role played by the newly recommended features. The findings show that RFE has an essential role in the dataset created by eliminating the fewest significant features. Moreover, “Concerning detecting phishing websites and classifications with 97.4% accuracy, the additional classifiers were outdone by the Stacking1 (RF + NN + bagging)” [15].
The second technique described in this review paper is the fuzzy rough set (FRS) theory, applied by [15] to select important features from the UCI and Mendeley datasets for phishing detection applications.
In [16], a feature selection algorithm based on random forest regression (RFG) was used to identify how many critical features are necessary for terms of the feature of the importance for phishing website detection. The proposed model did not outperform other ensemble learning libraries such as decision trees, boosted decision trees, locally deep support vectors, and NN. However, it did outperform the decision jungle found in the ensemble learning library. Overfitting may explain why decision tree-like models performed better than the proposed model. Overfitting happens when training accuracy is high and the validation or test accuracy is low. The pattern that the model is training may be distorted by the noise being fed into the training data. Because that noise is stochastic, training data that are fitted, inclusive of noise, reduce training errors. However, this does not help to reduce validation or testing errors, as validation and testing errors increase. The attributes that are irrelevant to the prediction can result in overfitting. The results of the Microsoft Azure Machine Learning Studio were based on individual learning models that had been fed into the dataset and had not undergone feature selection, so irrelevant features may have contributed to the noise, causing overfitting in such models.
In [17], the authors used the cuckoo search optimization algorithm as a feature selection method, which is useful for extracting relevant features. In [18], the experiments demonstrated that employing a feature selection method along with machine learning algorithms can improve the build time of classification models for phishing detection without compromising their accuracy.
In [19], based on the salp swarm algorithm (SSA), the researchers recommended a new system associated with phishing detection. SSA mainly aims to increase the performance of the classification and decrease the number of phishing system features. The dataset used in this paper was compiled by the authors. They collected the data using the website PhishTank. Metaheuristic algorithms require specific consideration to optimize binary problems such as the feature selection problem. This requires the conversion of real variables from the continuous optimizer into binary. Transfer functions (TFs) are the most common way to map a continuous optimizer into binary. They convert real variables into a probability between 0 and 1. These probability values are then used to change the position of solutions in the discrete space. TFs are critical components in the binarization process. However, few studies have analyzed their effect on the optimization process. Traditionally, S-TFs and V-TFs have been used to map real optimizers into binary, generating different optimizer behaviors in the binary space. The results of experiments performed using SSA with different binarization methods—S-TFs, V-TFs, X-TFs, Z-TFs, and U-TFs—demonstrate that the accuracy, fitness value, and the number of selected features vary based on the TFs applied. In [20], the adoption of deep learning algorithms to detect phishing was examined, as were the prevailing methods of supervised deep learning. The efficiency of hybrid algorithms and deep neural networks, alongside the partial use of feature selection techniques were also explored. The study made frequent use of the PhishTank dataset, and the choice of the TensorFlow and Keras frameworks was also addressed. Insights into related challenges and future research were also explained. Another related research comprehensively identifying URLs, phishing attacks, and detection techniques was documented in [21]. The focus of the research was models of deep learning to detect hybrid-based and URL-based phishing attacks, comparison and performance of data preprocessing, model design, and feature extraction. Deep understanding related to techniques to detect phishing attacks without using expert analysis. Against this, the current paper presents novel and scientific work intended to enhance the process of detecting deception using automatic feature selection based on the Chaotic Dragonfly Algorithm combined with KNN, SVM classifiers, and the decision tree that is ignored by various studies. The use of the Chaotic Dragonfly Algorithm makes the process of the algorithm much more accurate due to the selection of informative features. Additionally, this paper contributes by highlighting the experiments completed using MATLAB, and illustrates current research efforts in the area of feature detection, deception, and selection. This work also gives an insight into the significance of efficient and accurate approaches to curbing phishing threats, and underlines the distinctive contribution of this search model utilizing the Chaotic Dragonfly algorithm, yielding promising findings.

3. Materials and Methods

Various machine-learning-based methodologies have emerged for identifying phishing websites and increasing predictive performance. Phishing detection is a supervised classification approach that uses labeled datasets to fit models to classify data. Various algorithms exist for supervised learning processes, including naïve Bayes, NN, linear regression, logistic regression, decision trees, support vector machines, KNN, and RF. A useful product needs a robust solution with high accuracy and a low error rate. Improving the model’s performance requires a substantial dataset, especially for complex NNs. Computational time is also a crucial factor for real-time detection systems. Internet users must be able to distinguish between real and fake websites; visual tools will help them to identify phishing attacks. Selecting the most discriminative features is a challenging problem in many applications. Optimization-based problems are solved using algorithms for bio-inspired optimization, i.e., the problem of feature selection. In the current work, the discriminating features are mostly opted for with the use of a new Chaotic Dragonfly Algorithm, which is the Dragonfly Algorithm. This algorithm’s major inspiration was drawn from the static and dynamic behaviors of dragonflies swarming in nature. Dragonflies, or Odonata, are kinds of fancy insects. Nearly 3000 different kinds of this insect are found around the world. A dragonfly’s life cycle includes only two key stages, adult and nymph. They spend most of their lifespan as nymphs and then undergo metamorphosis to become adults. Dragonflies are small predators, as they feed in nature on almost all other small insects. Moreover, nymph dragonflies feed on small fish and other kinds of marine insects [22], as seen in Figure 1.
Dragonflies achieve two main goals, namely migration (dynamic swarming) and hunting (static swarming). During static swarming, they form small groups that fly back and forth inside a limited area so that other flying prey can be easily hunted by those dragonflies. Local movements and abrupt changes are the major flying path features of the static swarm. These features differ from those of the dynamic swarm because large dragonflies, which migrate and travel over a lengthy distance, create the swarm in one direction only. Dragonflies’ dynamic and static behaviors are very alike in exploring and exploiting the metaheuristic phases. This similarity came from creating sub-swarms and flying over many regions during the dynamic swarm, which is the main purpose of the exploration phase, while in the static swarm, the dragonflies fly in bigger swarms in one direction, which is the main purpose of the exploitation phase [19,23].

3.1. Dragonfly Algorithm Principle

In this algorithm, each of the behaviors is mathematically modeled, and the separation is calculated as shown in the equation in Table 1. The pseudo-codes of the Dragonfly Algorithm are shown in Figure 2.
The proposed algorithm was employed to select features from a dataset that was downloaded from the UCI Machine Learning Repository via the following link: https://archive.ics.uci.edu/ml/datasets/phishing+websites (accessed on 12 September 2021). Different feature selection methods and classifiers were compared. Also, a comparison with previous research could be made if the same dataset was used as in our experiments. However, if a different dataset was used, then we could apply that dataset to our method and compare the results. Different assessment methods for imbalanced datasets could be used. Accuracy is a well-known assessment method, and it represents the ratio between the correctly classified samples and the total number of samples, as shown in Equations (1) and (2).
A C C = T P + T N T P + T N + F P + F N
S T D = X μ 2 N
where
  • TP refers to the true positive, which is the appropriately predicted phishing website attack’s number.
  • FN refers to the false negative, which is the number of samples predicted as secure but that were in fact attacked.
  • TN refers to the true negative, which is the number of samples appropriately predicted as secure.
  • FP refers to the false positive, which the number of samples predicted as attacks, but that were in fact safe.
  • In this study, the data are divided randomly into training and testing sets using k-fold cross-validation to ensure the stability of the obtained results. The training set is applied to train a classifier through optimization, and the testing set is used to evaluate the selected features.

3.2. System Framework

In summary, the newly recommended model contains three major phases: data preprocessing, feature selection, and classification, as shown in Figure 3.

3.3. Classification

Decision Tree: this is hierarchically structured and comprises the leaf and inner nodes. Inner nodes embody conditions and tests, while peripheral nodes compromise class labels. The tree branches represent the findings of the related tests. Decision trees have many benefits, as well as being appropriate for multi-output problems, interpretable, and capable of handling categorical and numerical data. It is also easy to convert them to facilitate rapid learning programs and classification rules. The extrapolation of the decision tree involves iteratively sorting out the dataset from the root node. However, outliers and noise cause tree anomalies that are remedied using tree pruning. During tree pruning, unnecessary sub-trees are removed to attain smaller and less complex trees. On the one hand, pre-pruning does not allow for the additional splitting of nodes to turn them into terminal nodes. On the other hand, post-pruning removes sub-trees from a fully-grown tree to increase its accuracy and simplicity [20].
K-Nearest Neighbors (KNN): this is “a non-parametric classification algorithm used to assign a class label to a sample based on a majority vote to its nearest neighbors in the training data set” [21]. KNN is simply an efficient algorithm that requires no training. It helps to classify new data points by matching their feature values with those of the training samples, where the class label assigned is the one that is most prevalent among its k-nearest neighbors. The degree of flexibility or softness of the decision boundary is determined by the selection of k determiners. KNN is appropriate for categorical and numerical data and handles the problem of multiclass classification. Computationally, it is still expensive, particularly with huge datasets, as it necessitates computing distances between the novel sample and all of the training samples. It is possible to ensure fair evaluations of different features by using feature scaling [21].
Support Vector Machine (SVM): this is “a powerful and supervised learning algorithm used for regression and classification” [21]. It helps to find the optimal level, increasing the margin, or separating categories between the decision boundary and data points. In SVM, linear and nonlinear data can both be processed, using different kernel functions. Likewise, it is capable of handling overfitting and high-dimensional data and performs in numerous arenas [21].

4. Results

This experiment aims mainly to verify the accuracy of the prediction and performance of the suggested method. Three datasets were adopted to achieve the research objectives. Every dataset was examined using four different runtimes and numbers of iterations to determine the optimal number of iterations for all datasets, as is shown in Table 2 and Table 3. SVM classifiers, KNN, and decision trees were run to evaluate the experiments. A benchmark experiment was run first, without the use of the Chaotic Dragonfly Algorithm. In later experiments, MATLAB was used to achieve feature selection using the Chaotic Dragonfly Algorithm. For a subsequent comparison of the algorithms, the experiments were run in full and two measures were taken: standard deviation (STD) and (ACC).
The findings indicated that a run time of 30 and 100 iterations produced a higher level of accuracy than the other three cases. Thus, these parameters were used to conduct the remaining experiments on the datasets. The three classifiers’ standard deviations and accuracies for the phishing dataset are illustrated in Table 2. Increasing numbers of runs and iterations lead to higher results. This demonstrates that once the classifiers are allowed to extensively and iteratively process the data, their performance is increasingly improved to precisely classify phishing instances. To demonstrate comparable performance, the three classifiers need to show the same degrees of accuracy for different run times and numbers of iterations. This demonstrates that all three classifiers can efficiently learn and make more precise predictions in the phishing dataset. On the other hand, it is evident that the SVM classifier secures a slightly lower level of accuracy in comparison with other classifiers. This inconsistency is a result of the integral features of SVM and their sensitivity to hyperparameter selection.
Table 4 gives the results for the three different classifiers: kNN, decision tree, and SVM. It also shows the predicted results after implementing the Dragonfly Algorithm (accuracy with DA) compared to those obtained without the algorithm, which acts as a benchmark in these experiments.
Figure 4, Figure 5 and Figure 6 show the improvement rates, calculated using Equation (3), of three different classifiers when applied to three different phishing datasets. It can be seen that all classifiers were improved compared to the benchmark method. However, in Figure 4, SVM was more successful than the k-NN and decision tree classifiers, with almost 4% improvement. Moreover, it can be observed that in Figure 5 and Figure 6, the improvement is very high at almost 25%. Hence, the results show that the proposed method outperforms the baseline method for all applied classifiers and using different datasets.
I m p r o v e m e n t   R a t e = A c c u r a c y w i t h   D A A c c u r a c y w i t h o u t   D A A c c u r a c y w i t h   D A × 100
In order to make a valid comparison, three different datasets were used, as indicated in Figure 7. It is clear that the proposed method works better when the dataset is larger. Therefore, the results demonstrate a strong justification for applying the method to big datasets.

5. Discussion

Based on the figures and tables above, it can be concluded that the performance of automated feature selection using the Chaotic Dragonfly Algorithm is promising for other algorithms. The main reason for the superior results is the integration of CDA with the automated selection feature that finds the optimal selection by finding the optimal solutions in different cases of change of frequency and operation. This increases the iteration rate to achieve better optimization. In addition, the used classifier is the most successful and has a higher accuracy rate compared to other classifiers. The experiment was conducted on three datasets, each of which is discussed separately below.

5.1. Phishing.csv Data Set

This dataset was used to compare the performance of three different classification algorithms, namely KNN, decision tree, and SVM, for identifying phishing attacks. The accuracy and standard deviation of each algorithm were calculated both with and without the Dragonfly Algorithm (DA).
Without DA, both KNN and decision tree classifiers show the same accuracy of 94.2409, while SVM has a lower accuracy of 90.4855. The standard deviation of each algorithm without DA is also provided, with KNN and decision tree having the same value of 0.5259 and SVM having a higher value of 0.7898.
With DA, all three algorithms show an improvement in accuracy. KNN has the highest accuracy of 95.3174, followed closely by decision tree with an accuracy of 95.2902, and then SVM with an accuracy of 94.069. The standard deviation values for each algorithm with DA are also provided, with KNN having the lowest value of 0.3233, followed by decision tree with 0.3951, and then SVM with the highest value of 1.0547.
Overall, the results suggest that KNN and decision tree classifiers perform similarly well without DA, but KNN is the most accurate classifier with DA. SVM has a lower accuracy than the other two classifiers without DA, but shows significant improvement with DA. However, SVM also has the highest standard deviation values, indicating that its performance may be less consistent than that of the other two algorithms.
In conclusion, the results suggest that KNN and decision tree classifiers are more stable and reliable for identifying phishing attacks than SVM, especially when the Dragonfly Algorithm is not used. However, if the Dragonfly Algorithm is applied, all three algorithms can be used to achieve high accuracy in identifying phishing attacks.

5.2. Dataset_small.csv Data Set

Based on the information provided, it appears that the dataset_small.csv dataset was used to test the three different classifiers: KNN, decision tree, and SVM. The dataset was used to test both with and without the Dragonfly Algorithm (DA), and accuracy and standard deviation (STD) were calculated for each test.
Without DA, both the KNN and decision tree classifiers achieved an accuracy of 85.0223 with an STD of 0.4504 for each. The SVM classifier, on the other hand, achieved an accuracy of 60.4632 with an STD of 0.4852.
With DA, both the KNN and decision tree classifiers saw an improvement in accuracy. The KNN classifier achieved an accuracy of 92.4858 with an STD of 0.1022, while the decision tree classifier achieved an accuracy of 92.8905 with an STD of 0.4944. The SVM classifier also saw an improvement in accuracy with DA, achieving an accuracy of 75.0316 but with a much higher STD of 1.7528.
Overall, the KNN and decision tree classifiers seemed to perform better on this small dataset than the SVM classifier, with both achieving high accuracy scores with or without DA. The SVM classifier, on the other hand, had a lower accuracy score without DA and a higher STD with DA. It is also worth noting that DA seems to have a positive impact on the accuracy of all three classifiers, although the improvement in accuracy is more significant for the KNN and decision tree classifiers.

5.3. Dataset_full.csv Data Set

Based on the provided information, the full dataset was used to test three classifiers, namely k-Nearest Neighbors (KNN), decision tree (DT), and support vector machine (SVM).
For KNN, the classifier achieved 85.0288% accuracy without the Dragonfly Algorithm (DA), with a low standard deviation of 0.3357. However, when DA was applied, the accuracy improved to 92.5179%, with a smaller standard deviation of 0.2142.
For DT, the classifier also achieved 85.0288% accuracy without DA, with a similar standard deviation of 0.3357. However, when DA was applied, the accuracy further improved to 92.9269%, with a higher standard deviation of 0.4085.
For SVM, the classifier achieved a lower accuracy of 60.4606% without DA, with a relatively high standard deviation of 0.4849. However, when DA was applied, the accuracy improved significantly to 75.7289%, with a much higher standard deviation of 1.2436.
Overall, it seems that DA can greatly improve the accuracy of the classifiers, especially for KNN and DT. However, SVM still struggles with low accuracy, even with DA. Further analysis may be needed to understand why SVM did not perform as well as the other classifiers. It is also important to note that the standard deviation can provide useful information about the consistency of the classifier’s performance.

6. Conclusions

To address the low classification accuracy rate of KNN, decision tree, and SVM, a novel CDA automated feature selection is proposed. This paper compares the performance of these three popular classifier algorithms with that of the proposed algorithm. To assess the effectiveness of the proposed method, experiments were carried out on three datasets. Further experiments in different fields, including natural language processing, medical applications, and many more, could be conducted using our proposed method to provide a more widespread evaluation.
Finally, the hybrid method that integrates CDA with the classification task can be successfully applied to solve almost all optimization problems in real applications. The efficient results verify that the combination of CDA with these classifications produces significant improvements.
Despite the efficiency of the results obtained by the hybrid method, there are a number of limitations that need to be considered. Hence, other classifiers could be used to evaluate the performance of the proposed method. In addition, our method can be conducted using various types of dataset. Finally, other common evaluation measures can be used such as precision, recall and F1-score to give comprehensive results on the proposed method’s effectiveness.

Author Contributions

Conceptualization, G.A. and M.A. (Majdah Alshammari); methodology, G.A.; software, M.A. (Majdah Alshammari); validation, G.A., A.A. and T.S.A.; formal analysis, M.A. (Mohammad Alsaffar); investigation, G.A.; resources, A.A.; data curation, T.S.A.; writing—original draft preparation, M.A. (Majdah Alshammari); writing—review and editing, G.A.; visualization, A.A.; supervision, G.A.; project administration, G.A.; funding acquisition, G.A. All authors have read and agreed to the published version of the manuscript.

Funding

The Scientific Research Deanship at the University of Ha’il in Saudi Arabia provided funding for this study under project number BA-2129.

Data Availability Statement

In this study, the dataset that was downloaded from the UCI Machine Learning Repository via the following link: https://archive.ics.uci.edu/ml/datasets/phishing+websites (accessed on 12 September 2021).

Acknowledgments

This research has been funded by the Scientific Research Deanship at the University of Ha’il in Saudi Arabia under project number BA-2129.

Conflicts of Interest

The authors declare no conflict of interest.

References

  1. Ashraf, N.; Ahmad, W.; Ashraf, R. A comparative study of data mining algorithms for high detection rate in intrusion detection system. Ann. Emerg. Technol. Comput. 2018, 2, 49–57. [Google Scholar] [CrossRef]
  2. Al-Sarem, M.; Saeed, F.; Al-Mekhlafi, Z.G.; Mohammed, B.A.; Al-Hadhrami, T.; Alshammari, M.T.; Alreshidi, A.; Alshammari, T.S. An optimized stacking ensemble model for phishing websites detection. Electronics 2021, 10, 1285. [Google Scholar] [CrossRef]
  3. Dutta, A.K. Detecting phishing websites using machine learning technique. PLoS ONE 2021, 16, e0258361. [Google Scholar] [CrossRef]
  4. Cui, X.; Li, Y.; Fan, J.; Wang, T.; Zheng, Y. A Hybrid Improved Dragonfly Algorithm for Feature Selection. IEEE Access 2020, 8, 155619–155629. [Google Scholar] [CrossRef]
  5. Adamu, A.; Abdullahi, M.; Junaidu, S.B.; Hassan, I.H. A hybrid particle swarm optimization with crow search algorithm for feature selection. Mach. Learn. Appl. 2021, 6, 100108. [Google Scholar] [CrossRef]
  6. Wang, L.; Shi, R.; Dong, J. A hybridization of dragonfly algorithm optimization and angle modulation mechanism for 0–1 knapsack problems. Entropy 2021, 23, 598. [Google Scholar] [CrossRef]
  7. Adebowale, M.A.; Lwin, K.T.; Hossain, M.A. Deep learning with convolutional neural network and long short-term memory for phishing detection. In Proceedings of the 2019 13th International Conference on Software, Knowledge, Information Management and Applications (SKIMA), IEEE, Island of Ulkulhas, Maldives, 26–28 August 2019; pp. 1–8. [Google Scholar] [CrossRef]
  8. Subasi, A.; Molah, E.; Almkallawi, F.; Chaudhery, T.J. Intelligent phishing website detection using random forest classifier. In Proceedings of the 2017 International Conference on Electrical and Computing Technologies and Applications (ICECTA), IEEE, Ras Al Khaimah, United Arab Emirates, 21–23 November 2017; pp. 1–5. [Google Scholar] [CrossRef]
  9. Wang, W.; Li, Y.; Wang, X.; Liu, J.; Zhang, X. Detecting Android malicious apps and categorizing benign apps with ensemble of classifiers. Future Gener. Comput. Syst. 2018, 78, 987–994. [Google Scholar] [CrossRef] [Green Version]
  10. Tang, L.; Mahmoud, Q.H. A Survey of Machine Learning-Based Solutions for Phishing Website Detection. Mach. Learn. Knowl. Extr. 2021, 3, 34. [Google Scholar] [CrossRef]
  11. Zamir, A.; Khan, H.U.; Iqbal, T.; Yousaf, N.; Aslam, F.; Anjum, A.; Hamdani, M. Phishing web site detection using diverse machine learning algorithms. Electron. Libr. 2020, 38, 65–80. [Google Scholar] [CrossRef]
  12. Ibrahim, D.R.; Hadi, A.H. Phishing Websites Prediction Using Classification Techniques. In Proceedings of the 2017 International Conference on New Trends in Computing Sciences (ICTCS), IEEE, Amman, Jordan, 11–13 October 2017; pp. 133–137. [Google Scholar] [CrossRef]
  13. Shirsat, S.D. Demonstrating different phishing attacks using fuzzy logic. In Proceedings of the 2018 Second International Conference on Inventive Communication and Computational Technologies (ICICCT), IEEE, Coimbatore, India, 20–21 April 2018; pp. 57–61. [Google Scholar] [CrossRef]
  14. Tyagi, J.; Shad, S.; Sharma, S.; Gaur, S.; Kaur, G. A Novel Machine Learning Approach to Detect Phishing Websites. In Proceedings of the 2018 5th International Conference on Signal Processing and Integrated Networks (SPIN), IEEE, Noida, India, 22–23 February 2018; pp. 425–430. [Google Scholar] [CrossRef]
  15. Zabihimayvan, M.; Doran, D. Fuzzy rough set feature selection to enhance phishing attack detection. In Proceedings of the 2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), New Orleans, LA, USA, 23–26 June 2019; pp. 1–6. [Google Scholar] [CrossRef] [Green Version]
  16. Ubing, A.A.; Jasmi, S.K.; Abdullah, A.; Jhanjhi, N.Z.; Supramaniam, M. Phishing website detection: An improved accuracy through feature selection and ensemble learning. Int. J. Adv. Comput. Sci. Appl. 2019, 10, 252–257. [Google Scholar] [CrossRef] [Green Version]
  17. Saxena, A.; Sharma, N.; Agarwal, P.; Barotia, R. Phishing Website Prediction by Using Cuckoo Search as a Feature Selection and Random Forest and BF-Tree Classifier as a Classification Method. In Rising Threats in Expert Applications and Solutions. Advances in Intelligent Systems and Computing; Rathore, V.S., Dey, N., Piuri, V., Babo, R., Polkowski, Z., Tavares, J.M.R.S., Eds.; Springer: Singapore, 2020; Volume 1187, pp. 765–776. [Google Scholar] [CrossRef]
  18. Edward, J.D. Multimedia security: The 22nd century approach! In 2004 Workshop on Multimedia and Security; ACM: New York, NY, USA, 2004; pp. 1–116. [Google Scholar] [CrossRef]
  19. Khurma, R.A.; Sabri, K.E.; Castillo, P.A.; Aljarah, I. Salp swarm optimization search based feature selection for enhanced phishing websites detection. In Applications of Evolutionary Computation: 24th International Conference, EvoApplications; Springer: Cham, Switzerland, 2021; pp. 146–161. [Google Scholar] [CrossRef]
  20. Catal, C.; Giray, G.; Tekinerdogan, B.; Kumar, S.; Shukla, S. Applications of deep learning for phishing detection: A systematic literature review. Knowl. Inf. Syst. 2022, 64, 1457–1500. [Google Scholar] [CrossRef]
  21. Asiri, S.A.; Xiao, Y.; Alzahrani, S.; Li, S.; Li, T. A Survey of Intelligent Detection Designs of HTML URL Phishing Attacks. IEEE Access 2023, 11, 6421–6443. [Google Scholar] [CrossRef]
  22. Mirjalili, S. Dragonfly algorithm: A new meta-heuristic optimization technique for solving single-objective, discrete, and multi-objective problems. Neural Comput. Appl. 2016, 27, 1053–1073. [Google Scholar] [CrossRef]
  23. Sayed, G.I.; Tharwat, A.; Hassanien, A.E. Chaotic dragonfly algorithm: An improved metaheuristic algorithm for feature selection. Appl. Intell. 2019, 49, 188–205. [Google Scholar] [CrossRef]
  24. Jangir, P. A Multi-Objective Combined Economic Emission Dispatch Problem Solution Using Classical and Hurestic Approach. Master’s Thesis, Gujarat Technological University, Gujarat, India, 2015. [Google Scholar]
Figure 1. DAs Flowchart.
Figure 1. DAs Flowchart.
Electronics 12 02823 g001
Figure 2. Pseudo-codes of the Dragonfly Algorithm [24].
Figure 2. Pseudo-codes of the Dragonfly Algorithm [24].
Electronics 12 02823 g002
Figure 3. System Framework.
Figure 3. System Framework.
Electronics 12 02823 g003
Figure 4. Improvement rate of classifiers on the fishing dataset.
Figure 4. Improvement rate of classifiers on the fishing dataset.
Electronics 12 02823 g004
Figure 5. Improvement rate of classifiers on the small dataset.
Figure 5. Improvement rate of classifiers on the small dataset.
Electronics 12 02823 g005
Figure 6. Improvement rate of classifiers on the full dataset.
Figure 6. Improvement rate of classifiers on the full dataset.
Electronics 12 02823 g006
Figure 7. A comparison of three classifiers using three datasets.
Figure 7. A comparison of three classifiers using three datasets.
Electronics 12 02823 g007
Table 1. Behaviors’ mathematical models.
Table 1. Behaviors’ mathematical models.
ModelEquation
The separation S i = j = 1 N X X j
The alignment A i = j = 1 N X j N
The cohesion C i = j = 1 N X j N X
Attraction towards a food source F i = X + X
Distraction outwards to an enemy E i = X + X
Table 2. Results without feature selection (all features).
Table 2. Results without feature selection (all features).
IterationRunClassifierACCSTD
155KNN94.22890.7686
Decision Tree94.22890.7686
SVM90.77341.9699
3015KNN93.94840.5639
Decision Tree93.94840.5639
SVM90.93320.725
5025KNN94.21440.4916
Decision Tree94.21440.4916
SVM90.83311.1004
10030KNN94.24090.5259
Decision Tree94.24090.5259
SVM90.48550.7898
Table 3. Results with feature selection of DA.
Table 3. Results with feature selection of DA.
IterationRunClassifierACCSTD
155KNN94.69020.4226
Decision Tree95.31430.371
SVM93.35141.7887
3015KNN94.88010.3537
Decision Tree95.03390.633
SVM94.32531.2101
5025KNN95.16420.3757
Decision Tree95.23110.5048
SVM94.5310.8378
10030KNN95.31740.3233
Decision Tree95.29020.3951
SVM94.0691.0547
Table 4. Results for three datasets using 100 iterations and 30 run.
Table 4. Results for three datasets using 100 iterations and 30 run.
Data SetClassifiersAccuracy without DASTD without DAAccuracy with DASTD with DA
Phishing.csvKNN94.24090.525995.31740.3233
Decision tree94.24090.525995.29020.3951
SVM90.48550.789894.0691.0547
Dataset_small.csvKNN85.02230.450492.48580.1022
Decision tree85.02230.450492.89050.4944
SVM60.46320.485275.03161.7528
Dataset_full.csvKNN85.02880.335792.51790.2142
Decision tree85.02880.335792.92690.4085
SVM60.46060.484975.72891.2436
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Share and Cite

MDPI and ACS Style

Alshammari, G.; Alshammari, M.; Almurayziq, T.S.; Alshammari, A.; Alsaffar, M. Hybrid Phishing Detection Based on Automated Feature Selection Using the Chaotic Dragonfly Algorithm. Electronics 2023, 12, 2823. https://doi.org/10.3390/electronics12132823

AMA Style

Alshammari G, Alshammari M, Almurayziq TS, Alshammari A, Alsaffar M. Hybrid Phishing Detection Based on Automated Feature Selection Using the Chaotic Dragonfly Algorithm. Electronics. 2023; 12(13):2823. https://doi.org/10.3390/electronics12132823

Chicago/Turabian Style

Alshammari, Gharbi, Majdah Alshammari, Tariq S. Almurayziq, Abdullah Alshammari, and Mohammad Alsaffar. 2023. "Hybrid Phishing Detection Based on Automated Feature Selection Using the Chaotic Dragonfly Algorithm" Electronics 12, no. 13: 2823. https://doi.org/10.3390/electronics12132823

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop