Comparative Analysis of Machine

Learning Algorithms for Phishing

Website Detection

Dhiman Sarma, Tanni Mittra, Rose Mary Bawm, Tawsif Sarwar,

Farzana Firoz Lima, and Sohrab Hossain

Abstract Internet has become the most effective media for leveraging social inter-
actions during the COVID-19 pandemic. Users’ immense dependence on digital
platform increases the chance of fraudulence. Phishing attacks are the most common
ways of attack in the digital world. Any communication method can be used to target
an individual and trick them into leaking confidential data in a fake environment,
which can be later used to harm the sole victim or even an entire business depending
on the attacker’s intend and the type of leaked data. Researchers have developed
enormous anti-phishing tools and techniques like whitelist, blacklist, and antivirus
software to detect web phishing. Classification is one of the techniques used to detect
website phishing. This paper has proposed a model for detecting phishing attacks
using various machine learning (ML) classifiers. K-nearest neighbors, random forest,
support vector machines, and logistic regression are used as the machine learning
classifiers to train the proposed model. The dataset in this research was obtained
from the public online repository Mendeley with 48 features are extracted from
5000 phishing websites and 5000 real websites. The model was analyzed using F1
scores, where both precision and recall evaluations are taken into consideration. The
proposed work has concluded that the random forest classifier has achieved the most
efficient and highest performance scoring with 98% accuracy.

Keywords Machine learning · Phishing · Detection · KNN · K-nearest neighbor ·

Random forest · Decision tree · Logistic regression · Support vector machine

D. Sarma (B)
Department of Computer Science and Engineering, Rangamati Science and Technology
University, Rangamati, Bangladesh
e-mail: dhiman001@[Link]
T. Mittra
Department of Computer Science and Engineering, East West University, Dhaka, Bangladesh
R. M. Bawm · T. Sarwar · F. F. Lima · S. Hossain
Department of Computer Science and Engineering, East Delta University, Chittagong, Bangladesh

© The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd. 2021 883
S. Smys et al. (eds.), Inventive Computation and Information Technologies, Lecture Notes
in Networks and Systems 173,
[Link]
884 D. Sarma et al.

1 Introduction

Today’s digital world is increasingly carried out in wide range of platforms from
business to health care. Massive online activities open door for cyber criminals.
Phishing is the most successful and dangerous cyber-attack observed across the
globe. Phishing attacks are dangerous and it can be avoided by simply creating
awareness and developing the habits of staying alert and continuously being on the
lookout when surfing through the Internet and by clicking links after verifying the
trustworthiness of the source links. There are also tools such as browser extensions
that notify users when they have entered their credentials on a fake site, therefore,
possibly having their credentials transferred to a user with malicious intent. Other
tools can also allow networks to lock down everything and only allow access to
whitelisted sites to provide extra security while compromising some convenience on
the user side [1–4].
A company can take several measures to protect itself from phishing attacks. But
the core problem is still relying on the employees to some extent on being careful and
alert at all. While it ensures the reliability of machines, humans are not customizable.
A mistake from one employee could be enough to lead to a vulnerability that an
attacker can skillfully exploit and cause damage to an entire company if not detected
and contained in time. Security is a significant concern for any organization [5–9, 22].
This paper decided to employ the concepts of machine learning to train a model
that would learn to detect links that could be attempting to execute a phishing attack
and allow the machine to become an expert at detecting such sites and alerting humans
without having to rely on the human minds too much. By using artificial intelligence,
this research intended to add another layer of security that would tirelessly detect
sites and get better at its performance over time given more datasets to learn from
and allow humans to share their responsibilities, regarding careful Internet surfing
with the machines.

2 Related Research

Different research works that were pertinent to phishing attacks and essential clas-
sification techniques that were practiced to detect web phishing were highlighted in
this section.
With the current boom in technology, phishing has become more popular among
malicious hackers. The first-ever phishing lawsuit was filed in 2004 when a certain
phisher created a duplicate of a popular website known as “America Online”. With
the help of this same website, he was able to get access to personal user info and
bank details of many individuals. Phishers began to focus on websites that had online
transactions with people and made legions of fake websites that began to trick unsus-
pecting people into thinking they were the real one. Table 1 shows various types of
phishing attacks.
Comparative Analysis of Machine Learning Algorithms … 885

Table 1 Types of phishing attacks

Algorithm-based phishing Attackers create different algorithms that can detect and steal
personal user information from the database of a website
Deceptive phishing Currently, this is done by using e-mails that link a client to a
malicious website where a client unsuspectingly enters their
private information
URL phishing Hackers use hidden links in unsuspecting parts of a website that
leads a client to a malicious page [10–15]
Hosts file poisoning Before making a DNS query, the “hostnames” in the host records
are checked. Phishers poison the “host records” and redirect a user
to a phishing website
Content injection phishing Hackers inject some malicious sections in a real website that
collects the data of a user [16]
Clone phishing Phishers use a former sent e-mail and clone it. The cloned e-mail
has a malignant link attached to it that is sent to different
unsuspecting users [14]

Table 2 Traditional website phishing detection techniques

Blacklist filter A blacklist is a primary access control mechanism that can block some
aspects on a list from passing through. These filters can be applied in
different security measures like DNS servers, firewalls, e-mail servers,
etc. A blacklist filter maintains a list of elements like IP addresses,
domains, IP netblocks that are commonly used by phishers
whitelist filter A whitelist filter contains a list of different elements such as URLs,
schemes, or domains that will be allowed to pass through a system
gateway. A whitelist contrary to a blacklist maintains a list of all
legitimate websites
Pattern matching filter Pattern matching is a technique that checks if a specific sequence of
data or tokens exists among a list of given data

Table 2 explains traditional website phishing detection techniques like blacklist

filter, whitelist filter, and pattern matching filter.

2.1 Machine Learning-Based Methods

Malicious Domain Detection

Malicious domains are one of the leading causes of phishing. Different machine
learning methods and models were created to better detect malicious domains with
a high success rate [17].

E-mail Spam Filtering

Spam filters use probing methods that detect malicious e-mails and blocks them.
The e-mail is passed through thousands of predefined rules that scores the e-mail on
886 D. Sarma et al.

the probability of being a spam. Phishers use spam e-mails to direct a client to their
malicious webpage and steal data.

3 Methodology

As this paper mainly employs machine learning techniques to train models that can
detect phishing websites, our first step is to understand that our research understood
how machine learning works. In a nutshell, all machine learning techniques involve
a dataset and some programmed code that perform computations allowing the code
to analyze a portion of the data and observe relationships between the features and
the classification of the data. The machine’s trained knowledge of the relationship
was then tested against the rest of the data, and its performance was measured and
scored. Based on the performance of the model, the setup of the training procedure
and the dataset preprocessing were readjusted in hopes of better results in the next
iteration of training. If a model failed to provide satisfactory results, other techniques
were employed if found relevant to the dataset. If the model performs better than
all other trained models; however, the model was stored and used on new unknown
datasets to verify its performance furthermore.
It is important to note that different datasets could be in different formats, and
therefore new datasets introduced to the model might require preprocessing to
maintain optimal performance from the model.
To better demonstrate the model, Fig. 1 demonstrates the process.

3.1 Dataset

The dataset in this research was obtained from the public online repository Mendeley.
The dataset contained 48 features extracted from 5000 phishing websites and 5000
real websites. An improved feature extraction technique was employed to this dataset
by using the browser automation framework. The class label indicated two outcomes
where 0 was a phishing website, and 1 was a real website.

3.2 Data Preprocessing

Any collected dataset usually comes with errors, variable formats, different features,
incomplete sections, etc. If the dataset is used directly to train a model, it could lead
to unexpected behavior, and the results would rarely ever satisfy the expected needs.
Comparative Analysis of Machine Learning Algorithms … 887

Fig. 1 Flowchart of the proposed system

Therefore, it is important to preprocess data to convert raw data into an understandable

format to allow the model to train in the best way possible.

Steps in Data Preprocessing

Step 1. Import the libraries: Pandas, matplotlib, yellowbrick, numpy, and sklearn
libraries were used for import the libraries.
Step 2. Import the dataset: The dataset was imported and named as “data”.
Step 3. Check the missing values: This step was unnecessary for our dataset, as
our dataset did not have any missing values.
Step 4. See the categorical values: The dataset did not contain any categorical
values. So, this step was skipped.
Step 5. Split the dataset into training and test set: The dataset was split into
two parts. 70% of the dataset was used for training purposes and the rest of the 30%
for testing purposes. Training dataset provided features and labels together to learn
the relationship between them so that the model could later on test its knowledge
against the test set, where it was only provided with the features and was set to
generate labels for each set of features and check how many of its predictions were
done correctly.
888 D. Sarma et al.

Step 6. Feature scaling: Feature scaling was used to set a limit to the range
of variables to allow for comparison on common grounds. But it was need not to
implement for our dataset.

3.3 Classifiers

The model picked K-nearest neighbors, random forest, support vector machines,
and logistic regression as the machine learning techniques to train our model. The
models after having been trained and could then be analyzed using F1 scores that
took into account both precision and recall evaluations of the models. The model was
judged based on how much bias it contained on predicting the labels for a sample of
data, and how much difference existed in the fit of the data when compared between
the test set results and the train set results and a measurement that was referred to as
variance.

K-Nearest Neighbors (KNN)

The main idea of KNN in a nutshell is that things that are similar are usually near
each other. It is one of the simplest of all machine learning techniques and works by
simply comparing the features of a set of data, to be labeled, with other sets of data,
that are already labeled. It measures the difference between these features and refers
to these differences as distances. After having measured the distances, the model
selected k number of shortest distances and then output the most frequent labels
among them as its predicted label for the unlabeled dataset [15].

Random Forest
Random forests are made using decision trees, so it is important to understand
decision trees before understanding random forests.
Decision trees were made out of data by analyzing the features in a dataset and
creating a root using the feature that has the most impact on the label to the feature
set. These can be measured using different scoring techniques like the Gini Index.
Once a root had been decided on, the rest of the features were analyzed and similar
to the selection of the root, and the features were scored and the most significant
feature among the rest was added as a child to the root. This technique was repeated
until all of the features were added to the tree.
When a label was to be decided, the root feature was selected and then its prob-
ability was used to determine the path to take from its node, and similarly, it has
decided the intended next path from the next node and its corresponding feature. The
process was repeated until reached a leaf node that was the end of the tree, where
the decision was finalized, and therefore a label was provided by our model.
Although decision trees are good at predicting labels from the dataset used to
create them, they are not so good at predicting labels on an entirely new set of features
that are considered to be somewhat inaccurate at their predictive capabilities. This
inaccuracy can be minimized by using random forests.
Comparative Analysis of Machine Learning Algorithms … 889

The first step in generating a random forest was using the dataset to create a
bootstrapped dataset. This new dataset would contain samples from the original
dataset but would be randomly selected and placed into the new table, with the
possibility of some samples existing in the new table more than once.
The second step was to select a random subset of the features and analyze those,
using our chosen scoring technique, to generate the root of the decision tree. To add
children to the root, another random subset from among the rest of the features was
once again selected and was analyzed to pick the next child. The second step was
repeated several times to generate a wide variety of decision trees which increased
the accuracy of our model compared to using one individual decision tree.
The process of labeling an unlabeled sample of data was using all of the decision
trees to predict labels according to each of them, and then keeping track of the labels
produced by each tree, and finally selecting the label that was predicted by the most
number of decision trees. The most popular label was selected as the final predicted
label and was usually more accurate then what would have achieved from using a
single decision tree.
While random forests are deterministic, another model called extremely random-
ized tree can also be used which introduces more randomness in its generation of
trees. The splits in ERTs are not optimal, and therefore, can lead to more business.
Variance is reduced as well because of the extra randomness. While both random
forests and extremely randomized trees perform quite similarly, ERTs are usually
more inaccurate but also understandably faster in computation. But ERTs should be
avoided if the dataset contains a lot of noisy features which can reduce its functionality
even more [18–20].

Support Vector Machines

Support vector machines work by analyzing a dataset and trying to set a separator
called a support vector classifier, among the features to be able to classify the samples
using information regarding which side of the separator the sample falls into. To
be able to separate different kinds of datasets and establish boundaries that mark
regions for each label, the data was moved into a higher dimension than its original
relatively lower dimension in the beginning. For example, if a dataset were to be
one dimensional, it can be turned into a two-dimensional curve by using the squared
values of the features and plotting it against the original features. If a support vector
classifier were unable to separate the features into their labeled regions, this could
open up the possibilities and allow the separator to be placed in the newer and more
flexible graph.
The decision of squaring the features, or raising them to a perhaps higher poly-
nomial degree, is taken by the polynomial kernel which increases the dimensions by
setting new degrees and then uses the relationships between each pair of observa-
tions to find a support vector classifier. Radial kernel can also be used which finds
the support vector classifier in infinite dimensions and trains the model such that it
behaves like a weighted nearest neighbor technique.
890 D. Sarma et al.

When a new unlabeled sample is provided, it can simply be plot within the graph
and compare its position with that of the support vector classifier to observe which
side of the separator it falls into, and therefore, classify the sample accordingly.
Support vector classifiers also have other versions of it. For example, while linear
SVC only attempts to fit a hyperplane within a data to best separate the different
categories of the data, a Nu-SVC uses a parameter to control the number of support
vectors [21, 23].

Logistic Regression
Logistic regression is based on the concept of linear regression, where a line is
plotted against a given dataset and its axes. This line is drawn such that the squared
differences between this line and the plotted points are at their minimum. The line
and calculated R2 are used to determine whether the features are correlated. The p-
value was also calculated to verify that this value was actually statistically significant.
Finally, the line was used to plot any sample of data and finds a label’s corresponding
value according to this line.
Logistic regression uses a similar concept but is different such that it can only
classify two labels and no more. Another difference is that it does not use a straight
line, but rather an S-shaped curve which goes from 0 to 1. It tells the probability of
a given sample to belong in one of these two labels.
Logistic regression CV uses cross-validation over logistic regression to further
improve the quality of our model. When cross-validation was applied, sections of
data from the dataset were resampled in separate sessions to achieve multiple results.
It could calculate the mean probability which can label the data and can get more
accurate results.
To reach the right equation of the line, stochastic gradient descent was used
which used gradients of the loss function at each iteration as an indication to lead
to the proper values to be placed within the line equations constants, and therefore
minimizing the loss in the process and deriving the optimal line equation for our
dataset.

4 Result

Precision recall, F1 score, and success rate are widely used to measure the perfor-
mance of the supervised machine learning algorithms [24–27]. Classification report
of our model is described below. In all the tables, the row indicates 1 as a real website
and 0 as a phishing website.
Table 3 presents the classification report of the support vector machine. The preci-
sion and recall for predicting a real website are 0.920 and 0.898. These scores were
used to calculate the F1 score for predicting a real website which was 0.909. Simi-
larly, the precision and recall for predicting a phishing website are 0.895 and 0.917.
Using these both scores, the F1 score was measured for predicting a phishing website
and is 0.906. It is to be noted that the precision for predicting a real website is higher
Comparative Analysis of Machine Learning Algorithms … 891

Table 3 SVC classification

Precision Recall F1
report
1 0.920 0.898 0.909
0 0.895 0.917 0.906

while the recall for predicting a phishing website is higher. The F1 scores are similar.
F1 score was compared to other algorithms to find the optimal one.
Table 4 represents the classification report of the non-uniform support vector
classifier. The precision and recall for predicting a real website are 0.897 and 0.851.
These scores were used to calculate the F1 score for predicting a real website which is
0.874. Similarly, the precision and recall for predicting a phishing website are 0.851
and 0.896. Using these both, the F1 score was measured for predicting a phishing
website which is 0.873. The scores for these are significantly lower than support
vector machine.
Table 5 presents the classification report of the linear support vector classifier. The
precision and recall for predicting a real website are 0.900 and 0.970. These scores
were used to calculate the F1 score for predicting a real website which is 0.933.
Similarly, the precision and recall for predicting a phishing website are 0.965 and
0.885. Using these both scores, the F1 score was measured for predicting a phishing
website that is 0.923. The F1 scores in here are significantly higher than support
vector classifier.
Table 6 represents the classification report of KNN. The precision and recall for
predicting a real website are 0.854 and 0.905. These scores were used to calculate
the F1 score for predicting a real website which is 0.879. Similarly, the precision
and recall for predicting a phishing website are 0.893 and 0.836. Using these both,
the F1 score is measured for predicting a phishing website is 0.864. The F1 scores
in here are significantly lower than linear support vector classifier.

Table 4 Nu-SVC
Precision Recall F1
classification report
1 0.897 0.851 0.874
0 0.851 0.896 0.873

Table 5 Linear SVC

Precision Recall F1
classification report
1 0.900 0.970 0.933
0 0.965 0.885 0.923

Table 6 KNN classifier

Precision Recall F1
classification report
1 0.854 0.905 0.879
0 0.893 0.836 0.864
892 D. Sarma et al.

Table 7 Logistic regression

Precision Recall F1
classification report
1 0.897 0.898 0.898
0 0.892 0.891 0.892

Table 8 Logistic regression

Precision Recall F1
CV classification report
1 0.937 0.948 0.942
0 0.944 0.932 0.938

Table 7 presents the classification report of logistic regression. The precision and
recall for predicting a real website are 0.897 and 0.898. These scores are used to
calculate the F1 score for predicting a real website which is 0.878. Similarly, the
precision and recall for predicting a phishing website are 0.892 and 0.891. Using
these both, the F1 score is measured for predicting a phishing website is 0.892. The
precision, recall, and F1 scores for both 1 and 0 are remarkably close to each other
indicating that this algorithm works well for both precision and recall. However, the
F1 scores are still lower than linear SVC, so it cannot be considered as the best one.
Table 8 presents the classification report of logistic regression CV, where CV
stands for cross-validation. The precision and recall for predicting a real website are
0.937 and 0.948. These scores were used to calculate the F1 score for predicting a real
website which is 0.942. Similarly, the precision and recall for predicting a phishing
website are 0.944 and 0.932. Using these both scores, the F1 score was measured for
predicting a phishing website which is 0.938. The precision, recall, and F1 scores for
both 1 and 0 are remarkably close to each other, indicating that this algorithm works
well for both precision and recall. The F1 scores in here were better than linear SVC
so this is the best score so far.
Table 9 presents the classification report of stochastic gradient descent (SGD). The
precision and recall for predicting a real website are 0.966 and 0.826. These scores
were used to calculate the F1 score for predicting a real website which is 0.891.
Similarly, the precision and recall for predicting a phishing website are 0.841 and
0.969. Using these both scores, the F1 score was measured for predicting a phishing
website which is 0.900. The F1 scores in here were lower than logistic regression
CV so it was also rejected.
Table 10 represents the classification report of random forest classifier. The preci-
sion and recall for predicting a real website are 0.977 and 0.984. These scores were
used to calculate the F1 score for predicting a real website which is 0.980. Similarly,
the precision and recall for predicting a phishing website are 0.983 and 0.975. Using

Table 9 SGD classifier

Precision Recall F1
classification report
1 0.966 0.826 0.891
0 0.841 0.969 0.900
Comparative Analysis of Machine Learning Algorithms … 893

Table 10 Random forest

Precision Recall F1
classifier classification report
1 0.977 0.984 0.980
0 0.983 0.975 0.979

Table 11 Bagging classifier

Precision Recall F1
classification report
1 0.972 0.977 0.974
0 0.975 0.971 0.973

Table 12 Extra trees

Precision Recall F1
classifier classification report
1 0.984 0.979 0.982
0 0.978 0.984 0.981

these both scores, the F1 score was measured for predicting a phishing website which
is 0.979. Here, the precision, recall, and F1 scores are remarkably high than all the
other models. Hence, this is considered the best one yet.
Table 11 presents the classification report of bagging classifier. The precision and
recall for predicting a real website are 0.972 and 0.977. These scores were used to
calculate the F1 score for predicting a real website which is 0.974. Similarly, the
precision and recall for predicting a phishing website are 0.975 and 0.971. Using
these both scores, the F1 score was measured for predicting a phishing website is
0.973. Here, the precision, recall, and F1 scores are remarkably high than all the
other models except random forest classifier.
Table 12 represents the classification report of extra trees classifier. The precision
and recall for predicting a real website are 0.984 and 0.979. These scores were used
to calculate the F1 score for predicting a real website which is 0.982. Similarly, the
precision and recall for predicting a phishing website are 0.978 and 0.984. Using
these both, the F1 score was measured for predicting a phishing website is 0.981.
Here, the precision, recall, and F1 scores are the highest, and this is the best score of
all.
It is to be noticed from the above classification reports (Table 13) that all the
classifiers under random forest did remarkably well for detecting phishing websites
and real websites.

5 Conclusion

This study went in great detail and an in-depth explanation of machine learning
techniques and their performances when used against a dataset, containing data
regarding websites, in order to detect phishing websites. This technique is not
894 D. Sarma et al.

Table 13 Comparative classification report

Classifier Precision Recall F1
SVC 1 0.920 0.898 0.909
0 0.895 0.917 0.906
Nu-SVC 1 0.897 0.851 0.874
0 0.851 0.896 0.873
Linear SVC 1 0.900 0.970 0.933
0 0.965 0.885 0.923
KNN 1 0.854 0.905 0.879
0 0.893 0.836 0.864
Logistic regression 1 0.897 0.898 0.898
0 0.892 0.891 0.892
Logistic regression CV 1 0.937 0.948 0.942
0 0.944 0.932 0.938
SGD 1 0.966 0.826 0.891
0 0.841 0.969 0.900
Random forest 1 0.977 0.984 0.980
0 0.983 0.975 0.979
Bagging 1 0.972 0.977 0.974
0 0.975 0.971 0.973
Extra trees 1 0.920 0.898 0.909
0 0.895 0.917 0.906

commonly described in great detail in this paper but also showed how each of the
models performs by using plotted charts to demonstrate and compare each individual
algorithms.
This report aims to be useful to its readers to provide a conclusive analysis of
these methods and to verify our observations regarding random forest classifier’s
optimal performance. The graphs and details that were added to this paper aimed
to help others to carry out further experimentation progressing from where it was
concluded.
It is intended to carry on the proposed research work with further modifications to
the dataset and applies other machine learning techniques with modified parameters
to hopefully open more possibilities in improving the global defense against the
cyber attackers.
Comparative Analysis of Machine Learning Algorithms … 895

References

1. Da Silva JAT, Al-Khatib A, Tsigaris P (2020) Spam e-mails in academia: issues and costs.
Scientometrics 122:1171–1188
2. Mironova SM, Simonova SS (2020) Protection of the rights and freedoms of minors in the
digital space. Russ J Criminol 14:234–241
3. Sethuraman SC, Vijayakumar V, Walczak S (2020) Cyber attacks on healthcare devices using
unmanned aerial vehicles. J Med Syst 44:10
4. Tuan TA, Long HV, Son L, Kumar R, Priyadarshini I, Son NTK (2020) Performance evaluation
of Botnet DDoS attack detection using machine learning. Evol Intell 13:283–294
5. Azeez NA, Salaudeen BB, Misra S, Damasevicius R, Maskeliunas R (2020) Identifying
phishing attacks in communication networks using URL consistency features. Int J Electron
Secur Digit Forensics 12:200–213
6. Iwendi C, Jalil Z, Javed AR, Reddy GT, Kaluri R, Srivastava G, Jo O (2020) KeySplitWater-
mark: zero watermarking algorithm for software protection against cyber-attacks. IEEE Access
8:72650–72660
7. Liu XW, Fu JM (2020) SPWalk: similar property oriented feature learning for phishing
detection. IEEE Access 8:87031–87045
8. Parra GD, Rad P, Choo KKR, Beebe N (2020) Detecting internet of things attacks using
distributed deep learning. J Netw Comput Appl 163:13
9. Tan CL, Chiew KL, Yong KSC, Sze SN, Abdullah J, Sebastian Y (2020) A graph-theoretic
approach for the detection of phishing webpages. Comput Secur 95:14
10. Anwar S, Al-Obeidat F, Tubaishat A, Din S, Ahmad A, Khan FA, Jeon G, Loo J (2020)
Countering malicious URLs in internet of things using a knowledge-based approach and a
simulated expert. IEEE Internet Things J 7:4497–4504
11. Ariyadasa S, Fernando S, Fernando S (2020) Detecting phishing attacks using a combined
model of LSTM and CNN. Int J Adv Appl Sci 7:56–67
12. Bozkir AS, Aydos M (2020) LogoSENSE: a companion HOG based logo detection scheme
for phishing web page and E-mail brand recognition. Comput Secur 95:18
13. Gupta BB, Jain AK (2020) Phishing attack detection using a search engine and heuristics-based
technique. J Inf Technol Res 13:94–109
14. Sonowal G, Kuppusamy KS (2020) PhiDMA—a phishing detection model with multi-filter
approach. J King Saud Univ Comput Inf Sci 32:99–112
15. Zamir A, Khan HU, Iqbal T, Yousaf N, Aslam F, Anjum A, Hamdani M (2020) Phishing web
site detection using diverse machine learning algorithms. Electron Libr 38:65–80
16. Rodriguez GE, Torres JG, Flores P, Benavides DE (2020) Cross-site scripting (XSS) attacks
and mitigation: a survey. Comput Netw 166:23
17. Das A, Baki S, El Aassal A, Verma R, Dunbar A (2020) SoK: a comprehensive reexamination
of phishing research from the security perspective. IEEE Commun Surv Tutor 22:671–708
18. Adewole KS, Hang T, Wu WQ, Songs HB, Sangaiah AK (2020) Twitter spam account detection
based on clustering and classification methods. J Supercomput 76:4802–4837
19. Rao RS, Vaishnavi T, Pais AR (2020) CatchPhish: detection of phishing websites by inspecting
URLs. J Ambient Intell Humaniz Comput 11:813–825
20. Shabudin S, Sani NS, Ariffin KAZ, Aliff M (2020) Feature selection for phishing website
classification. Int J Adv Comput Sci Appl 11:587–595
21. Raja SE, Ravi R (2020) A performance analysis of software defined network based prevention
on phishing attack in cyberspace using a deep machine learning with CANTINA approach
(DMLCA). Comput Commun 153:375–381
22. Sarma D (2012) Security of hard disk encryption. Masters Thesis, Royal Institute of Technology,
Stockholm, Sweden. Identifiers: urn:nbn:se:kth:diva-98673 (URN)
23. Alqahtani H et al (2020) Cyber intrusion detection using machine learning classifica-
tion techniques. In: Computing science, communication and security, pp 121–31. Springer,
Singapore
896 D. Sarma et al.

24. Hossain S, et al (2019) A belief rule based expert system to predict student performance under
uncertainty. In: 2019 22nd international conference on computer and information technology
(ICCIT), pp 1–6. IEEE
25. Ahmed F et al (2020) A combined belief rule based expert system to predict coronary artery
disease. In: 2020 international conference on inventive computation technologies (ICICT), pp
252–257. IEEE
26. Hossain S et al (2020) A rule-based expert system to assess coronary artery disease under uncer-
tainty. In: Computing science, communication and security, Singapore, pp 143–159. Springer,
Singapore
27. Hossain S et al (2020) Crime prediction using spatio-temporal data. In: Computing science,
communication and security. Springer, Singapore, pp 277–289