# A Decision-Fusion-Based Ensemble Approach for Malicious Websites Detection
## 3 Materials and Methods
### Methodology of Proposed Approach
#### 3.2.1 Gradient-Boosting (GB) Classifier Method
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Name** & **Percentage of Training** **Instances** & **Percentage of Test Instances** \\ \hline Malicious & 87.08\% & 89.72\% \\ Benign & 12.92\% & 10.28\% \\ Total & 100\% & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The distribution of malicious and benign instances in the training and test sets. Figure 7: Confusion matrix of classification results using a DFEL model tested on 30% of the dataset without the highly correlated features,. From Figure 8, we can see that the highly correlated features decrease the number of TP instances to 476 instead of 477 to train the model without highly correlated features. The number of TN instances is not affected. The results of other evaluation metrics are given in Table 4.

In Table 4, the model is shown to achieve a classification result with 98.32% accuracy and a 98.31% weighted avg. F1-score. These results confirm that removing the highly correlated features is necessary for a more accurate classification. Moreover, decreasing the number of features increases the efficiency of the model. Figure 9 shows the average classification time of all test sets in seconds for the model trained on the training set with and without highly correlated features. \begin{table}
\begin{tabular}{c c c c} \hline
**Class Name** & **Precision** & **Recall** & **F1-Score** \\ \hline Malicious & 0.9896 & 0.9917 & 0.9906 \\ Benign & 0.9259 & 0.9091 & 0.9174 \\ Macro avg. & 0.9578 & 0.9504 & 0.9540 \\ Weighted avg. & 0.9831 & 0.9832 & 0.9831 \\ Accuracy & & 98.32\% & \\ \hline \end{tabular}
\end{table} 
Table 4: Results of evaluation metrics for a DFEL model trained with highly correlated features and tested on 30% of the dataset. Figure 8: Confusion matrix of classification results using a DFEL model tested on 30% of the dataset with the highly correlated features. Figure 9: Classification time of all test sets in seconds. In Figure 9, we can see that removing highly correlated features decreases the average classification time of all test sets from 0.031 s to 0.016 s, improving the efficiency of the DFEL model in addition to improving the detection accuracy. Moreover, this average classification time confirms the applicability of the proposed model for real-time detection. Besides, to analyze the ability of the proposed DFEL model compared with its models individually at the 0.5 classification threshold, Figure 10 illustrates the ROC curves of the DFEL model and its other base models. From Figure 10, we can see that the DFEL model outperforms its base models and achieves a 0.95 AUC, compared with a 0.93, 0.94, and 0.93 AUC for GB, XGB, and RF, respectively. The high AUC value for the DFEL model proves its ability to show how much the trained model can differentiate between test set classes. This means that the built model can classify instances of a malicious class as malicious, and instances of a benign class as benign. #### 4.1.2 Evaluation Method 2

This evaluation method trains and validates the proposed decision fusion model and its base models 15 times with 15 splits. Each time, the models are trained on a different number of training examples and validated on 10% of the dataset without highly correlated

Figure 10: ROC curves of the DFEL model and its other base models: (**a**) ROC curve of GB classifier, (**b**) ROC curve of XGB classifier, (**c**) ROC curve of RF classifier, and (**d**) ROC curve of DFEL model. features. Figure 11 demonstrates the learning curves of the DFEL model and its base models. The training and validation scores are compared to the training data examples (data size). From Figure 11, we can see that when fewer than 600 training examples are used, this not enough to allow the trained models to classify the validation set. In addition, we can see that the training accuracy scores for all models are still around the maximum, and the validation scores increase with more training examples.