# A Decision-Fusion-Based Ensemble Approach for Malicious Websites Detection
## 3 Materials and Methods
### Benchmark Dataset of Study  
The dataset adopted in this research is available on the Kaggle platform, [[https://www.kaggle.com/datasets/xwolf12/malicious-and-benign-websites](https://www.kaggle.com/datasets/xwolf12/malicious-and-benign-websites)]([https://www.kaggle.com/datasets/xwolf12/malicious-and-benign-websites](https://www.kaggle.com/datasets/xwolf12/malicious-and-benign-websites)) (accessed on 15 June 2023). It is a public dataset. It contains 1781 rows of data instances and 21 columns of variables (features) for benign and malicious websites. The target label is the 'Type' column, which indicates if the example data are for a benign or malicious website. The features of websites, with their data type included in the dataset, are presented in Table 1. Figure 1 demonstrates the number of dataset instances for the benign and malicious classes and their distribution. As shown in Figure 1, the distribution of instances in the dataset is imbalanced, as the malicious class form 87.9% of the total, while 12.1% are benign. \begin{table}
\begin{tabular}{c c c} \hline
**No.** & **Feature** & **Data Type** \\ \hline
0 & URL & object \\
1 & URL\_LENGTH & int64 \\
2 & NUMBER\_SPECIAL\_CHARACTERS & int64 \\
3 & CHARSET & object \\
4 & SERVER & object \\
5 & CONTENT\_LENGTH & float64 \\
6 & WHOIS\_COUNTRY & object \\
7 & WHOIS\_STATEPRO & object \\
8 & WHOIS\_REGDATE & object \\
9 & WHOIS\_UPDATED\_DATE & object \\
10 & TCP\_CONVERSAUTION\_EXCHANGE & int64 \\
11 & DIST\_REMOTE\_TCP\_PORT & int64 \\
12 & REMOTE\_IPS & int64 \\
13 & APP\_BYTES & int64 \\
14 & SOURCE\_APP\_PACKETS & int64 \\
15 & REMOTE\_APP\_PACKETS & int64 \\
16 & SOURCE\_APP\_BYTES & int64 \\
17 & REMOTE\_APP\_BYTES & int64 \\
18 & APP\_PACKETS & int64 \\
19 & DNS\_QUERY\_TIMES & float64 \\
20 & Type & int64 \\ \hline \end{tabular}
\end{table} 
Table 1: Features of the dataset and the data types. During the collection process and analysis of the dataset, features were collected from the network and application layers to enable the use of static and dynamic website characteristics. A description of each feature in the dataset is provided as follows:  
* The URL is a unique identification of the Uniform Resource Locators (URLs), analyzed in the collected dataset. * The 'URL_LENGTH' is the number of characters in the URL. * The 'NUMBER_SPECIAL_CHARACTERS' is the number of special characters in the URL. * The 'CHARSET' is a character set that has a categorical value that represents the character encoding standard. * The 'SEVERY' is a categorical value that represents the server operative system extracted from the packet response. * The 'CONTENT_LENGTH' is the HTTP header content size. * The 'WHOIS_COUNTRY' indicates the country in which the website server is situated. * The 'WHOIS_STATEPRO' represents the location at which the website is registered. * The 'WHOIS_REGDATE' is the registration date of the website server. * The 'WHOIS_UPDATED_DATE' is the date of the last update to the website server. * The 'TCP_CONVERATION_EXCHANGE' counts the number of packets between the honeypot and website using the TCP protocol. * The 'DIST_REMOTE_TCP_PORT' is the total number of ports, rather than those exposed in TCP. * The 'REMOTE_IPS' is the total number of Internet Protocols (IPs) in the connection of the honeypots. * The 'APP_BYTES' is the number of transferred bytes. * The 'SOURCE_APP_PACKETS' is the number of packets that were directed from the honeypot to the server. * The 'REMOTE_APP_PACKETS' is the number of packets that arrived from the server. * The 'SOURCE_APP_BYTES' is the number of bytes that were directed from the honeypot to the server. * The 'REMOTE_APP_BYTES' is the number of bytes that arrived from the server. * The 'APP_PACKETS' is the total number of IP packets produced through the communication between honeypot and server. * The 'DNS_QUERY_TIMES' is the number of DNS packets produced through the communication between honeypot and server.