# Phishing Webpage Classification via Deep Learning-Based Algorithms: An Empirical Study
## 3 Research Methodology
### Deep Learning Models
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Type** & **No** & **Feature** & **Name** & **Description** & **Value** \\ \hline \multirow{8}{*}{Address bar-based} & 1 & IP address & UsingIP & Having IP address in URL & \(-1,1\) \\  & 2 & URL length & LongURL & LongURL to hide the suspicious part & \(-1,0,1\) \\  & 3 & Shorting service & ShortURL & Using URL shortening services “TinyURL” & \(-1,1\) \\  & 4 & @ Symbol & Symbol@ & URL’s having @ symbol & \(-1,1\) \\  & 5 & \({}^{*}//^{*}\) redirecting & Redirecting// & Having “//” within URL path for directing & \(-1,1\) \\  & 6 & Prefix suffix & Prefix suffix & Adding prefix or suffix separately by (-) to the domain & \(-1,1\) \\  & 7 & Sub domain & Sub Domains & Sub domain and multi sub domain & \(-1,0,1\) \\  & 8 & SSL final state & HTTPS & Existence of HTTPS and validity of the certificate & \(-1,0,1\) \\  & 9 & Domain registration & DomainRegLen & Expiry date of domains/Domain registration length & \(-1,1\) \\  & 10 & Favicon & Favicon loaded from a domain & \(-1,1\) \\  & 11 & Port & NonStdPort & Using non-standard port & \(-1,1\) \\  & 12 & HTTPS token & HTTPSDomainURL & The existence of HTTPS token in the domain part of URL & \(-1,1\) \\  & 13 & Request URL & RequestURL & Request URL within a webpage/Abnormal request & \(-1,1\) \\  & 14 & URL of anchor & AnchorbURL & URL within \(<\)zqs /Abnormal anchor & \(-1,0,1\) \\  & 15 & Links in tags & LinksInScriptTags & Links in \(<\)Metaz, \(<\)Scriptp- and \(<\)Link-tags & \(-1,0,1\) \\  & 16 & SFH & ServerFormHandler & Server Form Handler & \(-1,0,1\) \\  & 17 & Email & InfoEmail & Submitting information to E-mail & \(-1,1\) \\  & 18 & Abnormal URL & AbnormalURL & Host name is included in the URL/Whois & \(-1,1\) \\  & 19 & Redirecting & WebsiteForwarding & Number of times a website has been redirected & \(0,1\) \\ \multirow{2}{*}{HTML and JavaScript-based} & 20 & On mouseover & StatusBarCast & On mouse over changes status bar/Status bar & \(-1,1\) \\  & 21 & Right click & DisableRightClick & Disabling right click & \(-1,1\) \\  & 22 & Pop-up window & UsingPopupWindow & Using Pop-up window & \(-1,1\) \\  & 23 & Iframedetection & Iframedetection & Using Iframe & \(-1,1\) \\  & 24 & Age of domain & AgreedDomain & Minimum age of a legitimate domain is 6 months & \(-1,1\) \\  & 25 & DNS record & DNSRecording & Existence of DNS record for the domain & \(-1,1\) \\  & 26 & Website traffic & WebsiteTraffic & Being among top 100,000 in Alexa rank & \(-1,0,1\) \\ \multirow{2}{*}{Domain-based} & 27 & Page rank & PageRank & Having a page rank greater than \(0.2\) & \(-1,1\) \\  & 28 & Google index & GoogleIndex & Website indexed by Google & \(-1,1\) \\  & 29 & Link reference & LinksPoitingToPage & Number of links pointing to a page & \(-1,0,1\) \\ \multirow{2}{*}{30} & \multirow{2}{*}{Statistical report} & \multirow{2}{*}{StatsReport} & \multirow{2}{*}{Top 10 domain and top 10 lps from PhishTank} & \(-1,1\) \\  & & Result & class & Phishing or legitimate & \(-1,1\) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: List of phishing website features. traditional neural network that uses extracted features from previous layers to perform the final classification task [29]. To avoid overfitting problems, batch normalization and dropout strategies are used between CNN layers (Figure 4b). ReLU is utilized as an activation function in the convolutional and FC layers, while sigmoid is implemented in the output layer. LSTM. LSTM is a variant of RNN which involves memory cell structure. The memory cell of a typical LSTM unit is comprised of three gates: an input gate, a forget gate, and an output gate [10]. Unlike a feedforward neural network, the output of a neuron in LSTM architecture at a particular instant can become input to the same neuron. There can be more than one LSTM layer in the LSTM-based phishing detection model, in which a dropout function is used in one layer after another to prevent overfitting issues as illustrated in Figure 5a.