## 3 Materials and Methods
### Performance Metrics  
We utilized five different performance metrics, including accuracy, precision, recall, F1-score, and classification time, to assess the effectiveness of phishing detection approaches [5; 6]. These metrics are essential for understanding the strengths and weaknesses of a model in differentiating between the positive (phishing) and negative (legitimate) classes as well as attack detection speed.  
Accuracy, precision, recall, and F1-score are calculated based on the four possible outcomes of a detection model's predictions: true positive (TP), false positive (FP), true negative (TN), and false negative (FN). TPs correspond to the instances where the model correctly predicts the positive class. Hence, in the context of phishing website detection, a true positive occurs when the model correctly identifies a website as phishing, and indeed, the website is a phishing site. FPs correspond to the instances where the model incorrectly predicts the positive class. In other words, a false positive occurs when the model mistakenly identifies a legitimate website as phishing. TNs are the outcomes where the model correctly predicts the negative class. A true negative occurs when the model correctly identifies a website as legitimate, and indeed, the website is a legitimate one. FNs are the outcomes where the model incorrectly predicts the negative class. In other words, a false negative occurs when the model fails to identify a phishing website and incorrectly classifies it as legitimate.  
Accuracy is a fundamental metric that gauges the overall correctness of a classification model. It quantifies the ratio of correctly predicted instances (both true positives and true negatives) to the total number of instances in the dataset, as formulated in (1). A high accuracy indicates a model's ability to make correct predictions across both positive (phishing) and negative (legitimate) instances.  
\[\text{Accuracy}=(\text{TP}+\text{TN})/(\text{TP}+\text{TN}+\text{FP}+\text{ FN}) \tag{1}\]  
Precision measures the accuracy of the positive predictions made by a model. It quantifies the ratio of true positive predictions to the total number of instances predicted as positive (both true positives and false positives), as formulated in Equation (2). Precision is particularly relevant, as it assesses the model's ability to avoid misclassifying legitimate websites as phishing. A high precision value implies a low false positive rate.  
\[\text{Precision}=\text{TP}/(\text{TP}+\text{FP}) \tag{2}\]  
Recall, also known as sensitivity or the true positive rate, evaluates the model's capacity to identify all positive instances in the dataset. It measures the ratio of true positive predictions to the total number of actual positive instances (both true positives and false negatives), as formulated in Equation (3). A high recall is crucial, as it indicates the model's effectiveness in capturing a significant portion of actual phishing instances, minimizing false negatives.  
\[\text{Recall}=\text{TP}/(\text{TP}+\text{FN}) \tag{3}\]The F1 score is the harmonic mean of precision and recall, providing a balanced evaluation of a model's performance, as formulated in Equation (4). It addresses situations where high precision and high recall are both desired. The F1 score is particularly relevant, where achieving a balance between accurately identifying phishing websites and minimizing false positives is crucial.  
\[\text{F1 score}=(\text{2}\cdot\text{Precision}\cdot\text{Recall})/(\text{ Precision}+\text{Recall}) \tag{4}\]  
The final performance metric, classification time, simply refers to the duration (in seconds) it takes for a classifier to predict the category of a new instance (website) after it has been trained on a given dataset.