# A Decision-Fusion-Based Ensemble Approach for Malicious Websites Detection
## 3 Materials and Methods
### Methodology of Proposed Approach
#### 3.2.1 Gradient-Boosting (GB) Classifier Method
The weighted soft-voting rule can produce the score of a class based on the probability score of each classifier multiplied by its weight. The weighted soft-voting rule works well if the combined classifiers solve different problems, such as over-fitting and class-imbalance problems, or the problem that occurs when data have statistical noise [52]. We can calculate the weighted majority voting rule related to the weight \(w_{i}\) of classifier \(C_{i}\) as follows:

\[\hat{y}=arg\max_{j}\sum_{i=1}^{m}w_{i}f_{j}(x) \tag{1}\]

where \(f_{j}\) is a decision boundary function, written as \(f_{j}(x)=C_{i}(x)=j\in L\), and \(L\) is a set of unique labels for classes. In the case of binary classification for malicious and benign website detection, the class label \(j\in\{0,1\}\) is used, in which class 0 denotes a benign website and 1 a malicious website. Additionally, we assume that the probability classification scores attained by the three ensemble classifiers (GB, XGB, RF) to classify an example \(x\) are:

\[GB(x)=[f_{0,1},\ f_{1,1}] \tag{2}\]

\[XGB(x)=[f_{0,2},\ f_{1,2}] \tag{3}\]

\[RF(x)=[f_{0,3},\ f_{1,3}] \tag{4}\]

By using the weights \(w_{j}\) and the default values of the classifiers' hyper-parameters, the average probability classification scores are computed as:

\[f(l=0,x)=f_{0,1}*w_{1}+f_{0,2}*w_{2}+f_{0,3}*w_{3} \tag{5}\]

\[f(l=1,x)=f_{1,1}*w_{1}+f_{1,2}*w_{2}+f_{1,3}*w_{3} \tag{6}\]

\[\hat{y}=arg\max_{l}\left[f(l=0,x),\ f(l=1,x)\right] \tag{7}\]

The value of \(\hat{y}\) is the final classification result of malicious and benign website detection for the proposed DFEL model. To train and evaluate the DFEL model, holdout and 10-fold cross-validation techniques are used. In the holdout technique, the dataset is randomly divided into two sets: a training set (70%) and test set (30%). The training set is utilized to build the model and the test set is applied to evaluate the model. For the 10-fold cross-validation technique, the dataset is divided into 10 sets, and the model is trained and evaluated in 10 iterations. In each iteration, one set is applied for testing and the other nine sets are used for training. The output of this step is a trained DFEL model. #### 3.3.3 Data Classification

This step is a part of deployment phase in which the trained model can be used for testing on unseen examples. It depends on the previous supervised learning step. The input is the trained model and the test sets of the holdout and 10-fold cross-validation techniques. The trained model can identify the class of new instances, based on the training data, into \"malicious\" or \"benign\" websites. Figure 3 illustrates the data classification step. Figure 3: Flowchart of the data classification step. In Figure 3, the test instances are pre-processed and classified using GB-, XGB-, and RF-trained classifiers. After that, the classification score of each classifier is weighted using its corresponding weight and summed together with the weighted scores of the other classifiers to form the classification label of the trained DFEL model. #### 3.3.4 Model Evaluation

The goal of model evaluation is to measure how well the model performs the task. This is an essential step in the development process of machine learning models. Model evaluation can aid in determining the best model that can be represented and its performance in the future. In the training process, evaluating the performance of models in this training set is not acceptable because they can easily produce accurate and over-fitted results. In the machine learning field, there are two techniques for evaluating models: hold-out and the 10-fold cross-validation technique. To avoid over-fitting, both techniques evaluate the model's performance using an unseen test set. In the holdout technique, the dataset is randomly divided into training and test sets. The training set is utilized to build models and the test set is used to assess the performance of the developed model.