# Detection of Malicious Websites Using Symbolic Classifier
## 4 Discussion  
In the case of the classic train/test approach of the GPSC algorithm using seven different dataset variations the obtained \(\overline{ACC}\), \(\overline{AUC}\), \(\overline{Precision}\), \(\overline{Recall}\), and \(\overline{F1\text{-}score}\) are all above 0.97 which is pretty high. Looking at Figure 2 it can be noticed that several variables, i.e., content_len, special_char, js_len, js_obf_len, HTTPS, and who_is variables have a high correlation (lowest negative correlation: \(-0.7\), and highest positive correlation range: 0.7-0.9) to the target variable (\"label\"). So the high \(\overline{ACC}\), \(\overline{AUC}\), \(\overline{Precision}\), \(\overline{Recall}\), and \(\overline{F1\text{-}score}\) of symbolic expression in the case of the original dataset can be attributed to the high correlation between several input variables and the desired output variable. Looking at Tables 9 and 11, the difference between train/test scores, i.e., standard deviation is the largest in the case of the original dataset. Regarding random oversampling and undersampling datasets, the \(\overline{ACC}\), \(\overline{AUC}\), \(\overline{Precision}\), \(\overline{Recall}\), and \(\overline{F1\text{-}score}\) are almost the same. The only benefit of using random undersampling is that the dataset has a lower number of samples which can easily be used in training and testing the GPSC algorithm since it requires less memory. From all other oversampling methods (ADASYN, SMOSTE, BorderlineSMOTE, and KmeansSMOTE) the highest result is achieved in the case of KmeansSMOTE and the lowest score in the case of the ADASYN dataset. Standard deviation between training/test in the case for all symbolic expressions obtained with oversampling dataset methods is virtually nonexistent which means that scores between training and testing are almost the same. When compared to the standard deviation of the symbolic expression obtained on the original dataset it can be noticed that oversampling methods have had some influence on the classification accuracy of obtained symbolic expressions since these methods provided balanced datasets. Regarding the hyperparameters used in the classic train/test approach, the crossover is not the dominant genetic operation which is usually the case. Looking at Table 8 for each dataset type the crossover was the dominant coefficient in 3 out of 7 cases. However, the sum of all genetic operations used to obtain the symbolic expression for each dataset is never equal to 1 which means that a small percentage of tournament winners entered the next generation unchanged during GPSC executions. The value of the parsimony coefficient is very small in all cases, i.e., \(10^{-6}\) which could potentially indicate a bloat phenomenon. However, the bloat did not occur since the fitness value was constantly dropping but the size of the symbolic expressions increased which made longer execution times. The value of stopping_criteria was never reached, i.e., in the case of the classic train/test approach with a random hyperparameter search method. All GPSC executions were terminated after a predefined number of generations were reached. GPSC was unable to reach the predefined minimum fitness value (stopping_criteria value) although the obtained results (classification accuracies of obtained symbolic expressions) are exceptional. In the case of GPSC with random hyperparameter search and 5-fold CV the list of hyperparameters is shown in Table 10 and results in Figure 7 and Table 11. The results in Figure 7 and Table 11 showed that the \(\overline{ACC}\), \(\overline{AUC}\), \(\overline{Precision}\), \(\overline{Recall}\), and \(\overline{F1}\)-\(\underline{score}\) values achieved with a symbolic expression that was obtained using this method (GPSC with random hyperparameter search, and 5-fold cross-validation) on the original dataset are slightly higher than in the previous method (GPSC with random hyperparameter search on classic train/test).