# Enhancing Phishing Email Detection through Ensemble Learning and Undersampling
## 4 Hybrid Ensemble Learning with Data Undersampling
### FMPED Algorithm  
Suppose that \(\mathcal{D}_{maj}\) represents the majority class training set, \(\mathcal{D}_{min}\) represents the minority class training set, and \(\mathcal{D}\) represents the whole training set. The FMPED algorithm includes three stages. \[D=\mathcal{D}_{maj}\cup\mathcal{D}_{min}. \tag{1}\]  
* Stage 1: Remove the overlapping majority class samples. [PERSON] et al. [36] point out that in imbalanced datasets, the overlapping regions containing majority and minority samples will cause the obtained classifier to deviate from the optimal classifier, resulting in a bias toward the majority class samples, thus leading to misclassification of minority class samples. It is necessary to remove those majority class samples located in overlapping regions before training. Figure 5 displays the overlapping area of the unbalanced dataset. [PERSON] et al. [36] use the squared loss function to compute which majority class samples should be removed and adjust the position of classification boundary by Fisher linear discrimination (FLD) because it requires no hyperparameters. This process is repeated until the G-mean of the retained samples becomes smaller. Figure 4: FMMPED diagram. Generally speaking, machine learning methods such as SVM and FLD obtain classifier hyperplanes that separate the two classes of samples. However, for unbalanced datasets, the classification hyperplanes obtained by these machine learning methods are likely to lie in the overlapping regions of the two types of samples. Therefore, unlike [36], the RMCSPV (removing majority class samples based on predicted value) algorithm removes samples based on the predicted values. The larger predicted value means the corresponding majority class sample may be closer to minority class samples. Moreover, samples are removed from the original majority class sample set, rather than from the set after the previous removal of each iteration. After removing selected samples, RMCSPV trains a classifier and calculates the G-mean value. This process ends when the maximum number of iterations is reached or the G-mean value decreases. This step can be seen as a preprocessing step before undersampling, so it is not necessary to set the maximum number of iterations to a large value. In this paper, we set it to 5. The specific process of RMCSPV is stated as Algorithm 1. All experimental results of RMCSPV are based on \(\theta=0.005\) in this article. Section 5 will discuss the choice of \(\theta\). ```
Input:\(\mathcal{D}_{maj},\mathcal{D}_{min},\mathcal{D},\theta\) Output:\(\hat{\mathcal{D}},\hat{\mathcal{D}}_{maj}\) \(\hat{\mathcal{D}}\leftarrow\mathcal{D},k\gets 1,G_{0}\gets 0\); while\(k\leq 5\)do Get a learning model \(f\) by training FLD with \(\hat{\mathcal{D}}\), and compute G-mean value \(G_{k}\) of the set \(\mathcal{D}\); if\(G_{k}<G_{k-1}\)then break; Remove \(\theta\) percent of samples from \(D_{maj}\) according to the ascending order of the value \(e^{-f(x)}\) and denote it as \(\hat{D}_{maj}\). \(\hat{\mathcal{D}}\leftarrow\hat{D}_{maj}\cup\mathcal{D}_{min}\);
```  
**Algorithm 1**RMCSPV  
Stage 1 only removes a small fraction of the majority samples in the overlapping region, and the factor of imbalance still exists. So, we attempt to undersample the majority samples. Statistical learning theory introduced by [PERSON] [37] indicates that the most \"important\" samples for classification are samples that are close to the classification hyperplane. So, we use Markov sampling to undersample the majority samples, such as in [36]. Different from Markov sampling in [36; 38], the number of samples to be drawn in the Markov undersampling (MUS) algorithm changes dynamically, which eliminates the need for parameter selection. The specific process of the MUS algorithm can be stated as Algorithm 2. All experimental results of MUS are based on \(q=1.3,\hat{n}=3,\hat{n}=5\) in this article. Section 5 will discuss the choices of \(q,\hat{n},\bar{n}\). Figure 5: Overlapping area of unbalanced dataset.