# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
In addition, SHAP can also give more perspective on the influences of specific features, whether they are essential or not. To implement this method, we need to calculate the SHAP values that define how each datum influences the entire prediction. SHAP values are the framework that unifies Shapley regression, Shapley sampling, and the quantitative input that influences feature attributions while allowing for connections with LIME [52], DeepLIFT [53], and layer-wise relevance propagation. We can then retrieve information on how high or low feature values can support negative or positive prediction results based on a summary of these values. ## 4 Experimental Setup

This section introduces the experimental setup for our evaluation using a benchmark dataset and explains the best setup for the machine learning model. ### Dataset

We used GAWAIN, a benchmark dataset by [PERSON] et al. [44] intended for malicious webpage detection, to evaluate our proposed model and analysis. This dataset is much more complicated than those used by other studies on malicious webpage detection. We think that this dataset has two main criteria that can be the best options for us to evaluate our new proposed feature, which can be described as follows:

* The inclusion of webpage features that have been proposed in some previous works. Features from related works were also added to better represent a single web page, such as image embedding, content embedding, or two different URL embeddings based on pre-trained word representation (Longformer and BERT). The availability of previous feature categories can help us compare our proposed feature's significant influence among all feature category combinations. * Representative distribution of data. This dataset was constructed so that the distribution between malicious and benign data is more difficult to separate. They believed this condition is closer to the actual scenario where attackers try to imitate the legitimize content as much as possible to evade detection. Table 2 explains the distribution of malicious and benign data in GAWAIN. It contains data for 105,485 webpages, 61,080 of them benign and 44,405 malicious. It provides all existing features that combine previous works with the same topics in malicious webpage and website detection using machine learning. In the current GAWAIN dataset, not all data contain JS for feature extraction. For analysis purposes regarding JS's influence on malicious webpage detection, we separated the data that contained JS from the data that did not. By separating the data, we can know how important this feature is to the model's performance. ### Parameter Setup

We evaluated our proposed approach with experiments that could confirm the ability of AST-JS to improve the performance of malicious webpage detection. The objective of this study was to offer a new feature. We focused more on the addition or non-addition of AST-JS in the system. We still focused on using XGBoost [44] as the main machine \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **Benign** & **Malicious** & **Total** \\ \hline All & 61,080 & 44,405 & 105,485 \\ With JavaScript & 36,443 & 23,923 & 60,366 \\ Without JavaScript & 24,637 & 20,482 & 45,199 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Dataset information. learning model, which was also used in previous work on the same dataset, GAWAIN. In addition, XGBoost gives an advantage when calculating SHAP values [43]. However, we also compared the model to other machine learning models. For more details, Table 3 explains some parameters we used in the experiment. We also used values for some parameters that were different from the original settings in [44]. This is because we used the SHAP method for analysis in the end, which is not applicable for the original setup. We found that our new settings give better results than the original one. For deeper analysis, we performed a clustering experiment on the dataset to label a particular group of webpage types.