# Detection of Malicious Websites Using Symbolic Classifier
## 2 Materials and Methods
### Genetic Programming--Symbolic Classifier
The size of the hoist mutation operation in the gplearn library is defined by setting the value of hyperparameter **p_hoist_mutation**. In point mutation, the random nodes are selected on the winner of the tournament selection. The constants and variables are replaced with randomly chosen constants from the primitive set. The functions are also replaced with randomly chosen functions however the newly chosen function must have the same number of arguments as the original function. The size of the point mutation is defined by setting the value of hyperparameter **p_point_mutation**. The sum of all these genetic operations must be equal to 1. If the sum is less than 1 then the balance of genetic operations shall fall back on reproduction, i.e., the tournament winners are cloned and enters the next generation unmodified. The evolution of symbolic expressions is propagated until the value of hyperparameter **stopping_criteria** is reached or the maximum number of **generations** is reached. The maximum number of generations is self-explanatory and usually, this is the dominating hyperparameter for stopping GP execution. The **stopping_criteria** is the minimum value of the fitness function and if one of the population members reaches this value the execution of GP is terminated. To the size of sub-samples from training, the dataset can be defined with hyperparameter **max_samples** to get more diverse looks at individual symbolic expressions from smaller portions of the data. If **max_samples** value is set to 1, then no subsampling is shown. If the value is set below 1 then during the execution of GP the out-of-bag (OOB) fitness value is shown. For a good evolution process, the value of OOB of the best symbolic expression should be near the true fitness function value. Another important hyperparameter in GP Symbolic classifier is the **parsimony_coefficient** value which is responsible for preventing the bloat phenomenon. During the execution of GP, it can happen that the size of symbolic expressions can rapidly increase from generation to generation without any benefit in lowering the fitness value. This can result in time-consuming GP execution with low classification accuracy or in memory overflow which would terminate GP execution without any solution. This rise of population members without any benefit to fitness function value is called the bloat phenomenon. However, this problem can be solved by implementing the parsimony coefficient value to the fitness function value and by doing so making the large program unfavorable for winning the tournament selection. The value of this parameter has to be finely tuned, i.e., if the value is too large it will choke the evolution process (population members will not evolve), and if the value is too small the bloat can happen very quickly. The list of previously described hyperparameters and their range that was used in this investigation is shown in the following subsection (Table 7). The Advantages and Disadvantages of GPSC Algorithm  
Each of the ML or deep learning algorithms has its advantages and disadvantages so does the GPSC algorithm. According to [37] the advantages of GPSC, as well as the GP algorithm, are:  
* For any dataset with defined input variables and the target variable the GPSC will try during its execution to connect input variables with the target variable in a form of symbolic expression (mathematical equation);
* The obtained symbolic expressions are sometimes easier to understand and use than complex ML models;
* It is not necessary for an individual to have absolute knowledge of the problem and its solutions. The disadvantages of the GPSC algorithm are:* The dataset size has some influence on GPSC performance. The larger the dataset the more memory is required to calculate the output of each population member;
* The correlation between some input variables and target (output) variable has to be high (Pearsons or Spearman correlation value in range \(-1.0\) to \(-0.5\) and \(0.5\) to \(1.0\)).