# A Decision-Fusion-Based Ensemble Approach for Malicious Websites Detection
## 3 Materials and Methods
### Methodology of Proposed Approach
#### 3.2.1 Gradient-Boosting (GB) Classifier Method
Comprehensively, the 10-fold cross-validation technique is the second evaluation method used to obtain an unbiased estimate of the model performance when there few data are available. The 10-fold cross-validation technique divides the data into 10 sets. Every time, a model is built using nine sets and tested on one set, which is the test set. Model evaluation is performed throughout both experimentation and production. Some technical metrics, such as accuracy, precision, recall, and F1-score, are used to evaluate the proposed model across different testing runs, as well as to compare it with different models. These technical metrics are computed based on the classification confusion matrix. In our methodology, the confusion matrix is 2 \(\times\) 2 for the two classes (malicious, benign). It is generated by the number of correct and incorrect predicted test class values using the classification model in relation to the values of actual test classes. The data in the matrix are widely used to evaluate the performance of such models. The technical metrics obtained from the confusion matrix can be calculated using the equations given below:

\[Accuracy=\frac{(TP+TN)}{(TP+FP+TN+FN)} \tag{8}\]

\[\hat{y}=arg\max_{j}\sum_{i=1}^{m}w_{i}f_{j}(x) \tag{1}\]0

\[\hat{y}=arg\max_{j}\sum_{i=1}^{m}w_{i}f_{j}(x) \tag{1}\]1

\[\hat{y}=arg\max_{j}\sum_{i=1}^{m}w_{i}f_{j}(x) \tag{1}\]2

where TP, TN, FP, and FN are the true positive, true negative, false positive, and false negative cases, respectively. As well as the above metrics, the area under curve (AUC) of the receiver operating characteristic (ROC) is used to evaluate the developed model. The AUC is the probability curve in which the degree of separability between classes is given as one of the key evaluation metrics. It measures the classification performance of machine learning models at different threshold values. By using the False Positive Rate (FPR) against True Positive Rate (TPR), the ROC curve can be plotted with a _x-axis_ and _y-axis_, representing the FPR and TPR, respectively. ## 4 Experiments and Results

This section validates the proposed approach to detect malicious websites. The approach is able to classify malicious websites and benign ones based on the developed decision-fusion-based ensemble classification model. The experiments can be used to obtain the benchmark dataset and evaluation metrics explained in the previous subsections. Two experiments are conducted to validate the research work. The first experiment is executed using the holdout evaluation, in which two evaluation methods are used: evaluation method one (evaluation method 1) divides the dataset into training set (70%), and test set (30%), and evaluation method two (evaluation method 2) executes the training and validation processes for 15 runs with 15 splits. In each split, the models are trained on a different number of training examples and validated on 10% of the dataset. The second experiment is accomplished using a 10-fold cross-validation technique. The 10-fold cross-validation technique divides the dataset into 10 sets. The training process is conducted for 10 runs. In each run, one set is used to test the base and developed models. In both experiments, the model parameters are initialized, along with their default values. The experiments are implemented using the Python programming language on a laptop with Intel processor Core i7-8750H CPU 2.21 GHz, RAM 32.0 GB and 64-bit Windows 11 operating system. Before training the ensemble models, we pre-process the dataset using the pre-processing step. We read it and replace the null values with zeroes to make the null values numeric when training the ensemble models. Then, we determine some basic statistics for the dataset to provide an overview of its feature values. Figure 4 shows the uniqueness and frequency of the dataset feature values. From Figure 4, we can see that the values of the URL feature are totally unique, with very low frequency.