# Detection of Malicious Websites Using Symbolic Classifier
## 2 Materials and Methods
### Genetic Programming--Symbolic Classifier  
In this paper, all investigations with genetic programming symbolic classifier (GPSC) were performed using the gplearn library [34] in the Python programming language. GPSC starts by creating the initial population of random naive symbolic expressions that are unfit for the particular task and using genetic operations (crossover and mutation) throughout the number of generations to make them fit for particular tasks. The population members in GP are represented as tree structures. For example the equation \(y=\min(X_{1}+X_{2},X_{1}+3\cdot X_{3})\) represented in tree structure form is shown in Figure 4.  
Figure 4: GP syntax tree representing \(y=\min(X_{1}+X_{2},X_{1}+3\cdot X_{3})\). As seen from Figure 4, the **min** is a root node, and the lines connecting **add** functions are called branches. All other elements below the root node are called nodes and the last elements in the tree structure are called leaves (\(X_{1}\), \(X_{2}\), \(3\), \(X_{3}\)). Another important thing regarding tree structure is that the size of the tree is measured by its depth. To build the initial population of symbolic expressions the constant values, functions, and input variables are required. The constant values are specified with hyperparameter **const_range**, i.e., the defined range of constant values before executing GP. During the execution GP randomly takes the constants from that range to create symbolic expressions. The variables are the input columns in the dataset used for training and in the symbolic expression they are represented as (\(X_{1},X_{2},\ldots,X_{n}\)). The functions are defined and stored in **function_set** which is also a hyperparameter defined before the execution of GP. The list of functions used in these investigations is shown in Table 6.  
In Table 6, the numbers in the arity column indicate the number of arguments taken by the mathematical function. The majority of functions shown in Table 6 are already integrated into gpleram library with exception of logarithm with base 2 and 10 and cube root. The definition of these functions had to be modified to avoid errors during the execution. The logarithm with base 2 can be written as:  
\[y= \begin{cases}\log_{2}(x)&\text{if }|x|>0.001,\\ 0&\text{if }|x|<0.001.\end{cases}  \tag{14}\]  
So, in case the absolute value of the argument (\(x\)) is larger than 0.001 then the function will calculate the \(\log_{2}(x)\). However, if the absolute value of the argument is equal to or lower than 0 then the output of \(\log_{2}(x)\) is equal to 0. The function for calculating logarithm with base 10 can be written as:  
\[y= \begin{cases}\log_{10}(x)&\text{if}|x|>0.001,\\ 0&\text{if}|x|<0.001.\end{cases}  \tag{15}\] \begin{table}
\begin{tabular}{c c} \hline \hline
**Function Name** & **Arity** \\ \hline Addition & 2 \\ \hline Subtraction & 2 \\ \hline Multiplication & 2 \\ \hline Division & 2 \\ \hline Minimum & 2 \\ \hline Maximum & 2 \\ \hline Square root & 1 \\ \hline Absolute value & 1 \\ \hline Sine & 1 \\ \hline Cosine & 1 \\ \hline Tangent & 1 \\ \hline Natural logarithm & 1 \\ \hline Logarithm base 2 & 1 \\ \hline Logarithm base 10 & 1 \\ \hline Cube root & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The list of mathematical functions used. The \(\log_{10}\) has a similar definition as the \(\log_{2}(x)\) function. The cube root function can be written as:  
\[y=\sqrt[3]{x}. \tag{16}\]  
It should be noted that \(y\) used in Equations (14)-(16) does not have any connections with the output (target) variable used in this investigation. In GP the primitive set consists of terminals and mathematical functions while terminals consist of dataset variables and a range of constants. The primitive set is used to build the initial population and later in process of genetic operations (crossover and mutation). The size of the initial population is specified with hyperparameter **population_size**. To build the initial population two hyperparameters are required, i.e., **init_method** and the **init_depth**.