# Detection of Malicious Websites Using Symbolic Classifier
## 2 Materials and Methods
### Dataset Description and Preparation
#### 2.2.2 Statistical Data Analysis  
After the necessary transformations were made, the dataset was obtained which will be used in later investigations. Here, the results of statistical and correlation analysis were performed. The results of the initial statistical analysis are shown in Table 4. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Network Class** & **Range** & **Network Address** & **Host Address** \\ \hline A & 0–127 & xxx & xxx.xxx.xxx \\ \hline B & 128–191 & xxx.xxx & xxx.xxx \\ \hline C & 192–223 & xxx.xxx.xxx & xxx \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The division and available numbers range of IP Addresses [28]. In Table 4, besides the results of the statistical analysis, the symbols of the variables that will be used in GPSC are also presented. Since the GPSC algorithm is used to detect malicious websites in all these investigations the output (target) variable will be \"label\" (\(y\)). The remaining 10 variables in the dataset are labeled with \(X_{i}\) where \(i\) is in the range from 0 to 9. Regarding the results of statistical analysis, every dataset variable has different mean and standard deviation values with different ranges between the minimum and maximum values so the scaling/normalizing techniques should be applied. However, an initial investigation without any scaling/normalizing techniques showed that symbolic expressions with high classification accuracy were obtained so the implementation of scaling/normalizing techniques was omitted from further investigation. To investigate the relationship between input and output variables, we will perform Pearson's correlation analysis [29]. Pearson's correlation analysis values are between \(-1\) and \(1\). If the correlation value between the input variable and output variable is equal to \(-1\) this means that the value of the input variable increases the value of the output variable decreases and vice versa. In case the correlation value between the input and output variable is equal to \(1\) this means that if the value of the input variable increases the value of the output variable also increases and vice versa. The worst possible correlation value between the input and output variable is \(0\) which means that if the value of the input variable increases or decreases it will not have any effect on the output variable. The best ranges of Pearson's correlation value are between \(-1.0\) to \(-0.5\) and \(0.5\) to \(1.0\). The worst range of the correlation value is between \(-0.5\) to \(0.5\). The result of Pearson's correlation analysis performed on the original dataset is shown in Figure 2.  
From Figure 2 it can be noticed that the highest positive correlation values with target (output) variable \"label\" (\(y\)) have input variables \"who_is\" (\(X_{3}\)), \"js_len\" (\(X_{5}\)), \"js_obf_len\" (\(X_{6}\)), \"special_char\" (\(X_{8}\)), and \"content_len\" (\(X_{9}\)). The highest negative correlation value with the target (output) variable \"label\" (\(y\)) is achieved with \"https\" (\(X_{4}\)) as the input variable. The correlation analysis showed that the output (target) variable \"label\" (\(y\)) does not have any correlation with \"url_len\" (\(X_{0}\)), \"geo_loc\" (\(X_{1}\)), \"td\" (\(X_{2}\)), and \"net_type\" (\(X_{7}\)) input variables. However, in the GPSC algorithm, all input variables will be used. From conducted correlation analysis it can be concluded that the most influential indicators of malicious/benign websites are: information provided on the Whols website about the website, JavaScript code embedded in HTML website, JavaScript code obfuscated in HTML website, special characters and content length of website description, and is the website url under https protocol or not. The length of url, geographic location, top-level domain, and net type extracted from the website IP address do not have any influence on the target variable.