# Towards a Hybrid Security Framework for Phishing Awareness Education and Defense
## 12 Architecture Performance Comparisons
### Results Discussion  
The CNN architecture model was selected due to its overall performance in the evaluation measured and fast training times. The initial CNN architecture model contains multiple layers, and its architecture is explained with reference to the code in Figure 16:  
**Input layer:** The input layer defines the model's input shape. The last dimension, one, denotes that there is only one feature per time step, while the first value shows the number of features in the input data. This is typical for time series or sequence data.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**Architecture** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **Confusion Matrix** & **Execution Time (s)** \\ \hline Bi-RNN & 0.94284 & 0.96712 & 0.93166 & 0.94906 & [67;128 & 2961] & 1886.289 \\  & & & & & [6390 & 87,121] & 1886.289 \\ \hline FNN & 0.925097 & 0.92400 & 0.94682 & 0.93527 & [62;807 & 7282] & 210.8156 \\  & & & & & [4972 & 88,539] & 248.538 \\ \hline GRU & 0.93113 & 0.93312 & 0.94740 & 0.94021 & [63;740 & 6349] & 248.538 \\  & & & & [4918 & 88,593] & 248.538 \\ \hline LSTM & 0.93052 & 0.93429 & 0.94490 & 0.93956 & [63;875 & 6214] & 321.976 \\  & & & & [5152 & 88,359] & 253.741 \\ \hline RNN & 0.92371 & 0.92708 & 0.94049 & 0.93374 & [63;172 & 917] & 253.741 \\  & & & & [5564 & 87,947] & 253.741 \\ \hline
**CNN** & **0.94333** & **0.95843** & **0.94169** & **0.94999** & **[66,270 & **3819**]** & **629.896** \\  & & & & & [**5452** & **88,059**] & **629.896** \\ \hline \end{tabular}
\end{table}
Table 4: Performance Comparisons of Deep Learning Architectures.  
**Conv1D layers:** The convolutional layer utilizes the Rectified Linear Unit (ReLU) activation function and includes filters, each with a kernel size of three. To extract features from the input data, convolutional layers are used.  
**Max-pooling layers:** This layer, which uses max-pooling with a pool size of two, is inserted after the convolutional layer. Max-pooling shrinks the feature maps' spatial size while preserving crucial data.  
**Flatten layer:** This layer transforms the 3D tensor output of the previous layer into a 1D tensor. This step is necessary to connect the convolutional layers to the fully connected layers.  
Figure 16: Initial CNN Architecture Design.  
Figure 15: FNN Architecture Design.  
**Dense layer:** This layer has 128 units, a ReLU activation function, and it is fully linked. Fully connected layers make decisions based on the features that the convolutional layers have extracted.  
**Output layer:** One dense neuron with a sigmoid activation function makes up the output layer. It produces a probability score that ranges from zero to one, which is the usual range for binary classification issues.  
**Model compilation:** The Adam optimizer, a popular option for optimizing neural networks, is used in the model. Binary classification jobs are well suited by the loss function, which is set to Binary Cross-Entropy. The disparity between the expected and real labels is quantified. Accuracy will be reported by the model as a measure to monitor throughout training.  
The number of convolutional and max-pooling layers has been increased to further increase accuracy, as depicted in Table 5. Four convolutional and max-pooling layers have been selected as the accuracy increased minimally with an increase in execution time.  
A dropout layer was placed in between the flatten and dense layers. Randomly changing a portion of the input units to zero during each training stage helps minimize overfitting. It serves as a type of regularization and might motivate the network to learn stronger features. The results of adding the dropout layers with different dropout rates were measured and compared to those without the dropout layer as depicted in Table 6. Not adding a dropout layer still yielded better results but took a longer time to train.