# Convolutional Graph Network-Based Feature Extraction to Detect Phishing Attacks
## 4 Experiments
### Results and Discussion  
We assessed our presented model's performance applying a PhishGNN set of data. The achieved outcomes were compared to the same models in this study. Our model obtained 93.52%, 90.78%, 97.00%, and 93.78% in terms of the accuracy, precision, recall, and F-score, respectively. In Table 3, we illustrate the outcomes reported in this study for some phishing diagnosis models applied in the assessment. For assessing the presented strategy's performance, we compared it with seven baseline and state-of-the-art techniques, such as GATConv [42], LightGBM [40], and EHRGCN [41]. In comparison to the last study, which achieved their ham and phishing emails from the PhishGNN dataset, our enhanced model performed better than the last outcomes of the study for accuracy. By evaluating the confusion matrix in Figure 2, we discovered that 97% of positive cases were correctly sorted as positive cases, while 75.40% of negative cases were correctly grouped. Our model was able to correctly distinguish between actual and suspected phishing nodes. However, there is a 24.60% chance of misclassifying normal nodes as phishing nodes since their network structure is similar to that of phishing nodes. The receiver operating characteristic curves (ROCs) are shown in Figure 3. These demonstrate the classification performance of the proposed model. The area under the ROC curve (AUC) value is 0.94, indicating a great classification model. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Method** & **Accuracy** & **Precision** & **Recall** & **F-Score** \\ \hline LightGBM [40] & 63.25\% & 75.23\% & 16.25\% & 26.73\% \\ EH-GCN [41] & 87.30\% & 87.48\% & 89.00\% & 88.40\% \\ GATConv [42] & 92.50\% & 95.70\% & 90.40\% & 93.00\% \\ Proposed model & 93.52\% & 90.78\% & 97.00\% & 93.78\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Classification performances of different methods. As illustrated in Figure 4, in the chosen feature relation matrix, some of the features illustrate higher relation degrees that put their significance in the diagnosis process of phishing into perspective. For instance, features like Feature_1, Feature_7, and Feature_5 show average to high relations with other features, showing that they obtained basic dataset relations. The higher-relation features, especially those that are related positively, might show crucial phishing attack natures like specific technical markers/user communications that are important for recognizing potential phishing attempts. In other words, less related features, like Feature_22 or Feature_18, might obtain independent/single information which could develop the model performance by decreasing the feature set redundancy. Figure 3: ROC curves of the proposed model: (**a**) training; (**b**) testing. Figure 2: Confusion matrix for classification results: (**a**) training; (**b**) testing. Features like Feature_1, Feature_7, and Feature_5 have moderate to high levels of association with other features. These features characterize the dataset's underlying linkages and are important for identifying phishing-related actions. Features with high positive correlations may indicate certain technical signs or user activities that are frequently seen in phishing attacks. In convolutional graph network models, these features serve as pivot nodes, collecting information from nearby nodes to increase the data-embedding quality. In contrast, characteristics like Feature_18 and Feature_22, which have fewer links with other features, provide independent and non-repetitive data. These features can reduce the dataset redundancy while also improving the model performance. The independent information provided by these qualities is particularly useful for detecting unknown or complex attacks with more diversified data. These qualities retain the diversity of the data and improve the model's generalizability. Features with stronger correlations (such as Feature_1) play an important role in distinguishing between phishing attacks and non-phishing actions.