# Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods
## 3 Proposed Method
### Preprocessing
#### 3.1.2 Sample JS Attack Codes
* (16) [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON]; [PERSON] A machine learning approach to detection of JavaScript-based attacks using AST features and paragraph vectors. _Appl. Soft Comput. J._**2019**, _84_, 1-11. [CrossRef]
* (17) [PERSON]; [PERSON]; [PERSON] [PERSON] Deobfuscation, Unpacking, and Decoding of Obfuscated Malicious JavaScript for Machine Learning Models Detection Performance Improvement. _CAAI Trans. Intell. Technol._**2020**, \(5\), 184-192. [CrossRef]* [18] [PERSON]; [PERSON] A targeted web crawling for building malicious javascript collection. In Proceedings of the ACM First International Workshop on Data-Intensive Software Management and Mining (DSMM '09), New York, NY, USA, 6 November 2009; pp. 23-26. [CrossRef]
* [19] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Client-Side Defense against Web-Based Identity Theft. In Proceedings of The 11 th Annual Network and Distributed System Security Symposium (NDSS '04), San Diego, CA, USA, 4-6 February 2004. Available online: [[http://crypto.stanford.edu/SpoofGuard/webspoof.pdf](http://crypto.stanford.edu/SpoofGuard/webspoof.pdf)]([http://crypto.stanford.edu/SpoofGuard/webspoof.pdf](http://crypto.stanford.edu/SpoofGuard/webspoof.pdf)) (accessed on 1 May 2020). * [20] [PERSON]; [PERSON] Behind phishing: An examination of phisher modi operandi. In Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), San Francisco, CA, USA, 14 April 2008. * [21] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Detecting Malware Domains: A Cyber-Threat Alarm System. In Proceedings of the International Conference on Emerging Technologies for Developing Countries, Cotonou, Benin, 29-30 May 2018; Springer International Publishing: Cham, Switzerland, 2018; pp. 181-191. * [22] [PERSON]; [PERSON] Breaking bad: Detecting malicious domains using word segmentation. In Proceedings of the 9 th IEEE Workshop on Web 2.0 Security and Privacy (W2 SP'15), San Jose, CA, USA, 21 May 2015. Available online: [[http://arxiv.org/abs/1506.04111](http://arxiv.org/abs/1506.04111)]([http://arxiv.org/abs/1506.04111](http://arxiv.org/abs/1506.04111)) (accessed on 1 October 2021). * [23] [PERSON]; [PERSON]; [PERSON] Method for Detecting a Malicious Domain by using WHOIS and DNS features. In Proceedings of the Third International Conference on Digital Security and Forensics (DigitalSec'16), Kuala Lumpur, Malaysia, 6-8 September 2016; pp. 74-80. * [24] [PERSON]; [PERSON] [PERSON]; [PERSON] Method for detecting a malicious domain by using only well known information. _Int. J. Cyber-Secur. Digit. Forensics_**2016**, 5, 166-174. [CrossRef]
* [25] [PERSON]; [PERSON]; [PERSON]; [PERSON] Phishstorm: Detecting phishing with streaming analytics. _IEEE Trans. Netw. Serv. Manag._**2014**, 11, 458-471. [CrossRef]
* [26] [PERSON]; [PERSON] Phishing URL detection using URL ranking. In Proceedings of the IEEE International Congress on Big Data, BigData Congress, New York, NY, USA, 27 June-2 July 2015; pp. 635-638. * [27] [PERSON]; [PERSON] New rule-based phishing detection method. _Expert Syst. Appl._**2016**, 53, 231-242. [CrossRef]
* [28] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Detecting Phishing Websites and Targets Based on URLs and Web page Links. In Proceedings of the 24 th International Conference on Pattern Recognition (ICPR'18), Beijing, China, 20-24 August 2018; pp. 3669-3674. [CrossRef]
* [29] [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Phishing URL detection with oversampling based on text generative adversarial networks. In Proceedings of the IEEE international conference on Big Data (Big Data), Seattle, WA, USA, 10-13 December 2018; pp. 1168-1177. [CrossRef]
* [30] [PERSON]; [PERSON] Towards detection of phishing websites on client-side using machine learning based approach. _Telecommun. Syst._**2018**, 68, 687-700. [CrossRef]
* [31] [PERSON]; [PERSON]; [PERSON]; [PERSON] Analyzing and detecting malicious flash advertisements.