## 2 Materials and Methods
### Spearman + RFE Scenario Result  
After obtaining the correlation results using this method, ten features with a negligible influence on the output variable are eliminated. The value fragments are indicated in Table 11 for dataset 1 and Table 12 for dataset 2.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No** & **Variable 1** & **Variable 2** & **Spearman Value** \\ \hline
1 & NumQueryComponents & QueryLength & 0.959329 \\
2 & NumQueryComponents & NumAmpersand & 0.750978 \\
3 & UrLLength & PathLength & 0.724112 \\
4 & NumAmpersand & QueryLength & 0.708677 \\
5 & PathLevel & PathLength & 0.652628 \\
6 & UrLLength & NumNumericChars & 0.564596 \\
7 & NumDash & PathLength & 0.550183 \\
8 & NumDots & SubdomainLevel & 0.542126 \\
9 & PctExtHyperlinks & PctExtResourceUrls & 0.520385 \\
10 & UrLLength & NumDash & 0.501986 \\
11 & PctExtResourceUrlsRT & ExtMetaScriptLinkRT & 0.487458 \\
12 & PctExtResourceUrls & FrequentDomainNameMismatch & 0.465619 \\
13 & SubdomainLevel & HostnameLength & 0.459177 \\
14 & NumNumericChars & RandomString & 0.457105 \\
15 & RelativeFormAction & AbnormalFormAction & 0.429697 \\  &... &... &... \\
770 & RandomString & PctExtResourceUrls & 0.000528 \\
771 & NumUnderscore & MissingTitle & 0.000107 \\
772 & PctExtHyperlinks & UrLLengthRT & 0.000058 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Spearman correlation value between features on dataset 1.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No** & **Variable 1** & **Variable 2** & **Spearman Value** \\ \hline
1 & nb\_dots & nb\_subdomains & 0.981132 \\
2 & longest\_word\_path & avg\_word\_path & 0.928796 \\
3 & nb\_qm & nb\_eq & 0.916903 \\
4 & length\_url & length\_words\_raw & 0.907651 \\
5 & longest\_word\_host & avg\_word\_host & 0.878764 \\
6 & length\_url & longest\_word\_path & 0.831591 \\
7 & ratio\_intHyperlinks & links\_in\_tags & 0.787153 \\
8 & longest\_words\_raw & avg\_words\_raw & 0.756151 \\
9 & length\_hostname & longest\_word\_host & 0.748802 \\
10 & nb\_percent & nb\_space & 0.748207 \\
11 & length\_words\_raw & longest\_word\_path & 0.747163 \\
12 & shortest\_word\_path & avg\_word\_path & 0.742056 \\
13 & nb\_extCSS & external\_favicon & 0.737071 \\ \hline \hline \end{tabular}
\end{table}
Table 12: Spearman correlation value between features on Dataset 2.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**No** & **Variable 1** & **Variable 2** & **Spearman Value** \\ \hline
1 & nb\_dots & nb\_subdomains & 0.981132 \\
2 & longest\_word\_path & avg\_word\_path & 0.928796 \\
3 & nb\_qm & nb\_eq & 0.916903 \\
4 & length\_url & length\_words\_raw & 0.907651 \\
5 & longest\_word\_host & avg\_word\_host & 0.878764 \\
6 & length\_url & longest\_word\_path & 0.831591 \\
7 & ratio\_intHyperlinks & links\_in\_tags & 0.787153 \\
8 & longest\_words\_raw & avg\_words\_raw & 0.756151 \\
9 & length\_hostname & longest\_word\_host & 0.748802 \\
10 & nb\_percent & nb\_space & 0.748207 \\
11 & length\_words\_raw & longest\_word\_path & 0.747163 \\
12 & shortest\_word\_path & avg\_word\_path & 0.742056 \\
13 & nb\_extCSS & external\_favicon & 0.737071 \\ \hline \hline \end{tabular}
\end{table}
Table 10: List of features removed using MICe TICe and their effect on the output variable on dataset 2.  
The deleted feature is generated by ranking the results according to the MICe TICe correlation value that is the highest. Then, as seen in Table 13, the deleted features from those findings and their effect on the output variable for dataset 1 are as follows: PathLevel, SubdomainLevel, NumNumericChars, PctExtResourceUrls, UrlLength, PathLength, QueryLength, NumAmpersand, NumQueryComponents, and NumDash. For dataset 2, as seen in Table 14, the deleted features from those findings and their effect on the output variable for dataset 2 are as follows: ratio_extHyperlinks, tId_in_path, shortest_word_path, nb_dslash, http_in_path, nb_underscore, nb_percent, char_repeat, nb_space, and shortest_words_raw.