# A Heterogeneous Machine Learning Ensemble Framework for Malicious Webpage Detection
## 2 Related Work
### Machine Learning-Based Malicious Website Detection  
A machine learning-based approach to detect malicious websites requires feature extraction to accumulate learning data. These features include lexical-, host-, and content-based features, which can be configured in different patterns based on their attributes. The lexical-based features refer to the information obtained from the URL name itself, and they can be extracted from features such as URL string, URL length, element (hostname and top-level domain, etc.) length, and the number of special characters and symbols, or obtained from the extraction of IP addresses, keywords, and tokens [16]. Host-based features can be obtained from the URL hostname features, providing information such as malicious host features, geographical location, identification, and management style [17]. Finally, content-based features have a larger amount of information compared to other types of features, including HTML, JavaScript, visual imagery, and Active X, which can be extracted by crawling the entire webpage [18].  
Researchers have developed various methods to classify a particular URL as malicious or benign using feature extraction attributes as a dataset for machine learning. Machine learning algorithm-based classifiers include k-nearest neighbors (KNN), SVM, random forest, naive Bayes, and artificial neural networks. [PERSON] et al. [10] proposed a phishing website detection method that uses ensemble classifiers. They built an ensemble classification algorithm based on tag features from the HTML attributes to combine the predicted results from different phishing detection classifiers. They also employed a hierarchical clustering technique for automatic phishing categorization. [PERSON] et al. [19] presented an approach based on reinforcement learning for phishing URL detection. They classified URLs as malicious or benign based on URL information, the URL's IP address, and additional URL access requests, and their novel model is capable of compensation depending on the learning agents' behavior and status. [PERSON] et al. [6] extracted 14 features by defining lexical-based, host-based, and content-based features, and compared the performances of random forest, gradient boosting, and neural networks. They compared the performance of each feature based on the similarity between known and new malicious web data. [PERSON] et al. [20] proposed a malicious web detection model using a SVM classifier. The features they considered include the IP address, '\(\mathscr{O}\)' symbol, '.' (dot) symbol, domain separation using '-' (underscore or hyphen) symbol, URL redirection, HTTPS token, email subject line, short URL service, hostname length, sensitive words, the number of slashes, Unicode, SSL certificate validity, anchor, iframe, and website ranking. They emphasized that selecting an effective feature is the key to improving the performance of machine learning models.  
Machine learning researchers agree that the success of a model or algorithm depends on the manner in which the features are selected and extracted from the web. Classifying whether a particular web is malicious or benign depends on the performance of the machine learning model. Therefore, it is imperative to study the features and machine learning models that are most effective in accurately predicting malicious URLs. Therefore, in this study, a method for extracting a feature set optimized for a model is proposed.