# Towards Lightweight URL-Based Phishing Detection
## 3 Methodology
### Feature Selection
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Feature** & **Description** \\ \hline
**F1. URL Length** & A frequently used feature in this domain. As in previous work (e.g., [25]), our experiments suggest a discrepancy in the average URL length between legitimate and phishing URLs, i.e., correlation of URL length and phishing instances (Table 2). \\ \hline
**F2. HTTPS usage** & The dataset analysis shows a lack of TLS usage in phishing websites. Although TLS adoption in phishing web sites is growing [2], serving a website through HTTPS requires more resources, which threat actors might decide to avoid. Furthermore, the low average lifespan of a phishing webpage could also deter non sophisticated threat actors from using TLS. \\ \hline
**F3. Numerical characters** & Numerical characters are uncommon for benign domains and especially subdomains in our dataset. \\ \hline
**F4. Special characters** & The number of ‘\(\emptyset\)’ and ‘\(\sim\)’ characters are uncommon; the tilde is an outdated practice of accessing a user’s folder on a Linux system, while the ‘\(\emptyset\)’ causes unexpected behaviour in the browser. \\ \hline
**F5. Number of dots (J)** & Given the popularity of hosting or storage services today and the existence of many open redirect vulnerabilities, some phishing URLs hide their real domain behind the trusted domain of another company. This can be easily identified by checking if the number of periods in the path of the URL exceeds one. \\ \hline
**F6. Number of hyphens** & If there is no domain present in the path portion of the URL, the hyphen count is determined based on the network location only, otherwise for the whole URL. This allows the feature to include cases such as “target-brand.example.com” and “storage.service.com/website/target-brand.example.com/”. \\ \hline
**F7. Number of subdomains** & Most of the benign URLs use only one subdomain, such as “www”. In contrast, phishing URLs may use a multi-component subdomain for social engineering purposes with the misuse of a known brand. Based on this, this feature will flag any URL whose subdomain components’ count exceeds two. \\ \hline
**F8–F10. Suggestive vocabulary** & These features indicate the presence of suggestive vocabulary, in the subdomain, domain, and path sections of a URL. Past work [12] uncovered that suggestive vocabulary, such as login, banking, confirm, etc, is often found in phishing URLs. \\ \hline
**F11–F12. Similarity index** & This feature reflects the similarity index between the URL’s domain and subdomain, and the top benign domains in the dataset. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Statistical analysis of URL length over the training dataset. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline  & **Benign** & **Phishing** \\ \hline
**Average** & 57.81 & 77.54 \\
**Median** & 52 & 58 \\
**90 th percentile** & 90 & 143 \\
**95 th percentile** & 107 & 218 \\
**99 th percentile** & 141 & 321 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of features used. on the subdomain must not ignored as these represent the presence of a benign domain in the subdomain section of a given URL.