# Convolutional Graph Network-Based Feature Extraction to Detect Phishing Attacks
## 3 Materials and Methods
### Extracting Features Based on Graph Convolution Network
Step 4:  
The neural network is made with three layers, such as an input layer equal to the sum of the features' numbers, a GCN, as well as an output layer:  
\[\hat{x}_{j}=ReLU\big{(}W_{input}x_{j}\big{)} \tag{7}\]  
For the feature selection, only selected features in the input-layer weight matrix are used iteratively:  
In the first iteration, \(S=\{0\}\), so only the first column of the weight matrix is used. The GCN layer is used to build representations (embedding) based on graph similarity:  
\[\hat{x}_{j}=ReLU\big{(}W_{1}\hat{x}_{j}+\frac{1}{|N(j)|}\sum_{i\in N(j)}W_{2} \hat{x}_{i}\big{)} \tag{8}\]  
\[W_{1}\in\mathbb{R}^{b_{2}\times b_{1}}\]  
\[W_{2}\in\mathbb{R}^{b_{2}\times b_{1}}\]  
The output layer has the same number of neurons as there are classes. Following this, the probability for each class is calculated:  
\[\hat{y}_{j}=Softmax\big{(}W_{output}\hat{x}_{j}+b_{output}\big{)} \tag{9}\]  
\[\text{W}_{\text{output}}\in\mathbb{R}^{b_{2}\times 2}\]  
\[\text{b}_{\text{output}}\in\mathbb{R}^{2}\]Step 5: Loss calculation  
The hinge loss is a cost function used to train statistical classification. The hinge loss function is mostly used to determine the maximum classification margin in support vector machines. For the output \(t=\pm 1\) and the hinge loss classification order, the prediction \(y\) is defined as follows:  
\[(\gamma=2~{}~{}C=0.2)\]0  
where y is the actual value of the class (0 or 1); y' is the output of the classification model. The hinge loss function is a nonlinear cost function used for classification models with any type of architecture. This cost function has many desirable properties, such as stability and accuracy sensitivity. To use this hinge loss function in phishing, we set the values of the classes of phishing and valid pages to \(-1\) and \(1\), respectively. The hinge loss is especially useful in the GNN context because it fosters a distinct separation in the learnt node embeddings, making the model more resilient against noisy or overlapping graph characteristics. Unlike the cross-entropy loss, which focuses on probabilistic outputs, the hinge loss directly optimizes the margin, which is useful for distinguishing phishing URLs from authentic ones based on tiny feature changes in the network structure. This results in better generalization and robustness in spotting phishing patterns. Algorithm 1 describes the technique for detecting phishing nodes. This technique uses a GNN, an SVM, and the NRW distance to increase the feature selection and classification accuracy in the detection of phishing attacks. The dataset is separated into training and testing sets, and a graph (\(G\)) is created from feature vectors using pairwise distances. To capture the graph's local structure, the technique computes the neighborhood random walk (NRW) distance between nodes, which aids in the construction of an adjacency matrix that better portrays the node interactions based on neighborhood connectedness. This adjacency matrix is then used to train a graph model, which includes self-loops for better message delivery and uses the hinge loss to optimize the node categorization. After training the GNN model, the approach uses feature gradients to choose the most informative features, thereby lowering the dataset's dimension. These selected features are then fed into an SVM classifier, which refines the phishing detection model using the hinge loss. Finally, predictions are generated on the test set, and performance metrics like the precision, accuracy, and AUC are calculated to determine the model's effectiveness. The technique intends to improve high-precision phishing attack detection by incorporating the NRW to improve graph representation and merge the GNN with the SVM.