# Investigating the Influence of Feature Sources for Malicious Website Detection
## 3 Preliminary Experiments
### Additional Malicious Samples
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Category** & **Feature** & **Description** \\ \hline \multirow{4}{*}{Raw} & URL of the website & String format of the URL of the website. \\  & HTML page content & The HTML page code of the homepage of the website in string format. \\  & Hostname & The extracted hostname of the website in string format. \\  & Domain name & The extracted domain name of each website in string format. \\  & Label of the website & A binary label that states whether the website is malicious or benign. \\ \hline \multirow{4}{*}{Lexical} & Length of the URL * & The number of characters in the URL. \\  & Number of underscores, semicolons, subdomains, zeros, spaces, hyphens, @ symbols, queries, ampersands, and equal \\  & Hostname length * & The number of characters in the hostname extracted from the given website. \\  & Ratio of digits to URL * & The number of digits divided by the length of the URL. \\  & Ratio of digits to hostname * & The number of digits divided by length of hostname. \\  & IP address in URL * & A binary label that states if an IP address exists in the URL. \\  & Existence of @ symbol in URL * & A label that states if the URL contains any @ characters. \\  & Domain length & The number of characters in the extracted domain name. \\  & Unique URL characters, numbers and letters & Taking the total number of unique characters, numbers and letters in a URL. Note that each of these is their own feature. \\  & Ratio of letters to chars & The unique letter count divided by the total unique character count in a URL. \\  & Ratio of numbers to chars & Count of numbers in a URL divided by the total unique character in a URL. \\  & Top-level domain * & The top level domain of a website as a category label. \\ \hline \multirow{4}{*}{Content} & Length of JavaScript code * & Total number of characters of JavaScript code present in HTML content. \\  & Length of deobfuscated JS code * * & Length of the JavaScript code put through deobfuscation tool. \\  & URL count in content * & The total number of URLs found in the HTML page content [23; 24]. \\  & Unique URL count in content * & The unique number of URLs found in the HTML page content [23; 24]. \\  & Suspicious JS function count * & The number of suspicious functions found in the JavaScript code [25]. \\  & JavaScript function count * & The total number of JavaScript functions called in the code [23; 24]. \\  & Content length & The total number of characters of the HTML content page. \\  & Script tag references & A count of the total number of script tags in the HTML page content. \\  & Comtains HEX & Binary indicator about webpage * HTML content containing any hexadecimal characters. \\  & HEX length & The number of Hexadecimal characters in the HTML content page. \\  & DCD MPEG-7 * & The 5 dominant colors of an image. They are extracted as 5 different columns. \\  & Average length of JS arrays & The average length of arrays in the JS code present in HTML content. \\  & Maximum length of JS arrays & The maximum length of arrays in the JS code present in HTML content. \\ \hline \multirow{4}{*}{Host} & IP address * & String format of the IP address of the website. \\  & Geographic location & The name of the country the website is hosted in. \\  & WHOS information* & A binary label that states whether the WHOIS information for the website is complete or incomplete. \\  & HTTPS * & A binary label that states whether the website is secure HTTP protocol or not. \\  & Is in Alexa’s top 1 million & A binary label that describes if the given domain name of a URL exists in Alexa’s top 1 million domains. \\ \hline \multirow{4}{*}{Embedding} & Image embeddings & The embeddings of the website’s image. They are extracted using MobileNetV2 [26]. \\  & Content embeddings & The embeddings of the HTML page content. Extracted using CodeBert [27; 28]. \\  & URL embeddings (Distilbert) & URL embeddings extracted using the Distilbert Tranformer [29; 30]. \\  & URL embeddings (Longformer) & URL embeddings extracted using the Longformer Transformer [30; 31]. \\  & Mean statistic for embeddings & URL and image embeddings, as well as chi-squared feature selected embedding dimensions, are summarized as a single representative number—the mean of the embedding vector (or parts of the vector). \\ \hline \hline \end{tabular}
\end{table}