# HinPhish: An Effective Phishing Detection Approach Based on Heterogeneous Information Networks
## 3 Preliminaries  
### Heterogeneous Information Networks  
Systems in the real world are always composed of different types of components with complex interactions. However, many traditional data analysis and mining studies have ignored the differences between different objects and relationships, leading to the loss of some semantic information. In recent years, more and more researchers have modeled target systems as heterogeneous information networks (HINs) [40], which can retain more comprehensive semantic and structural information, supporting higher-level semantic mining. A HIN is defined as follows:  
**Definition 1** (**Heterogeneous Information Network**[40, 41]).: _An information network is a directed graph \(G=(V,E)\) with an object type mapping \(\varphi:V\rightarrow\mathcal{A}\) and a link type mapping \(\psi:E\rightarrow\mathcal{R}\). Each object \(v\in V\) belongs to one particular object type in the object type set \(\mathcal{A}:\varphi(v)\in\mathcal{A}\), and each link \(e\in E\) belongs to one particular relation type in the relation type set \(\mathcal{R}:\psi(e)\in\mathcal{R}\). The information network is called a **heterogeneous information network** if the number of object types satisfies \(|\mathcal{A}|>1\), or if the number of relationship types satisfies \(|\mathcal{R}|>1\); otherwise, it is a **homogeneous information network**._  
In order to understand the complex objects and relationship types in heterogeneous information networks more clearly, the network schema is used to describe the structure of the network at the model level.  
**Definition 2** (**Network Schema**[40, 41]).: _The network schema is a meta-template for an information network \(G=(V,E)\), with the object type mapping \(\varphi:V\rightarrow\mathcal{A}\) and the link type mapping \(\psi:E\rightarrow\mathcal{R}\). It is denoted as \(T_{G}=(\mathcal{A},\mathcal{R})\). An information network following a network schema is called a **network instance** of the network schema. For a link type \(R\) connecting object type \(S\) to object type \(T\) (i.e., \(S\stackrel{{ R}}{{\longrightarrow}}T\)), \(S\) and \(T\) are the source object type and target object type of the link type \(R\), which can be denoted as \(R.S\) and \(R.T\), respectively. The inverse relation \(R^{-1}\) holds naturally for \(T\stackrel{{ R^{-1}}}{{\longrightarrow}}S\)._  
Figure 3 shows a simple HIN model considering a few websites. It contains three types of objects: Webpage (W), Domain (D), and Resource (R). There are different relationships between different types of objects: the webpage of a website is built on a domain; a webpage can be linked to other webpages through hyperlinks; and webpages also use other resources, such as pictures, videos, and JavaScript, to enrich themselves and implement their functions. In summary, a HIN is a special information network that contains many types of objects and relationships. The network schema specifies the structural constraints of the HIN, and the network instance contains all the information about the objects and their relationships in the whole network.