2017 IEEE 3rd International Conference on Collaboration and Internet Computing
Detection of Phishing Webpages using
Heterogeneous Transfer Learning
Karl R. Weiss
Taghi M. Khoshgoftaar
Florida Atlantic University
kweiss6@fau.edu
Florida Atlantic University
khoshgof@fau.edu
attempt to trick and defraud a legitimate internet user into
disclosing personal information by displaying webpages that
falsely represent a genuine company or cause. The types
of user information that are typically targeted by phishers
include user-names, passwords, answers to security questions,
social security numbers, and credit card information. The
information obtained by the phishing websites is typically
used for malicious purposes such as identity fraud and illegal
financial transactions. In 2015, the average 10,000 employee
company spent $3.7 million on phishing attacks [4].
There are a number of ways to combat phishing attacks. One
method of combating phishing is through legal channels. Many
countries have strict laws that prohibit phishing. Anti-phishing
laws have been enacted in the United States and United
Kingdom since 2006 [5]. However, phishing still remains an
issue in countries where strict anti-phishing laws have been
enacted. Another method to combat the phishing problem is
through user education. An internet user can look for items
that indicate a phishing webpage, such as an incorrect domain
name in the URL or not using a secure connection (e.g. https)
for financial transactions. Unfortunately, the education method
requires the internet user to have some level of technical ability
and knowledge. Because of this, user education is only able
to address a portion of the phishing problem.
A third method to combat the phishing problem is through
technical solutions. One technical solution that has been
deployed is the use of blacklists in security software. The
inherent nature of phishing websites is they do not last for
long periods of time and they change their domain names
frequently. An issue with using blacklists is keeping the
list current and up-to-date given the dynamic nature of the
phishing websites. The other technical solution is the data
mining and machine learning approach, where key features
of phishing websites are discovered and used to train machine
learning algorithms to detect phishing webpages. This paper is
focused on machine learning solutions for detecting phishing
websites.
A subclass of machine learning is transfer learning. Transfer
learning is used in an environment where there is limited or
no labeled training data for a domain of interest (referred to as
the target data). In this case, labeled data from a domain, that
is similar to the domain of interest (referred to as the source
data), is used to train a transfer learning algorithm. Transfer
learning algorithms attempt to transfer relevant information
Abstract—The detection of phishing websites using traditional
machine learning methods has been demonstrated in previous
studies. Traditional machine learning methods assume that the
input feature space is the same between the training and
testing data. There are scenarios in machine learning, where
the available labeled training data has a different input feature
space than the testing data. In cases where the input feature space
between the testing and training data are different, traditional
machine learning methods cannot be used. Heterogeneous transfer learning methods are used to transform the different input
feature spaces between the testing and the training data into a
unique and common set of input features. For our experiment,
we construct numerous scenarios for the application of phishing
website detection, where the features of the testing and training
data are different. Our experiment starts with a baseline dataset
for the detection of phishing websites. This baseline dataset is
used to create separate training and testing datasets by splitting
the features, such that the features in the training and testing data
are mutually exclusive. Then, a heterogeneous transfer learning
technique called Canonical Correlation Analysis is used to align
the input feature space between the training and testing data.
The feature aligned training and testing data is used with various
traditional machine learning methods and homogeneous transfer
learning methods to predict phishing websites. The performance
results of the different scenarios and algorithms are reported and
analyzed.
Keywords–Heterogeneous transfer learning, Phishing
website detection.
I. I NTRODUCTION
The internet has become an integral part of people’s lives
over the past 20 years. In 2016, there were over 286 million
internet users in the United States representing approximately
88% of the population. In the United Kingdom and Japan,
internet usage represents 92% and 91% of the population,
respectively [1]. As of 2017, there are 3.8 trillion internet users
worldwide [2]. One reason for the popularity of the internet is
the ability to conveniently engage in commerce transactions.
E-commerce revenue for 2017 is estimated to be over $2.2
trillion and is predicted to grow to over $4.4 trillion by 2021
[3]. Further, the internet has become a popular vehicle for
banking and stock trading. With the wide use of financial
activity being conducted over the internet, data security is an
increasingly important factor.
A threat to data security over the internet is phishing.
Phishing is an attempt to steal an internet user’s personal
and/or financial information by impersonating a website of
a legitimate internet entity. A dishonest internet entity will
0-7695-6303-1/17/31.00 ©2017 IEEE
DOI 10.1109/CIC.2017.00034
190
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
from the source data, while suppressing the unrelated portions,
to build a learner to predict target data [6]. Because the
source and target data are drawn from different domains in
a transfer learning environment, the data distribution between
the source and target data may be different [7]. When there are
distribution differences between the training and testing data,
the performance of a predictive learner may be degraded [8].
Transfer learning algorithms are able to build high-performing
learners from training and testing data with different data
distributions.
There are two classes of transfer learning, which are referred
to as homogeneous transfer learning and heterogeneous transfer learning. Homogeneous transfer learning is the case where
the source and target data share the same input feature space,
but have different data distributions. Heterogeneous transfer
learning is the case where the source and target data have
a different input feature space. For more information on the
details of transfer learning, refer to the survey of transfer
learning [6].
A machine learning practitioner may have limited labeled
datasets available to train a predictive learner for a phishing
application. In previous works that address the detection of
phishing websites, there is no uniform agreement on which
input features to use. The unlabeled testing data of interest to
the machine learning practitioner may have a different input
feature space from the available labeled datasets. This could
be due to features being different between the training and
testing data, or the training and testing data having a different
number of features. If the feature input space is not the same,
then traditional machine learning methods cannot be used.
To this end, we apply heterogeneous transfer learning to the
application of phishing website detection. This experiment is
a benefit to a machine learning practitioner, who is in search
of a solution for the application of phishing website detection,
where the available labeled training does not have the same
input feature space as the testing data.
Our experiment constructs dataset pairs with mutually exclusive features to create heterogeneous test scenarios. A
heterogeneous test scenario is where the source and the target
data have a different input feature space. In our experiment,
the input feature space of the source and target data is
first aligned (transformed to be the same) using a heterogeneous transfer learning technique called Canonical Correlation
Analysis (CCA) [9]. Then, the feature aligned source and
target data is used to train various homogeneous transfer
learning algorithms, along with traditional machine learning
algorithms. Our goal is to determine the effectiveness of using
heterogeneous transfer learning for the application of phishing website prediction. We further examine the effectiveness
using homogeneous transfer learning and traditional machine
learning with the the transformed input feature space. To
the best of our knowledge, heterogeneous transfer learning
methods coupled with both traditional machine learning and
homogeneous transfer learning methods have not been applied
to the application of phishing website detection.
The remainder of this paper is organized as follows. Section
II discusses works relevant to our experiment. Section III
presents the experiment design and definition. Section IV
provides and discusses the test results of the experiment.
Section V presents the experiment conclusions.
II. R ELATED W ORK
The majority of previous heterogeneous transfer learning
works focus solely on aligning the input feature space of the
source and target data. These works make an assumption that
there is no further distribution difference between the source
and target data after the feature alignment step. However, there
are limited works that address both input feature alignment and
reducing distribution differences between the source and target
data.
The work by Zhou et al. [10] first learns an asymmetric
transformation from the target data to the source data to
align the input feature space. Next, the algorithm discovers
a common latent feature space using the transformed data to
reduce the distribution differences between the target data and
the source data. This portion of the algorithm is implemented
using a deep learning method. Lastly, the common latent
feature space is used to train a learner. The algorithm by Zhou
et al. [10] is used in the application of multiple language text
sentiment classification.
The heterogeneous transfer learning work by Yi-Ren et
al. [9] employs a domain adaptation technique to reduce
distribution differences between the source and target data, and
also uses the CCA algorithm to resolve the input feature space
differences. A kernelized version of the CCA algorithm is also
used to derive a nonlinear correlation subspace which aligns
the input feature space between the source and target data. The
aligned feature space is used to train a Support Vector Machine
(SVM) model that is modified with a domain adaptation
technique. This method is tested using the applications of
image recognition and text-image classification.
There have been a number of works that have addressed
the topic of phishing detection through traditional machine
learning techniques. The paper by Aburrous et al. [11] defines
27 unique features to detect e-banking phishing. These 27 features are assigned one of three values of Legitimate, Genuine,
or Doubtful. The experiment focuses on the comparison of
six different associative classification algorithms. In the work
by Pan and Ding [12], six unique features are defined to
predict the existence of a phishing webpage. A Support Vector
Machine is used as the traditional machine learning model.
The accuracy level obtained is below other comparable studies,
which could be due to the small number of features used.
The work by Fette et al. [13] uses Random Forest, Support
Vector Machine, Decision Tree, and Naive Bayes models to
predict phishing emails. Ten features are constructed from the
emails collected for the experiment. The work by Mohammad
et al. [14] uses 17 unique features to detect phishing websites.
This method uses a self-structuring neural network to perform
the classification process.
Our experiment applies a heterogeneous transfer learning
technique, coupled with homogeneous transfer learning and
191
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
the URL has one subdomains it is labeled as Legitimate, if it
is has two subdomains it is labeled as Suspicious, otherwise
it is labeled as Phishing.
• Using Secure Socket Layer (Feature H): Using a Secure
Socket Layer (e.g. https) gives the impression of legitimacy to
a webpage. This false sense of security is used by phishers to
trick users. There are three criteria used for this feature: use
of https, use of a trusted certificate authority, and length of
the issued certificate. A list of trusted certificate authorities is
obtained for this feature evaluation. If using http (non-secure),
then the feature is labeled as Legitimate. If using https and the
certificate authority is trusted and the age of the certificate is
less than one year, then the feature is labeled as Legitimate.
If using https and the certificate authority is not trusted, then
the feature is labeled as Suspicious, otherwise it is labeled as
Phishing.
• Domain name registration length (Feature I): Phishing websites typically have a short life span, therefore their domain
names are only registered for the minimum amount of time. If
the domain name registration expires in less than one year, then
it is labeled as Phishing, otherwise it is labeled as Legitimate.
• Using a favicon (Feature J): A favicon is a small icon image
that is shown with the address or title of the webpage. If the
favicon is loaded from a domain different from what is shown
in the address bar, then it is labeled as Phishing, otherwise it
is labeled as Legitimate.
• Using a non-standard port (Feature K): A list of typical
standard port usage is obtained for this feature. If a request is
made to use a non-standard port, then it is labeled as Phishing,
otherwise it is labeled as Legitimate.
• Using an https token in the domain name (Feature L):
Phishers may try to trick users by adding https to the domain
name of a URL. If the domain name includes https, then it is
labeled as Phishing, otherwise it is labeled as Legitimate.
• Using request URL (Feature M): Legitimate websites typically request image and video files from the same domain
name as the webpage. If less than 22% of requests are made to
different domains, then it is labeled as Legitimate. If between
22% and 61% of the requests are made to different domains,
then it is labeled as Suspicious. If more than 61% of the
requests are made to different domains, then it is labeled as
Phishing.
• Anchor requests (Feature N): An anchor is an html tag
defined as <a>. Here, the percentage that an anchor tag makes
a request from a domain name different from the webpage
domain name is tabulated combined with the percentage that
an anchor tag does not point to any domain name. If the
percentage is less than 31%, then it is labeled as Legitimate. If
the percentage is between 31% and 67%, then it is labeled as
Suspicious. If the percentage is above 67%, then it is labeled
as Phishing.
• Use of link tags (Feature O): The <meta>, <link>, and
<script> tags in the html code are examined to find out how
many make requests to a domain name that is different from
the webpage. If the percentage is less than 17%, then it is
labeled as Legitimate. If the percentage is between 17% and
traditional machine learning models to the application of
detecting phishing websites. Our experiment parameters are
unique from the previous related work, and to the best of our
knowledge have not been previously investigated.
III. E XPERIMENT D ESIGN AND D EFINITION
The following section defines the datasets, learners, and
procedures used to perform our experiment. Parameter values
for the experiment are provided in addition to defining the
processes needed to ensure the experiment results are reproducible and reliable.
A. Base Dataset
The dataset used for our experiment is called “Phishing
Websites” which is sourced from the UCI Machine Learning
Repository [15]. There are 11,055 instances in this dataset
with approximately 55% of the instances labeled as “Phishing”
and the other 45% labeled as “Legitimate.” There are 30
independent features in the Phishing Websites dataset. The
features are assigned two values of Legitimate or Phishing,
or three values of Legitimate, Suspicious or Phishing. In this
section, we define the 30 features used in this paper. For further
details on these features, refer to “Phishing Websites” at the
UCI Machine Learning Repository [15].
• Using an IP address (Feature A): If the URL contains an
actual numbered IP address (e.g. http://11.96.10.20/a.html) as
opposed to a domain name, then the feature is labeled as
Phishing, otherwise it is labeled as Legitimate.
• Using a long URL (Feature B): Phishers sometimes try to
hide a suspicious part of the URL by creating long URLs.
If the URL is less than 54 characters, the feature is labeled
as Legitimate, if the URL is between 54 and 75 characters
the feature is labeled as Suspicious, otherwise the feature is
labeled as Phishing.
• Using URL Shortening Services (Feature C): A shortening
service uses a URL name (usually a small URL) that is
different from the actual URL to redirect the webpage. If a
shortening service is used the feature is labeled as Phishing,
otherwise it is Legitimate.
• Using “@” symbol in URL (Feature D): The characters
preceding an “@” symbol in a URL are ignored by the
browser. This method is used in an attempt to trick users into
thinking the URL is different from what it actually is. Using
an “@” symbol in the URL is considered Phishing, otherwise
it is Legitimate.
• Using “//” in URL to redirect (Feature E): If a “//” is used
in a URL to redirect to another website, then it is labeled as
Phishing, otherwise it is labeled as Legitimate.
• Using “-” in the domain name (Feature F): A dash symbol
(“-”) can be used in a domain name to fool a user into thinking
the domain name is from a legitimate company. If a “-” is used
in the domain name, then it is labeled as Phishing, otherwise
it is Legitimate.
• Using multiple subdomains in a URL (Feature G): A typical
URL has one subdomain. This subdomain can be “www” (e.g.
as in www.ibm.com) or some other domain defined name. If
192
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
• Google index (Feature Z3): Most phishing webpages are not
indexed by Google. If a webpage is indexed by Google, then
it is labeled as Legitimate, otherwise it is labeled as Phishing.
• Number of links (Feature Z4): Phishing webpages typically
do not have links from other webpages pointing to their
webpage. If the number of links pointing to the webpage is
zero, then it is labeled as Phishing. If the number of links
pointing to the webpage is between one and two, then it is
labeled as Suspicious. If the number of links pointing to the
webpage is greater than two, then it is labeled as Legitimate.
• Phishing reports (Feature Z5): The statistics from PhishTank
and StopBadware are used for this feature. If the host for the
webpage has an IP address or domain name listed in PhishTank
or StopBadware list, then it is labeled Phishing, otherwise it
is labeled Legitimate.
81%, then it is labeled as Suspicious. If the percentage is above
81%, then it is labeled as Phishing.
• Use of server form handler (Feature P): In legitimate
websites, the server form handler typically links to a domain
name that is the same as the webpage. If the server form
handler is blank or empty, then it is labeled as Phishing. If the
server form handler links to a domain name that is different
from the webpage, then it is labeled as Suspicious. For all
other cases, it is labeled as Legitimate.
• Submitting user information to email (Feature Q): Legitimate
websites typically will not use the mailto or mail() functions
to send user information. If a website uses the mailto or mail()
functions, then it is labeled as Phishing, otherwise it is labeled
as Legitimate.
• Abnormal URL (Feature R): If the host-name (obtained from
the WHOIS database) is contained in the URL, then it is
labeled as Legitimate, otherwise it is labeled as Phishing.
• Number of redirects (Feature S): Legitimate websites are
redirected, on average, less than Phishing websites. If the
number of redirections is zero or one, then it is labeled as
Legitimate. If the number of redirections is between two
and four, then it is labeled as Suspicious. If the number of
redirections is greater than four, than it is labeled as Phishing.
• Status bar change (Feature T): Phishing websites can use
Javascript to display an erroneous URL in the status bar. If the
mouseover event in a webpage changes the status bar, then it
is labeled as Phishing, otherwise it is labeled as Legitimate.
• Disable mouse right-click (Feature U): Phishing websites can
disable the mouse right-click function so users cannot view the
webpage source code. If the mouse right-click is disabled, then
it is labeled as Phishing, otherwise it is labeled as Legitimate.
• Using pop-up windows (Feature V): Phishing webpages can
ask users to submit personal information on pop-up windows,
whereas this activity is rare for Legitimate webpages. If there
are text fields in a pop-up window, then it is labeled as
Phishing, otherwise it is labeled as Legitimate.
• Use of iframe tag (Feature W): If a webpage uses at least
one iframe tag, then it is labeled as Phishing, otherwise it is
labeled as Legitimate.
• Age of domain (Feature X): Phishing websites do not last
for long. The age of the domain is obtained from the WHOIS
database. If the age of the domain is less than six months, then
it is labeled as Phishing, otherwise it is labeled as Legitimate.
• DNS record (Feature Y): If the DNS record is not found
or is empty (per the WHOIS database) then it is labeled as
Phishing, otherwise it is labeled as Legitimate.
• Website traffic (Feature Z1): Phishing websites typically do
not generate large amounts of traffic. If the website traffic rank
is in the top 100,000, then it is labeled as Legitimate. If the
website traffic is not in the top 100,000 (but still ranked), then
it is labeled as Suspicious. If the website is not ranked, then
it is labeled as Phishing.
• Page rank (Feature Z2): Phishing webpages typically have
a very low page rank. If the page rank of a webpage is less
than 0.2, then it is labeled as Phishing, otherwise it is labeled
as Legitimate.
B. Dataset Construction
From the Base Dataset of Phishing Websites described
above, we divide both the instances and the features to create
source and target dataset pairs for our experiment. To aid in
the feature division process, the relevance of the 30 features
is determined by using the Chi-Square measure [16]. The
following is the feature ranking from most relevant to least
relevant: H, N, Z1, G, F, O, M, I, P, Z3, X, Z2, A, Z5, Z4, Y,
B, C, R, D, T, L, E, K, S, Q, U, W, J, V.
There are three datasets pairs (six datasets in total) that are
created from the Phishing Websites Base Dataset. A dataset
pair represents a source and target data pair. Each dataset
within the dataset pair contains 5,500 instances which are
randomly selected from the Base Dataset. Each dataset pair
is constructed to contain mutually exclusive features from the
Base Dataset.
The first dataset pair is created by evenly distributing the
features by order of relevance. For this case, the individual
datasets are referred to as 15AF and 15BF, where each dataset
contains 15 unique features. The next dataset pair, referred to
as 10AF and 10BF, is created by eliminating the five least
relevant features from the 15AF and 15BF datasets. The 10AF
and 10BF datasets each have 10 unique features. The last
dataset pair, referred to as 9F and 21F, is created by assigning
the nine features used from the work of Abdelhamid et al.
[17] to the 9F dataset. Then, the remaining 21 features are
assigned to the 21F dataset. The 9F dataset has a higher
concentration of high-ranked relevant features as compared
to the 21F dataset. The class balance for each dataset is
maintained at approximately 55% for the “Phishing” class.
The dataset pairs are summarized in Table I.
C. Algorithms Tested
The algorithm structure used for our experiment is depicted
in Figure 1. For the “Heterogeneous Transfer Learning” section, we use the Canonical Correlation Analysis algorithm as
developed by Yi-Ren et al. [9]. Source and target data with
different feature spaces are input to the CCA algorithm. The
output (“Feature Aligned Data”) is a transformed source and
target data with the same feature spaces. This information
193
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
TABLE I
D EFINITION OF DATASET PAIRS
Dataset Name
15AF
15BF
10AF
10BF
9F
21F
the Geodesic Flow Kernel (GFK) algorithm [22], the Joint
Domain Adaptation (JDA) algorithm [23], the Transfer Joint
Matching (TJM) algorithm [24], the Graph Co-Regularization
Transfer Learning (GTL) algorithm [25], the Transfer Kernel
Learning (TKL) algorithm [26], and the Transfer Component
Analysis (TCA) algorithm [27]. These seven homogeneous
transfer learning algorithms require labeled source data and
unlabeled target data. All seven of the transfer learning algorithms are open source implementations written in the MATLAB programming language. The four traditional machine
learning algorithms used in our experiment are SVM [28], 5Nearest Neighbors (5NN) [29], Logistic Regression (LR) [30],
and Random Forest (RF) [31].
The ARTL algorithm simultaneously resolves marginal and
conditional distribution differences, while learning the final
classification model. Pseudo labels are discovered for the
unlabeled target data in an attempt to resolve the conditional
distribution differences. The pseudo labels are found using
an L2-regularized Logistic Regression model trained with the
labeled source data. The distribution alignment and learning
process are integrated into a Regularized Least Squares classification model.
The GFK algorithm uses a feature reduction process to reduce the marginal distribution differences between the source
and target data. The domain adaptation process further employs a geodesic flow kernel built with the reduced input
feature space. The geodesic flow kernel projects a large number of subspaces onto the geodesic flow curve. The geodesic
flow curve creates a smoothing function for the geometric and
statistical properties between the target and source data. The
GFK algorithm then finds domain-invariant subspaces on the
geodesic flow curve to further reduce the marginal distribution
differences between the target and source data. These domaininvariant subspaces are used to train a 5NN traditional learner.
The JDA algorithm simultaneously corrects for the marginal
and conditional distribution differences between the source and
target data. A modified Principal Component Analysis (PCA)
step is used for dimensionality reduction. This modified PCA
algorithm is integrated with the Maximum Mean Discrepancy
distance measure, which is used to resolve the marginal
distribution differences. The labeled source data is used to
train a classifier that generates pseudo labels, which are used
in the conditional distribution correction process. An SVM
traditional learner is trained with the distribution aligned data.
The TJM algorithm performs a domain adaptation process
by first reducing the marginal distribution between the source
and target data. Using PCA, the TJM algorithm performs
a dimensionality reduction step. Next, a feature matching
process is employed using the Maximum Mean Discrepancy
measure in a Reproducing Kernel Hilbert Space. An instance
reweighing procedure is used to further reduce the distribution
differences between the source and target. Irrelevant instances
are eliminated during this step. The modified source data is
used to train a 5NN traditional learner.
The GTL algorithm uses a Nonnegative Matrix Factorization
(NMF) [32] technique to reduce the marginal distribution
Features
C,E,L,M,N,O,Q,R,U,V,X,Z1,Z3,Z4,Z5
A,B,D,F,G,H,I,J,K,P,S,T,W,Y,Z2
C,M,N,O,R,X,Z1,Z3,Z4,Z5
A,B,D,F,G,H,I,P,Y,Z2
A,B,H,M,N,P,V,X,Z1
C,D,E,F,G,I,J,K,L,O,Q,R,S,T,U,W,Y,Z2,Z3,Z4,Z5
(along with the class labels for the source data) is input to
the “Learning Algorithm” section. The Learning Algorithm
section uses either a traditional machine learning model or a
homogeneous transfer learning model.
Source
Features
Target
Features
Heterogeneous Transfer
Learning
Feature Aligned Data
Learning Algorithm
Classified Output
Fig. 1. Block diagram of the experiment algorithm structure
1) Heterogeneous Transfer Learning: Canonical Correlation Analysis is a process of discovering basis vectors for
two different sets of variables. The CCA process attempts to
mutually maximize the correlation between the projection of
the variables onto the basis vectors. The linear transformation
that is found by the CCA process creates a pair of transformed
variable sets that have maximized correlation [18]. After the
CCA transformation, the source and target input feature spaces
are the same. For complete technical details of the algorithm
refer to Yi-Ren et al. [9].
The CCA algorithm does not require class labels to perform
the feature transformation. At the input to the CCA algorithm,
we create an additional input feature for the source data, that
directly represents the source class label. The target feature
space remains unchanged. The addition of the source class
label to the source input feature space adds further information
during the transformation process and is found to have overall
better performance in our testing as compared to not including
this extra feature. The CCA algorithm used in our experiment
is an open source implementation written in the MATLAB
[19] programming language.
2) Learning Algorithms: There are seven state-of-the-art
homogeneous transfer learning algorithms [20] and four traditional learning algorithms used as the Learning Algorithm
block in our experiment. The seven homogeneous transfer
learning methods used in our experiment include the Adaptation Regularization Transfer Learning (ARTL) algorithm [21],
194
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
similarity function to determine the nearest neighbors. The
5NN algorithm is implemented in MATLAB.
differences between the target and source data. The NMF
step finds common latent features through collective matrix
factorization, while preserving the statistical and geometric properties of the target and source data. A graph coregularization process is integrated into the NMF technique
to further refine the common features. The NMF process is
used as the underlying learning model for the GTL algorithm.
The TKL algorithm uses a Reproducing Kernel Hilbert
Space to align the source and target marginal data distributions
differences. At the same time, it learns a domain-invariant
kernel. These extrapolated kernel spaces use the Nyström
approximation error to represent the distribution differences.
Numerous spectral kernels are created by using a target
eigensystem technique on the source data. The final kernel
is selected from the spectral kernel that most closely matches
the target kernel. The data from the domain-invariant kernel
is used to train an SVM traditional learner.
The TCA algorithm attempts to find common latent features
that have similar marginal distributions across the target and
source data. The latent features are discovered using a Reproducing Kernel Hilbert Space. The Maximum Mean Discrepancy measure is used to determine the marginal distribution
differences. After the latent features with reduced marginal
distribution differences are found, an SVM model is trained
as the traditional learner.
The LR algorithm is a statistical learning method, that is
used for binary classification. The LR model is found using an
algebraic equation of summed terms, where each input feature
is represented by a single term with a corresponding coefficient. The result of the algebraic equation is the probability of
one of the output classes. The MATLAB command “glmfit” is
used to implement the LR model. Default parameters are used
with the exception of the distribution parameter being set to
“binomial” and the link parameter being set to “logit.”
The SVM model is an algorithm that finds the maximum
margin linear or non-linear hyperplane within an instance
space, which provides the greatest separation between the
classes. The nearest instances to the hyperplane form the
support vectors. In our experiment, the LIBSVM software [33]
is used with a Gaussian radial basis function kernel. The SVM
model is run in a MATLAB environment. Default parameters
are used with the exception of the “C” parameter, which is
uniquely set per dataset.
The RF model is an ensemble-based prediction method,
where the ensemble is comprised of N unpruned decision
trees. The training process for each of the N decision trees
creates random datasets using sampling with replacement.
This training process ensures low model bias and decreased
performance variance. The classification result is found by the
majority vote (or average) of the ensemble of decision trees.
The MATLAB command “TreeBagger” is used to implement
the RF model. The NumTrees parameter (N) is set to 100.
Settings greater than 100 did not produce better results.
The 5NN learning model predicts a test instance by a
majority vote of the five nearest training instances to that
particular test instance. Euclidean distance is used as the
D. Experiment Test Definition and Parameter Setting
For the tests performed in our experiment, the source and
target data each contain 5,500 instances. For our experiment,
we assume a machine learning application environment with
similar negative and positive class importance. The positive
class (the Phishing class) balance for both the source and
target data is approximately 55%. For all tests, the classifier’s
discriminative threshold setting is set to a default of equal cost
for a false negative and a false positive. Classification accuracy
is selected as the performance measure [34].
The homogeneous transfer learning algorithms in our experiment have parameter settings that impact performance.
The algorithm parameters are individually set as a function
of the dataset used. The parameters used for our experiment
are discovered by testing different parameter combinations for
each dataset. The original algorithm manuscripts are used as
a reference to determine the best range of values to search
from. The source and target data are drawn from the same
dataset (domain) during the parameter setting process. The
algorithm parameters are summarized in Table IV (located in
the Appendix).
IV. D ISCUSSION OF R ESULTS
This section examines the results of the CCA algorithm
coupled with seven different homogeneous transfer learning algorithms and four traditional learning algorithms, when tested
with the defined dataset pairs. Table II shows the accuracy
results of the traditional learners using 5-fold cross-validation
for each of the six datasets defined in Section III-B. Table II
serves as an upper bound reference on the performance results
for this experiment. The average of all the results from Table
II is 87.5%.
TABLE II
5- FOLD CROSS - VALIDATION FOR EACH INDIVIDUAL DATASET
Algorithm
SVM
5NN
LR
RF
15AF
89.7%
87.0%
88.1%
90.0%
15BF
90.0%
86.8%
87.5%
90.0%
10AF
88.6%
86.6%
87.6%
88.6%
10BF
90.4%
87.7%
88.8%
90.5%
9F
92.2%
90.8%
91.4%
92.5%
21F
82.0%
78.2%
74.5%
81.0%
Three dataset pairs are initially defined in Section III-B.
The source and target are reversed for each dataset pair to
create a total of six dataset pairs. Table III shows the results
for the six dataset pair combinations that are tested. The
first seven algorithms listed are homogeneous transfer learning
algorithms and the last four algorithms are traditional machine
learning algorithms. A dataset pair is identified as the source
dataset followed by the target dataset (e.g. source/target).
From Table III, it is observed that both the SVM and
TCA algorithms show no predictive capabilities for all of
the six dataset pairs. The TCA transfer learning algorithm
uses an SVM model as its base traditional learner. However,
the TKL and JDA transfer learning algorithms also use an
195
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
TABLE III
C LASSIFICATION ACCURACY FOR DIFFERENT DATASET PAIRS AND ALGORITHMS USING THE CCA ALGORITHM
Algorithms
ARTL
GFK
JDA
TJM
GTL
TKL
TCA
SVM
5NN
LR
RF
Average
15AF/15BF
88.9%
79.9%
88.1%
88.4%
85.9%
88.6%
45.3%
44.0%
75.9%
88.7%
88.7%
78.4%
15BF/15AF
86.1%
73.4%
79.8%
86.3%
86.3%
85.3%
55.4%
55.4%
77.8%
87.1%
87.1%
78.2%
Source Dataset / Target Dataset
10AF/10BF
10BF/10AF
9F/21F
89.0%
85.7%
71.6%
82.6%
78.9%
63.7%
88.5%
81.8%
73.6%
88.2%
84.5%
74.3%
87.8%
86.2%
71.6%
88.9%
85.7%
71.6%
44.0%
55.4%
56.0%
44.0%
55.4%
44.0%
84.4%
79.3%
63.3%
88.7%
87.0%
72.2%
88.9%
86.9%
72.0%
79.5%
78.8%
66.7%
SVM model as its base traditional learner. Both the TKL and
JDA algorithms demonstrate good predictive capabilities over
the six dataset pairs tested. Therefore, the poor performance
of the TCA algorithm cannot be directly linked to the poor
performance of the SVM algorithm. With the exception of the
SVM and TCA algorithms, all other algorithms demonstrate
good predictive capabilities over the six dataset pairs.
With respect to the highest performing algorithms for each
of the dataset pairs, the ARTL algorithm has the highest
accuracy in three cases, the TJM algorithm in one case, the
LR algorithm in three cases, and the RF algorithm in one case.
The highest performing algorithm is displayed in bold text for
each column in Table III.
The last column in Table III shows the average accuracy
for each algorithm over the six dataset pairs. The two top
performing models are the RF and LR algorithms. Most
notably, nine of the eleven algorithms are at or above 77%
accuracy, which is within 10% of the average cross-validation
results from Table II. Further, six of the algorithms are within
3% of the of the average cross-validation results.
From Table III, it is observed that the homogeneous transfer
learning algorithms do not demonstrate a performance advantage over the traditional learning algorithms. Both the transfer
learning and traditional learning algorithms have an example
of poor performance (e.g. TCA and SVM, respectively). Also,
both the transfer learning and traditional learning algorithms
have examples of high performers (e.g. ARTL and TJM for
transfer learning, and LR and RF for traditional machine
learning).
The 10AF and 10BF datasets are derived by removing the
five least relevant features from both the 15AF and 15BF
datasets, respectively. We want to understand the impact of
the five extra features on the CCA transformation. From
Table III, both the 10AF/10BF and 10BF/10AF average results
are marginally higher than the 15AF/15BF and15BF/15AF
average results. The removal of the five least relevant features
has a minimal impact on the results.
The 9F dataset is constructed with a higher concentration
of relevant features as compared to the 21F dataset. This is
evidenced by the individual dataset cross-validation results
from Table II, where the 9F dataset has at least a 10% accuracy
21F/9F
91.0%
83.5%
88.4%
90.5%
89.6%
90.6%
47.3%
44.6%
83.5%
91.0%
90.9%
81.0%
Average
85.3%
77.0%
83.4%
85.4%
84.6%
85.1%
50.6%
47.9%
77.4%
85.8%
85.8%
77.1%
advantage over the 21F dataset for each learner. When using
the 9F and 21F dataset pair with the CCA algorithm, Table
III shows that the 21F/9F dataset pair has an average accuracy
advantage of approximately 14% over the 9F/21F dataset pair.
Using the dataset with the least relevant features as the target
(e.g. 21F) has a negative impact of the results as compared to
using that dataset as the source.
V. C ONCLUSION
Our experiment performs heterogeneous transfer learning
tests on the application of predicting phishing webpages. We
construct six dataset pairs from a Base Dataset, where each
dataset pair contains mutually exclusive features. A heterogeneous transfer learning technique called Canonical Correlation
Analysis is used to align the features in the dataset pair. Then,
seven homogeneous transfer learning and four traditional machine learning algorithms are used to learn and predict the
transformed input feature space. We have demonstrated that
nine of the eleven algorithms show good predictive capabilities
for detecting phishing webpages, with two algorithms showing
no predictive capabilities. The homogeneous transfer learning
algorithms did not have a performance advantage over the
traditional machine learning algorithms. This investigation is
a benefit to a machine learning practitioner, who is in search
of a solution for the application of phishing website detection,
where the available labeled training does not have the same
input feature space as the testing data. We are not aware of
other works that have applied heterogeneous transfer learning
methods coupled with both homogeneous transfer learning
and traditional machine learning methods to the application
of phishing website detection. Areas of future work include
expanding the constructed dataset pairs to include a wider
range of feature differences and testing different traditional
machine learners.
ACKNOWLEDGMENT
The authors gratefully acknowledge partial support by
the National Science Foundation, under grant number CNS1427536. Any opinions, findings, and conclusions or recommendations expressed in this paper are those of the author(s)
196
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.
and do not necessarily reflect the views of the National Science
Foundation.
[22] B. Gong, Y. Shi, F. Sha, and K. Grauman, “Geodesic flow kernel
for unsupervised domain adaptation,” Proceedings of the 2012 IEEE
Conference on Computer Vision and Pattern Recognition, pp. 2066–
2073, 2012.
[23] M. Long, J. Wang, G. Ding, J. Sun, and P. S. Yu, “Transfer feature
learning with joint distribution adaptation,” in 2013 IEEE International
Conference on Computer Vision, 2013, pp. 2200–2207.
[24] M. Long, J. Wang, G. Ding, J. Sun, and P. Yu, “Transfer joint matching
for unsupervised domain adaptation,” in 2014 IEEE Conference on
Computer Vision and Pattern Recognition, 2014, pp. 1410–1417.
[25] M. Long, J. Wang, G. Ding, D. Shen, and Q. Yang, “Transfer learning
with graph co-regularization,” IEEE Transactions on Knowledge and
Data Engineering, vol. 26, no. 7, pp. 1805–1818, 2014.
[26] M. Long, J. Wang, J. Sun, and P. S. Yu, “Domain invariant transfer kernel
learning,” IEEE Transactions on Knowledge and Data Engineering,
vol. 27, no. 6, pp. 1519–1532, 2015.
[27] S. J. Pan, I. W. Tsang, J. T. Kwok, and Q. Yang, “Domain adaptation via
transfer component analysis,” IEEE Transactions on Neural Networks,
vol. 22, no. 2, pp. 199–210, 2011.
[28] B. Schölkopf, C. J. C. Burges, and A. J. Smola, Eds., Advances in Kernel
Methods: Support Vector Learning. Cambridge, MA, USA: MIT Press,
1999.
[29] D. W. Aha, Ed., Lazy Learning. Norwell, MA, USA: Kluwer Academic
Publishers, 1997.
[30] T. M. Khoshgoftaar and E. B. Allen, “Logistic regression modeling of
software quality,” International Journal of Reliability, Quality and Safety
Engineering, vol. 6, no. 04, pp. 303–317, 1999.
[31] T. M. Khoshgoftaar, M. Golawala, and J. Van Hulse, “An empirical study
of learning from imbalanced data using random forest,” in 19th IEEE
International Conference on Tools with Artificial Intelligence (ICTAI
2007), vol. 2. IEEE, 2007, pp. 310–317.
[32] D. D. Lee and H. S. Seung, “Algorithms for non-negative matrix
factorization,” in In NIPS. MIT Press, 2000, pp. 556–562.
[33] C. Chang and C. Lin, “LIBSVM – A Library for Support Vector
Machines,” http://www.csie.ntu.edu.tw/∼cjlin/libsvm, [Online; accessed
2-Sept-2017].
[34] K. R. Weiss and T. M. Khoshgoftaar, “Analysis of transfer learning
performance measures,” in Information Reuse and Integration (IRI),
2017 IEEE International Conference on, 2017, pp. 338–344.
R EFERENCES
[1] “Internet users by country 2016,” [Online; accessed 2-Sept-2017].
[Online]. Available: http://www.internetlivestats.com/internet-users-bycountry
[2] “Internet
growth
statistics
1995
to
2017,”
[Online;
accessed
2-Sept-2017].
[Online].
Available:
http://www.internetworldstats.com/emarketing.htm
[3] “Global
retail
e-commerce
market
size,”
[Online;
accessed
2-Sept-2017].
[Online].
Available:
https://www.statista.com/statistics/379046/worldwide-retail-ecommerce-sales
[4] Maria
Korolov,
“Phishing
cost
for
large
businesses,”
[Online;
accessed
2-Sept-2017].
[Online].
Available:
https://www.csoonline.com/article/2975807/cyber-attacksespionage/phishing-is-a-37-million-annual-cost-for-average-largecompany.html
[5] R. M. Mohammad, F. A. Thabtah, and L. McCluskey, “Predicting
phishing websites based on self-structuring neural network.” Neural
Computing and Applications, vol. 25, pp. 443–458, 2014.
[6] K. Weiss, T. M. Khoshgoftaar, and D. Wang, “A survey of transfer
learning,” Journal of Big Data, vol. 3, no. 1, pp. 1–40, 2016.
[7] K. R. Weiss, T. M. Khoshgoftaar, and O. Rehman, “Designing a testing
framework for transfer learning algorithms,” in Information Reuse and
Integration (IRI), 2016 IEEE International Conference on. IEEE, 2016,
pp. 152–159.
[8] H. Shimodaira, “Improving predictive inference under covariate shift by
weighting the log-likelihood function,” Journal of Statistical Planning
and Inference, vol. 90, no. 2, pp. 227–244, 2000.
[9] Y. Yeh, C. Huang, and Y. F. Wang, “Heterogeneous domain adaptation
and classification by exploiting the correlation subspace,” IEEE Trans.
Image Processing, vol. 23, no. 5, pp. 2009–2018, 2014.
[10] J. T. Zhou, S. J. Pan, I. W. Tsang, and Y. Yan, “Hybrid heterogeneous
transfer learning through deep learning,” in Proceedings of the TwentyEighth AAAI Conference on Artificial Intelligence, ser. AAAI’14. AAAI
Press, 2014, pp. 2213–2219.
[11] M. Aburrous, M. A. Hossain, K. Dahal, and F. Thabtah, “Predicting
phishing websites using classification mining techniques with experimental case studies,” in 2010 Seventh International Conference on
Information Technology: New Generations, April 2010, pp. 176–181.
[12] Y. Pan and X. Ding, “Anomaly based web phishing page detection,”
in 2006 22nd Annual Computer Security Applications Conference (ACSAC’06), Dec 2006, pp. 381–392.
[13] I. Fette, N. Sadeh, and A. Tomasic, “Learning to detect phishing emails,”
in Proceedings of the 16th International Conference on World Wide Web,
ser. WWW ’07. ACM, 2007, pp. 649–656.
[14] R. M. Mohammad, F. A. Thabtah, and L. McCluskey, “Predicting
phishing websites based on self-structuring neural network,” Neural
Computing and Applications, vol. 25, no. 2, pp. 443–458, 2014.
[15] M. Lichman, “UCI machine learning repository,” 2013, [Online;
accessed 2-Sept-2017]. [Online]. Available: http://archive.ics.uci.edu/ml
[16] I. H. Witten and E. Frank, Data Mining:Practical Machine Learning
Tools and Techniques, 3rd ed. Morgan Kaufmann, 2011.
[17] N. Abdelhamid, A. Ayesh, and F. Thabtah, “Phishing detection based
associative classification data mining,” vol. 41, p. 59485959, 10 2014.
[18] D. R. Hardoon, S. R. Szedmak, and J. R. Shawe-taylor, “Canonical
correlation analysis: An overview with application to learning methods,”
Neural Comput., vol. 16, no. 12, pp. 2639–2664, Dec. 2004.
[19] The MathWorks Inc, “Matlab and statistics toolbox release
2016a,” [Online; accessed 2-Sept-2017]. [Online]. Available:
https://uk.mathworks.com/products/matlab.html
[20] K. R. Weiss and T. M. Khoshgoftaar, “Analysis of a transfer learning
application using the transfer learning test framework,” in 23rd ISSAT
International Conference on Reliability and Quality in Design, Aug
2017, pp. 151–156.
[21] M. Long, J. Wang, G. Ding, S. J. Pan, and P. S. Yu, “Adaptation regularization: A general framework for transfer learning,” IEEE Transactions
on Knowledge and Data Engineering, vol. 26, no. 5, pp. 1076–1089,
2014.
A PPENDIX
The settable algorithm parameters for each dataset are
captured in Table IV.
TABLE IV
S ETTABLE ALGORITHM PARAMETERS USED IN OUR EXPERIMENT
Algorithm
(Parameters)
ARTL (p,σ,λ,γ)
GFK (d)
JDA (k,λ,γ,T,C)
TJM (k,λ,T)
GTL (p,λ,γ,σ,T)
TKL (ζ,C)
TCA (d,σ,C)
Algorithm
(Parameters)
ARTL (p,σ,λ,γ)
GFK (d)
JDA (k,λ,γ,T,C)
TJM (k,λ,T)
GTL (p,λ,γ,σ,T)
TKL (ζ,C)
TCA (d,σ,C)
15AF
15BF
10AF
4,.2,1,.1
5
15,5,.25,5,10
12,5,10
14,1,1,100,5
.8,2
15,8,2
4,.1,5,.25
5
10,5,.1,10,1
10,10,5
5,.1,10,100,5
1.1,10
10,4,1
4,.1,5,.25
4
9,5,.1,10,1
9,10,5
5,.1,10,100,5
1.1,10
9,4,5
10BF
9F
21F
4,.1,5,.25
5
9,5,.1,10,1
9,10,5
8,.1,10,100,5
1.1,10
9,4,5
4,.2,1,.1
5
10,5,.25,5,10
10,5,10
9,1,1,100,5
.8,2
10,8,2
4,.1,5,.25
4
10,5,.1,10,1
10,10,5
5,.1,10,100,5
1.1,10
10,4,5
197
Authorized licensed use limited to: Zhengzhou University. Downloaded on May 29,2025 at 13:55:49 UTC from IEEE Xplore. Restrictions apply.