Intelligent Rule-based Phishing Websites Classification Based on URL Features

A rule-based classifier that detects phishing websites from their URL features, such as length, use of IP addresses, special symbols and domain identity, protecting users who shop and bank online.

A dataset is collected or downloaded and cleaned: missing values, duplicates and outliers are handled. Features are selected and encoded, and the data is split into training and test sets. Several algorithms are trained and compared, and the best one is tuned. The final model runs behind a simple web form where the user enters values and gets the prediction with its confidence.

We compared a few suitable algorithms (for example logistic regression, decision tree, random forest and SVM) on the same train-test split and chose the one with the best balance of accuracy, recall and speed for this data.

Accuracy is correct predictions over all predictions. Precision is how many predicted positives are truly positive. Recall is how many actual positives were found. When classes are imbalanced, precision and recall matter more than accuracy.

Symmetric encryption (AES, DES) uses one shared key for encryption and decryption and is fast. Asymmetric encryption (RSA) uses a public key to encrypt and a private key to decrypt, which solves key sharing but is slower.

A hash is one-way, so even the administrator cannot recover the password. We add a random salt and use a slow hash such as bcrypt so stolen hashes are hard to crack.

It follows a three-tier architecture: the browser shows the user interface, the server-side code handles logic and validation, and the MySQL database stores records. Requests travel over HTTP and responses are rendered as HTML or JSON.

We followed an iterative (incremental) model: requirements and a basic design first, then modules built and tested one by one, with the guide's feedback after each review. It suits a project where requirements become clearer as we build.

Unit testing of each module, integration testing of the complete flow and system testing with real inputs. Test cases with expected and actual results are listed in the report, including invalid inputs.

The current version is tested on a limited dataset or number of users. Future work includes deploying on the cloud, adding more features or languages, improving accuracy with more data and building a mobile version.