Web Phishing Detection Using a Deep Learning …downloads.hindawi.com/journals/wcmc/2018/4678746.pdfWeb Phishing Detection Using a Deep Learning Framework PingYi ,1 YuxiangGuan,1 FutaiZou,1

Research ArticleWeb Phishing Detection Using a Deep Learning Framework

Ping Yi 1 Yuxiang Guan1 Futai Zou1 Yao Yao2 Wei Wang2 and Ting Zhu 2

1School of Cyber Security Shanghai Jiao Tong University Shanghai 200240 China2Department of Computer Science and Electrical Engineering University of Maryland Baltimore County MD 21250 USA

Correspondence should be addressed to Ping Yi yipingsjtueducn

Received 2 June 2018 Revised 1 August 2018 Accepted 2 September 2018 Published 26 September 2018

Academic Editor Tony T Luo

Copyright copy 2018 Ping Yi et al This is an open access article distributed under the Creative Commons Attribution License whichpermits unrestricted use distribution and reproduction in any medium provided the original work is properly cited

Web service is one of the key communications software services for the Internet Web phishing is one of many security threatsto web services on the Internet Web phishing aims to steal private information such as usernames passwords and credit carddetails by way of impersonating a legitimate entity It will lead to information disclosure and property damage This paper mainlyfocuses on applying a deep learning framework to detect phishing websites This paper first designs two types of features for webphishing original features and interaction features A detection model based on Deep Belief Networks (DBN) is then presentedThe test using real IP flows from ISP (Internet Service Provider) shows that the detecting model based on DBN can achieve anapproximately 90 true positive rate and 06 false positive rate

1 Introduction

Web service is a communication protocol and softwarebetween two electronic devices over the Internet [1] Webservices extends the World Wide web infrastructure toprovide the methods for an electronic device to connect toother electronic devices [2] Web services are built on topof open communication protocols such as TCPIP HTTPJava HTML and XML Web service is one of the greatestinventions of mankind so far and it is also the most profoundmanifestation of computer influence on human beings [3]

With the rapid development of the Internet and theincreasing popularity of electronic payment in web serviceInternet fraud and web security have gradually been themainconcern of the public [4] Web Phishing is a way of suchfraud which uses social engineering technique through shortmessages emails and WeChat [5] to induce users to visitfake websites to get sensitive information like their privateaccount token for payment credit card information and soon

Thefirst phishing attack onAOL (AmericaOnline) can betraced back to early 1995 [6] A phisher successfully obtainedAOL users personal information It may lead to not only theabuse of credit card information but also an attack on theonline payment system entirely feasible

The phishing activity in early 2016 was the highest everrecorded since it beganmonitoring in 2004The total numberof phishing attacks in 2016 was 1220523 This was a 65percent increase over 2015 In the fourth quarter of 2004there were 1609 phishing attacks per month In the fourthquarter of 2016 there was an average of 92564 phishingattacks per month an increase of 5753 over 12 years[7] According to the 3rd Microsoft Computing Safer IndexReport released in February 2014 the annual worldwideimpact of phishing could be as high as $5 billion [8] Withthe prevalence of network phishing has become one of themost serious security threats in modern society thus makingdetecting and defending against web phishing an urgent andessential research task Web phishing detection is crucial forboth private users and enterprises [9]

Some possible solutions to combat phishing were cre-ated including specific legislation and technologies From atechnical point of view the detection of phishing generallyincludes the following categories detection based on a blacklist [10] and white list detection based on Uniform ResourceLocator (URL) features [11] detection based on web contentand detection based on machine learning The antiphishingway using blacklist may be an easy way but it cannot findnew phishing websites The detection on URL is to analyzethe features of URL The URL of phishing websites may

HindawiWireless Communications and Mobile ComputingVolume 2018 Article ID 4678746 9 pageshttpsdoiorg10115520184678746

2 Wireless Communications and Mobile Computing

be very similar to real websites to the human eye butthey are different in IP The content-based detection usuallyrefers to the detection of phishing sites through the pagesof elements such as form information field names andresource reference

In this paper we will focus on the detection model usinga deep learning framework The main contributions are asfollows

(i) We present two feature types for web phishing detec-tion an original feature and an interaction featureThe original feature is the direct feature of URLincluding special characters in URL and age of thedomain The interacting feature is the interactionbetweenwebsites including in-degree and out-degreeof URL

(ii) We introduce DBN to detect web phishing Wediscuss the training process of DBN and get theappropriate parameters to detect web phishing

(iii) We use real IP flows data from ISP to evaluatethe effectiveness of the detection model on DBNTrue Positive Rate (TPR) with different parameters isanalyzed our TPR is approximately 90

The paper is organized as follows Related works arediscussed in Section 2 The detection model and algorithmare discussed in Section 3 DBN is tested and evaluated inSection 4 The conclusion is drawn in Section 5

2 Related Works

Researchers have conducted lot of work in security [12ndash18]including secure routing [19ndash21] intrusion detection [22ndash27] intrusion prevention [28] and smart grids security [29]Different from research problems in wireless networks [30ndash60] and energy networks [61ndash64] web phishing is the attemptto acquire sensitive information such as usernames pass-words and credit card details often for malicious reasonsby masquerading as a trustworthy website on the InternetResearchers present some solutions to detect web phishing asfollows

When we judge whether a specific website is web phish-ing the direct way is to use a white list or black list Wemay search the URL in some database and decide PawanPrakash et al [10] presented two ways to detect phishingwebsites by the blacklist The first way includes five heuristicsto enumerate simple combinations of known phishing sitesto discover new phishing URLs The second way consists ofan approximate matching algorithm that dissects a URL intomultiple components that are matched individually againstentries in the blacklist Many well-known browser vendorssuch as Firefox [65] and Chrome [66] also used a self-built orthird-party black-white list to identify whether the URL is aphishing siteThis method is very accurate but its blacklist orwhitelist usually relies onmanual maintaining and reviewingObviously these methods are not real time and may cost a lotof time and effort

Another phishing detection way is to analyze the featuresof URL For example sometimes a URL looks similar to the

famous site URL or contains some special characters in theURL Samuel Marchal et al [11] used one concept of intra-URL relatedness and evaluate it using features extracted fromwords that compose a URL based on query data fromGoogleand Yahoo search engines These features are then usedin machine-learning-based classification to detect phishingURLs from a real data set This method is efficient andeconomical because it utilizes the preexisting knowledge ofthe URL which has a fast detection speed and a lowercost However we cannot fully exploit the characteristics ofphishing in terms of an URL only because the essence ofthe scheme is to fraud by means of web content Phishingattackers are very likely familiar with URLs and easily tailortheir URLs to avoid detection therefore this method willresult in a lower detection rate if only the information of theURL is checked

The content-based detection usually refers to the detec-tion of phishing sites through the pages of elements suchas form information field names and resource referenceAnthony Fu et al [67] proposed an approach to detectphishing web page using Earth moverrsquos distance (EMD) tomeasure web page visual similarity The accuracy rate of thismethod is high But at the same time the downside is a needto collect large amounts of data as a priori knowledge

With the popularity of machine learning phishing detec-tion has focused on the use of machine learning algorithmsThis method integrates URL text features domain namefeatures and web content features into a unified detectionbasis W Chu et al [68] presented a machine learningalgorithm based on phishing detection using only lexical anddomain features J Ma et al [69] described an approach toclassifying URLs automatically as either malicious or benignbased on supervised learning across both lexical and host-based features In general the essence of these methods ofmachine learning detection is to map all the features ofthe phishing website into the same space and then to usethe machine learning and data mining algorithms to detectphishing

3 The Phishing Detection Model Basedon DBN

31 Phishing Feature Extraction and Definition First we getreal traffic flow from ISP The data set includes traffic flow for40 minutes and 24 hours We construct the graph structureof traffic flow and analyze the characteristics of web phishingfrom the view of the graph

Each piece of data contains the following fields

(i) 119860119863 user node number(ii) 119868119875 user IP address(iii) 119879119878 access time(iv) 119880119877119871 Uniform Resource Locator access web address(v) 119877119864119865 request page source(vi) 119880119860 user browser type(vii) 119863119878119879 minus 119868119875 server address to access(viii) 119862119870119864 User Cookie

Wireless Communications and Mobile Computing 3

A graph is mathematical structures used to model pair-wise relations between objects It is also a very direct wayto describe the relationship between nodes in a networkThe relationship between the nodes on the Internet canalso be expressed through the graph structure Thereforewe construct a graph to store the real traffic flow data anddescribe the relationship between the nodes in traffic flow

Give an undirected graph 119866 = (119881 119864) where 119881 includestwo kinds of node

(i) user node 119860119863(ii) access 119880119877119871 and 119877119864119865 119864 sub 119881 times 119881 denotes an access

relationship between 119877119864119865 119860119863 and 119880119877119871

The vertices of the graph 119866 = (119881 119864) are as follows

(i) User node 119881119860119863 has one attribute total access times(vertex out-degree)

(ii) User node 119881119880119877119871 has two attributes total accessedtimes (vertex in-degree) and website registrationtime

The edges of the graph 119866 = (119881 119864) are as follows

(i) The number of visits which corresponds to thenumber of occurrences of the edge the number oftimes anADmayhave access to aURL or the numberof direct links between two URLs depending on thecorresponding vertex type

(ii) Cookie the cookie field in the access record(iii) UA User Agent in the access record

32 Feature Definition We define two kinds of features todetect web phishing and they are an original feature andinteractive feature

321 Original Feature There are some features in the phish-ing URL such as special charactersWe definite these featuresin URL as an original feature as follows

(i) 1198741 there are special characters in URL such as Unicode and so on Those special characters are notallowed in a normal URL

(ii) 1198742 there are too many dots or less than four dots innormal URL

(iii) 1198743 the age of the domain is too short For examplethe age of the normal domain is more than 3 months

In order to quantify the above characteristics all thecharacteristic values are binary that is one of 0 or 1Intuitively the more of the 1 appear in the feature the higherthe likelihood that the site will be a phishing site

322 Interaction Feature There are some features in graph119866 = (119881 119864) such as access frequency We define these featuresthrough a node relationship as interaction feature as follows

(i) 1198681 in-degree of 119880119877119871 node from 119877119864119865 is very small Ingeneral the normal websites do not link to phishingsites The phishing sites are directly accessed

Require Visible Layer 119881 = V1 V119898 Hidden Layer119867 = ℎ1 ℎ119899

Ensure Gradient Approximation Δ120579 larr997888 Δ119908119894119895 Δ119886119894 Δ119887119895 fori in 1119899 j in 1119898

1 for 119894 in 1119899 119895 in 1119898 do2 Initialize Δ119908119894119895 = Δ119886119894 = Δ119887119895 = 03 end for4 for Each V in V do5 V0 larr997888 V6 for 119905 in 0119896 minus 1 do7 for 119894 in 1119899 do8 Sample ℎ119905119894 sim 119901(ℎ119894|V119905)9 end for10 for 119895 in 1119898 do11 Sample V119905119895 sim 119901(V119895|ℎ119905)12 end for13 end for14 end for15 for 119894 in 1119899 119895 in 1119898 do16 Δ119908119894119895 larr997888 Δ119908119894119895 + 119901(ℎ119894|V0)V0119895 minus 119901(ℎ119894|V119896)V11989611989517 Δ119886119894 larr997888 Δ119886119894 + 119901(ℎ119894|V0) minus 119901(ℎ119894|V119896)18 Δ119887119895 larr997888 Δ119887119895 + V0119895 minus V11989611989519 end for

Algorithm 1 119896-step CD-119896

(ii) 1198682 out-degree of 119880119877119871 node is very small In order toget personal private information the phishing sitesare usually terminal websites and do not link to theother sites

(iii) 1198683 the frequency of 119880119877119871 from 119860119863 is one In generalone user accesses the phishing site only one time andthe user cannot access the phishing sitemore than onetime

(iv) 1198684 when 119860119863 accesses 119880119877119871 user browser type 119880119860 isnot the main browser Well-known browser vendorsoften have a built-in filtering phishing site plug-in Auser who uses unknown browsers is more likely toaccess the phishing sites

(v) 1198685 there is no cookie in user The phishing site doesnot leave its cookie in user

33 Detection Based on DBN DBN is one of the deep learn-ing models each of which is a restricted type of Boltzmannmachine that contains a layer of visible units that representingthe data [70]

DBN can extract phishing features from a data set Thekey to training a DBN is how to determine some parametersAccording to Hinton and Salakhutdinov [71] we selectContrastive Divergence (CD) as training algorithm whichcalculates the gradient through 119896 times of Gibbs Sampling[72] The pseudocode of 119896-step CD-119896 is in Algorithm 1

119908119894119895 is the weight matrix of all edges 119886119894 and 119887119895 arerespectively the offset vector of the visible and hidden layersand Sample is Gibbs Sampling [72] We can get a set of


Require Period 119879 Learning Rate 120578 Momentum 120588 VisibleLayer 119881 Hidden Layer 119867 Number of visible andhidden layer units 119899V 119899ℎ Offset Vector 119886 119887 WeightMatrix119882

Ensure 120579 = 119882 119886 1198871 Initialize 119882 119886 1198872 for 119894 isin 1119879 do3 Calling CD-119896 to generateΔ120579 = Δ119882Δ119886 Δ1198874 119882 larr997888 120588119882 + 120578((1119899V)Δ119882)5 119886 larr997888 120588119886 + 120578((1119899V)Δ119886)6 119887 larr997888 120588119887 + 120578((1119899V)Δ119887)7 end for

Algorithm 2 Training process

parameters 120579 = 119908119894119895 119886119894 119887119895 by this algorithm The gradient offormula is as

119862119863119896 (120579 V0) = minussum

ℎ

119901 (ℎ | V0)120597119864 (V0 ℎ)

120597120579

+ sumℎ

119901 (ℎ | V119896)120597119864 (V119896 ℎ)

120597120579

(1)

First we set initialization parameters The weight matrixobeys the normal distribution (0001) We set visible layeroffset 119886119894 as

119886119894 = ln119901 (V119894)

1 minus 119901 (V119894)(2)

where 119901(V119894) is the probability of the 119894 in the active state Forthe original feature we can determine the characteristics ofnonphishing sites and then calculate the ratio of nonphishingsites to take the back that is 119886119894 We set the offset vector ofhidden layers as 0 After initialization we start the trainingprocess and pseudocode is in Algorithm 2

The iteration period119879 and 119896 of CD-119896 do not have to selecta large number Hinton [71] discussed that the algorithm canget to good result even if 119896 = 1 The parameter 120578 is relatedto the concept of gradient ascent in Maximum likelihoodApproximation in Restricted Boltzmann Machine (RBM)

119871120579 = ln (119871 (120579 | 119881)) = ln119899

prod119894=1

119901 (V119894 | 120579)

=119899

sum119894=1

ln (119901 (V119894 | 120579))

(3)

In order to maximize 119871120579 we use the iterative (4)

120579 larr997888 120579 + 120578120597 ln (119871 (120579))120597120579

(4)

The learning rate 120578 is related to the convergence speed ofthe algorithm The larger the learning rate 120578 the faster theconvergence But there is no guarantee that the algorithm

always has a good result That is to say the algorithm stabilityis not high If the learning rate 120578 selects a smaller valuethe algorithm can guarantee the stability but at the sametime it leads to slower convergence speed The algorithm willrun for a long time To solve this problem the algorithmintroduces a momentum 120588 associated with the direction ofthe last parameter change in the algorithm to avoid prematureconvergence of the algorithm The iterative formula is asfollows

120579 larr997888 120588120579 + 120578120597 ln (119871 (120579))120597120579

(5)

The number of nodes on the hidden layers is entirelydetermined by the training effect and experience The classictraining process of DBN is in Hintonrsquos paper [71] We presenta training process as follows

(i) Step 1 to initialize set119874 of original features and set 119868 ofinteraction features we use set 1198810 = 119874 119868 as input ofthe bottom layer Then the DBN trains the first layerand gets the result 1198670 of the hidden layer

(ii) Step 2 the output from the previous layer is used asthe input feature of the next layer119881119894 = 119867119894minus1 and DBNgets the output 119867119894

(iii) Step 3 do Step 2 until getting to the top layer

(iv) Step 4 fine-tune weight matrix 119882 = 119908119894119895

The fine-tuning step is key to the training process of DBNin order to get better features from the data set There are anunsupervisedway and a supervisedway in the process of fine-tuning The Backpropagation is a supervised way [73] Thewake-sleep algorithm is an unsupervisedway [74]We use thesupervised way to fine-tune for we can calibrate the data bysome blacklists in advance

Since the entire DBN can be seen as a feature extractionprocess the output of the top RBM can be seen as a featurein a space At this point these features can be used as acommon machine learning algorithm input Although wecan do the processing of the top RBM directly as an inputto a classifier without any processing it is clear that theerror return can be obtained with fine-grained features undersupervised conditions Y Tang [75] describes a case in thetop classifier using Support Vector Machine (SVM) It isnot difficult to speculate that other binary classifiers are alsofeasible In addition it should be noted that the practice ofthe top classifier found that the characteristics of the originalinput and DBN extracted after the characteristics of theclassification will play a better classification effect This paperchooses SVM as a binary classifier and classifies the DBNfeatures together with the original features as SVM input

According to H Wang and B Raj [76] the time com-plexity of deep learning model including DBN is 119874(119897119900119892119899)S Bahrampour et al [77] do a comparative study of fivedeep learning frameworks namely Caffe Neon TensorFlowTheano and Torch The experimental results show the gradi-ent computation time of TensorFlow increases from 14ms to23ms while batch size increases from 32 to 1024


Table 1 Raw data statistics

Traffic in 40min Traffic in 24 hoursRecord Sum 882103 9774545Unique IP 13754 842601Unique AD 8533 467343Unique URL 36729 1982005

4 Test and Analysis

41 Test Data and Evaluation Criterion The test data comefrom ISP and are composed of two data sets The small dataset includes real traffic flow for 40 minutes The big data setincludes real traffic flow for 24 hours After pretreatment weget record sum unique IP unique AD and unique URL as inTable 1

This paper belongs to a classical binary classificationmodel application In the binary classification model theresults are usually marked as Positive (P) or Negative (N) Inthis paper the corresponding node is either a phishing site ornot a phishing site Then with the classification results with apriori facts there will be the following four categories

(i) True Positive (TP) is actually P and the classificationis also P

(ii) False Positive (FP) is actually N and the classificationis also P

(iii) True Negative (TN) is actually N and the classifica-tion is also N

(iv) FalseNegative (FN) is actually P and the classificationis also N

The above classification data can generate four categoriesof evaluation criterions with details as follows

(i) Accuracy (ACC)119860119862119862 = (119879119875+119879119873)(119879119875+119879119873+119865119875+119865119873)

(ii) True Positive Rate (TPR Recall) 119879119875119877 = 119879119875(119879119875 +119865119873)

(iii) False Positive Rate (FPR Fall-Out) 119865119875119877 = 119865119875(119865119875 +119879119873)

(iv) Positive Predictive Value (PPV Precision) 119875119875119881 =119879119875(119879119875 + 119865119875)

In this paper we use TPR as evaluation criterion

42 Experimental Environment and Parameter Setup In thispaper DBN experiments are conducted in stand-alone modeThe hardware environment includes CPU processor Inteli5-4570 quad-core 16G memory and the Nvidia GeForceseries GTX760 graphics card Deep learning algorithms oftenrequire high computational performanceMany popular deeplearning libraries use theGPU to increase computation speed

GPUMLib [78] is a GPU machine learning library Itmay use C++ and Compute Unified Device Architecture(CUDA) and has support for Backpropagation (BP) Multi-ple Backpropagation (MBP) Autonomous Training System

(ATS) for creating BP and MBP networks Neural SelectiveInputModel (NSIM) for BP andMPB RBM SVM and othercomputationally machine learning algorithms

SVM model can be seen as a shallow feature extraction(with a hidden layer) DBN selects at least two layers in orderto relatively enhance the feature selection effect and toomanylayers will lead to overfitting DBNmain module declarationis as in Listing 1

Some parameters are explained as follows

(i) layers the number of nodes per layer Here as thevisible layer has a total of 10 different variables as aset of features select 10 as the number of visible layernodes

(ii) inputs the matrix to be trained(iii) initialLearningRate learning rate(iv) momentum learning rate correction momentum

Select the default value(v) useBinaryValuesVisibleReconstruction whether to

use the binary value to reconstruct the visible layerSelect the initial value false

(vi) stdWeights the upper and lower bounds of the weightmatrix are initialized

The number119873 of DBN layer is one of the key parametersof the DBN algorithm In this paper we do not specify a fixedvalue for119873 because119873 is regarded as change parameter to testthe DBNWe set the number of each layer to 10The learningrate 120578 is in [001 01] and sets as 01 for faster learning rateThe momentum 120588 sets as the default value

43 Experiment and Analysis There are three parameters toaffect the accuracy They are the number119873 of DBN layer thenumber 119879 of iterations per layer and the number of nodes inhidden layers L McAfee [79] shows that when the numberof iterations and the number of hidden layer nodes exceed acertain threshold the precision of the algorithm will reach ahigher level With the number of iterations or hidden layernodes increase the detection rate will be a small drop Thereason may be overfitting Therefore we first set the largernumber of iterations 119879 = 1000 and hidden layer nodes suchas 119897119886119910119890119903119904 = 119905119900119901 = 100 ℎ119894119889119889119890119899 = 50 50 V119894119904119894119887119897119890 = 10

Figure 1 shows that TPR is related to the number oflayers When the number of layers is 2 TPR gets the toplevel at about 89 With the number of layers increase TPRdecreases a little The reason is that too many layers will leadto overfitting Therefore the best number of layers is twolayers

Figure 2 shows that TPR is related to the number of itera-tions The results show that when the number of iterations isat 200 the detection rate is above 80The highest detectionrate achieves at about 250 iterations After that the accuracyof the algorithm decreases with the increase of the numberof iterations Moreover the more iterations of each layer arethe longer the algorithm overall run time Therefore the bestnumber of iterations is 250

Figure 3 shows that TPR is related to the number of hid-den units The results show that TPR increases significantly


DBN(HostArrayltintgt amp layersHostMatrixltcudafloatgt amp inputscudafloat initialLearningRatecudafloat momentum = DEFAULT MOMENTUMbool useBinaryValuesVisibleReconstruction = falsecudafloat stdWeights = STD WEIGHTS)

Listing 1 DBN main module declaration

70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)

1 2 3 4 50Number of DBN layers

Figure 1 The relationship between the number of layers and TrueTPR

100 200 300 400 500 600 700 800 900 10000Number of iterations per RBM

0

20

40

60

80

100

True

Pos

itive

Rat

e (

)

Figure 2 The relationship between number of iterations and TPR

to above 85 when the number of hidden units gets 20The detection rate does not change much under 30 hiddenunits And when it gets to 40 hidden nodes the detectionrate again significantly increases and reaches nearly 90Since then as the number of nodes increases the detectionrate under 80 hidden units is slightly higher than 90 Butthe overall detection rate does not significantly change aftermore than 40 hidden nodes As the number of hidden layer

50

60

70

80

90

100

True

Pos

itive

Rat

e (

)

20 30 40 50 60 70 80 90 10010Number of hidden units per layer

Figure 3 The relationship between number of hidden units andTPR

Table 2 The TPR between BP and no BP

BP no BPAccuracy 896 891TPR 892 872

nodes increase the running time also significantly increasesTherefore the number of hidden units should be 40

Table 2 shows TPR between BP and no BP We find thatfine-tuning in BP does not improve the TPR but reducesdetection rate and increases running time The possiblereason is that BP results in a degree of overfitting in the caseof small input latitudes It is also possible that the parametersof the BP algorithm are not appropriate Therefore we do notuse BP in detection

After training and getting the parameters in the small dataset we useDBN to detect the phishingwebsites in the big dataset The results show that there were 17672 nodes in phishingwebsites and the detection ratewas 892TheFPRwas 06Because the big data set cannot be fully calibrated the resultsare only reference significance

5 Conclusions

In this paper we analyze the features of phishing websitesand present two types of feature for web phishing detection


original feature and interaction feature Then we introduceDBN to detect phishing websites and discuss the detectionmodel and algorithm for DBN We train DBN and get theappropriate parameters for detection in the small data setIn the end we use the big data set to test DBN and TPR isapproximately 90

Data Availability

The test data used to support the findings of this study havenot been made available because these data belong to the ISP(Internet Service Provider)

Conflicts of Interest

The authors declare that they have no conflicts of interest

Acknowledgments

This work is supported by National Natural Science Founda-tion of China (61571290 61831007 and 61431008) the NSFC-Zhejiang Joint Fund for the Integration of Industrializationand Informationization under Grant U1509219 and ShanghaiMunicipal Science and Technology Project under Grants16511102605 and 16DZ1200702 and NSF Grants 1652669 and1539047

References

[1] httpsenwikipediaorgwikiWeb service[2] O Adam Y C Lee and A Y Zomaya ldquoStochastic resource pro-

visioning for containerized multi-tier web services in cloudsrdquoIEEE Transactions on Parallel and Distributed Systems vol 28no 7 pp 2060ndash2073 2017

[3] T Bujlow V Carela-Espanol J Sole-Pareta and P Barlet-RosldquoA survey on web tracking Mechanisms implications anddefensesrdquo Proceedings of the IEEE vol 105 no 8 pp 1476ndash15102017

[4] H-C Huang Z-K Zhang H-W Cheng and SW Shieh ldquoWebapplication security Threats countermeasures and pitfallsrdquoThe Computer Journal vol 50 no 6 pp 81ndash85 2017

[5] httpsenwikipediaorgwikiWeChat[6] K Rekouche Early phishing 2011[7] httpwwwantiphishingorg[8] Microsoft ldquo20 Indians are victims of online phishing attacks

Microsoftrdquo IANS 2014 httpnewsbiharprabhacom[9] LWu XDu and JWu ldquoEffective defense schemes for phishing

attacks on mobile computing platformsrdquo IEEE Transactions onVehicular Technology vol 65 no 8 pp 6678ndash6691 2016

[10] P Prakash M Kumar R R Kompella and M Gupta ldquoPhish-Net Predictive blacklisting to detect phishing attacksrdquo inProceedings of the 2017 IEEE Conference on Computer Commu-nications (IEEE INFOCOM 2010) San Diego USAMarch 2010

[11] S Marchal J Francois R State and T Engel ldquoPhish stormDetecting phishing with streaming analyticsrdquo IEEE Transac-tions on Network and Service Management vol 11 no 4 pp458ndash471 2014

[12] P Yi T Zhu Q Zhang Y Wu and L Pan ldquoPuppet attackA denial of service attack in advanced metering infrastructure

networkrdquo Journal of Network and Computer Applications vol59 no 1 pp 325ndash332 2016

[13] P Yi T Zhu Q Zhang Y Wu and J Li ldquoA denial ofservice attack in advanced metering infrastructure networkrdquoin Proceedings of the 2014 IEEE International Conference onCommunications (IEEE ICC 2014) pp 1029ndash1034 IEEE SydneyAustralia June 2014

[14] S XiaoW Gong D Towsley Q Zhang and T Zhu ldquoReliabilityanalysis for cryptographic key managementrdquo in Proceedings ofthe IEEE International Conference on Communications (IEEEICC 2014) Sydney Austrailia June 2014

[15] D Jiang Z Yuan P Zhang L Miao and T Zhu ldquoA trafficanomaly detection approach in communication networks forapplications of multimedia medical devicesrdquoMultimedia Toolsand Applications vol 75 no 22 pp 14281ndash14305 2016

[16] Z Huang T Zhu Y Gu and Y Li ldquoShepherd Sharingenergy for privacy preserving in hybrid AC-DC microgridsrdquoin Proceedings of the Seventh ACM International Conference onFuture Energy Systems (ACM e-Energy 2016) Canada 2016

[17] Y Li and T Zhu ldquoGait-Based Wi-Fi signatures for privacy-preservingrdquo in Proceedings of the 2016 ACM Symposium onInformAtion Computer and Communications Security (ASI-ACCS 2016) Xirsquoan China 2016

[18] Y Yao Y Li X Liu et al ldquoAegis An interference-negligibleRF sensing shieldrdquo in Proceedings of the 37th Annual IEEEInternational Conference on Computer Communications (IEEEINFOCOM 2018) Honolulu HI Hawaii USA April 2018

[19] T Zhu S Xiao P Yi D Towsley and W Gong ldquoA secureenergy routing mechanism for sharing renewable energy insmart microgridrdquo in Proceedings of the 2011 IEEE InternationalConference on Smart Grid Communications (SmartGridComm2011) Brussels Belgium 2011

[20] T Zhu and M Yu ldquoA secure quality of service routing protocolfor wireless Ad Hoc Networksrdquo in Proceedings of the IEEEGlobal Communication Conference (IEEE GLOBECOM 2006)San Francisco CA USA November 2006

[21] T Zhu and M Yu ldquoA dynamic secure QoS routing protocolfor wireless Ad Hoc networksrdquo in Proceedings of the 29th IEEESarnoff Symposium (IEEE Sarnoff rsquo06) Princeton NJ USAApril 2006

[22] P Yi T Zhu J Ma and Y Wu ldquoAn intrusion preventionmechanism in mobile ad hoc networksrdquo Ad-Hoc amp SensorWireless Networks vol 17 no 3-4 pp 269ndash292 2013

[23] P Yi T Zhu N Liu Y Wu and J Li ldquoCross-layer detection forblack hole attack in wireless networkrdquo Journal of ComputationalInformation Systems vol 8 no 10 pp 4101ndash4109 2012

[24] W Li P Yi Y Wu L Pan and J Li ldquoA new intrusiondetection system based on KNN classification algorithm inwireless sensor networkrdquo Journal of Electrical and ComputerEngineering vol 2014 Article ID 240217 8 pages 2014

[25] P Yi Y Wu and J Chen ldquoTowards an artificial immune systemfor detecting anomalies in wireless mesh networksrdquo ChinaCommunications vol 8 no 3 pp 107ndash117 2011

[26] P Yi Y Wu N Liu and Z Wang ldquoIntrusion detection forwireless mesh networks using finite state Machinerdquo ChinaCommunications vol 7 no 5 pp 40ndash48 2010

[27] P Yi X Jiang and Y Wu ldquoDistributed intrusion detection formobile ad hoc networksrdquo Journal of Systems Engineering andElectronics vol 19 no 3 pp 851ndash859 2008

[28] P Yi T Zhu Q Zhang Y Wu and J Li ldquoGreen firewall Anenergy-efficient intrusion prevention mechanism in wireless


sensor networkrdquo inProceedings of the 2012 IEEEGlobal Commu-nications Conference (GLOBECOM 2012) Anaheim CaliforniaUSA December 2012

[29] X D Wang and P Yi ldquoSecurity framework for wireless com-munications in smart distribution gridrdquo IEEE Transactions onSmart Grid vol 2 no 4 pp 809ndash818 2011

[30] C Zhou and T Zhu ldquoHighly spatial reusable MAC for wirelesssensor networksrdquo in Proceedings of the 2007 International Con-ference on Wireless Communications Networking and MobileComputing WiCOM 2007 IEEE China September 2007

[31] Z Zhong T Zhu T He and Z Zhang ldquoDemo Leakage-awareenergy synchronization on twin-star nodesrdquo in ACM SenSys2008

[32] Z Chang and Z Ting ldquoThorough analysis of MAC protocols inwireless sensor networksrdquo in Proceedings of the 2008 4th Inter-national Conference on Wireless Communications Networkingand Mobile Computing IEEE China October 2008

[33] C Zhou andT Zhu ldquoA spatial reusableMACprotocol for stablewireless sensor networksrdquo in Proceedings of the 2008 Interna-tional Conference on Wireless Communications Networking andMobile Computing WiCOM 2008 China October 2008

[34] Y Gu T Zhu and T He ldquoESC energy synchronized commu-nication in sustainable sensor networksrdquo in Proceedings of the17th IEEE International Conference on Network Protocols (ICNPrsquo09) Princeton NJ USA October 2009

[35] Z Zhong T ZhuDWang andTHe ldquoTrackingwith unreliablenode sequencesrdquo in Proceedings of the 28th Conference onComputer Communications (INFOCOM rsquo09) April 2009

[36] T Zhu Z Zhong Y Gu T He and Z-L Zhang ldquoLeakage-aware energy synchronization for wireless sensor networksrdquo inProceedings of the 7th ACM International Conference on MobileSystems Applications and Services (MobiSysrsquo09) Poland June2009

[37] T Zhu Y Gu T He and Z-L Zhang ldquoEShare a capacitor-driven energy storage and sharing network for long-term oper-ationrdquo in Proceedings of the 8th ACM International Conferenceon Embedded Networked Sensor Systems (SenSys rsquo10) pp 239ndash252 Zurich Switzerland November 2010

[38] T Zhu and D Towsley ldquoE2R Energy efficient routing formulti-hop green wireless networksrdquo in Proceedings of the 2011IEEE Conference on Computer Communications WorkshopsINFOCOMWKSHPS 2011 China April 2011

[39] S Guo SMKim T Zhu YGu andTHe ldquoCorrelated floodingin low-duty-cycle wireless sensor networksrdquo in Proceedings ofthe 19th IEEE International Conference on Network Protocols(ICNP rsquo11) IEEE Vancouver BC Canada October 2011

[40] T Zhu Y Gu T He and Z Zhang ldquoAchieving long-termoperation with a capacitor-driven energy storage and sharingnetworkrdquo ACM Transactions on Sensor Networks vol 8 no 4article 32 2012

[41] Q Zhang T Zhu Y Ping and Y Gu ldquoCooperative datareduction in wireless sensor networkrdquo in Proceedings of the 2012IEEE Global Communications Conference (GLOBECOM rsquo12)IEEE Anaheim CA USA December 2012

[42] T Zhu AMohaisen Y Ping andD Towsley ldquoDEOS Dynamicenergy-oriented scheduling for sustainable wireless sensor net-worksrdquo in Proceedings of the IEEE Conference on ComputerCommunications (INFOCOM rsquo12) Orlando Fla USA March2012

[43] T Zhu Z Zhong T He and Z Zhang ldquoAchieving efficientflooding by utilizing link correlation in wireless sensor net-worksrdquo IEEEACM Transactions on Networking vol 21 no 1pp 121ndash134 2013

[44] YGu LHe T Zhu andTHe ldquoAchieving energy-synchronizedcommunication in energy-harvesting wireless sensor net-worksrdquo ACM Transactions on Embedded Computing Systemsvol 13 no 2 2014

[45] L He L Kong Y Gu J Pan and T Zhu ldquoEvaluating the on-demand mobile charging in wireless sensor networksrdquo IEEETransactions on Mobile Computing vol 14 no 9 pp 1861ndash18752014

[46] S Ren P Yi D Hong YWu andT Zhu ldquoDistributed construc-tion of connected dominating sets optimized by minimum-weight spanning tree in wireless Ad-Hoc sensor networksrdquo inProceedings of the 2014 IEEE 17th International Conference onComputational Science and Engineering (CSE) IEEE ChengduChina December 2014

[47] S Ren P Yi T Zhu Y Wu and J Li ldquoA 3-hop messagerelay algorithm for connected dominating sets in wireless ad-hoc sensor networksrdquo in Proceedings of the 2014 IEEECICInternational Conference on Communications in China ICCC2014 pp 829ndash834 China October 2014

[48] Z Zhou M Xie T Zhu et al ldquoEEP2P An energy-efficientand economy-efficient P2P network protocolrdquo in Proceedings ofthe 2014 International Green Computing Conference IGCC 2014IEEE Dallas TX USA November 2014

[49] L He P Cheng Y Gu J Pan T Zhu and C Liu ldquoMobile-to-mobile energy replenishment in mission-critical roboticsensor networksrdquo in Proceedings of the 33rd IEEE Conferenceon Computer Communications IEEE INFOCOM 2014 pp 1195ndash1203 Canada May 2014

[50] J Jun L Cheng L He Y Gu and T Zhu ldquoExploiting sender-based link correlation in wireless sensor networksrdquo in Pro-ceedings of the 22nd IEEE International Conference on NetworkProtocols ICNP 2014 pp 445ndash455 USA October 2014

[51] Z Huang D Corrigan S Narayanan T Zhu E Bentley andM Medley ldquoDistributed and dynamic spectrum managementin airborne networksrdquo in Proceedings of the 34th Annual IEEEMilitary Communications Conference MILCOM 2015 pp 786ndash791 USA October 2015

[52] Q Zhang Z Zhou W Xu et al ldquoFingerprint-free trackingwith dynamic enhanced field divisionrdquo in Proceedings of the34th IEEE Annual Conference on Computer Communicationsand Networks IEEE INFOCOM 2015 pp 2785ndash2793 KowloonHong Kong May 2015

[53] F Chai T Zhu and K-D Kang ldquoA link-correlation-awarecross-layer protocol for IoT devicesrdquo in Proceedings of the 2016IEEE International Conference on Communications ICC 2016Malaysia May 2016

[54] Y Li and T Zhu ldquoUsing Wi-Fi signals to characterize humangait for identification and activity monitoringrdquo in Proceedingsof the 2016 IEEE First International Conference on ConnectedHealth Applications Systems and Engineering Technologies(CHASE) pp 238ndash247 Washington DC USA June 2016

[55] L Cheng Y Gu J Niu et al ldquoTaming collisions for delay reduc-tion in low-duty-cycle wireless sensor networksrdquo in Proceedingsof the 35th Annual IEEE International Conference on ComputerCommunications IEEE INFOCOM 2016 USA April 2016

[56] Z Chi Y Yao T Xie Z Huang M Hammond and T ZhuldquoHarmony Exploiting coarse-grained received signal strengthfrom IoTdevices for human activity recognitionrdquo inProceedings


of the 24th IEEE International Conference on Network ProtocolsICNP 2016 Singapore November 2016

[57] Z Chi Y Li H Sun Y Yao Z Lu and T Zhu ldquoB2W2 N-wayconcurrent communication for IoT devicesrdquo in Proceedings ofthe 14th ACMConference on EmbeddedNetwork Sensor Systemspp 245ndash258 Stanford CA USA 2016

[58] Z Chi Y Li Y Yao and T Zhu ldquoPMC Parallel multi-protocolcommunication to heterogeneous IoT radios within a singleWiFi channelrdquo in Proceedings of the 25th IEEE InternationalConference on Network Protocols ICNP 2017 Canada October2017

[59] Z Chi Z Huang Y Yao T Xie H Sun and T Zhu ldquoEMFEmbedding multiple flows of information in existing traffic forconcurrent communication among heterogeneous IoT devicesrdquoin Proceedings of the 2017 IEEE Conference on Computer Com-munications INFOCOM 2017 USA May 2017

[60] Y Li Z Chi X Liu and T Zhu ldquoChiron Concurrent highthroughput communication for iot devicesrdquo in Proceedings ofthe 16th Annual International Conference on Mobile SystemsApplications and Services (MobiSys rsquo18) pp 204ndash216 ACMNew York NY USA June 2018

[61] P Yi T Zhu B Jiang B Wang and D Towsley ldquoAn energytransmission and distribution network using electric vehiclesrdquoin Proceedings of the 2012 IEEE International Conference onCommunications (ICC rsquo12) Ottawa ON Canada June 2012

[62] A Mishra D Irwin P Shenoy J Kurose and T Zhu ldquoGreen-Charge Managing renewableenergy in smart buildingsrdquo IEEEJournal on Selected Areas in Communications vol 31 no 7 pp1281ndash1293 2013

[63] P Yi T Zhu G Lin et al ldquoEnergy scheduling and allocationin electric vehicle energy distribution networksrdquo in Proceedingsof the 2013 IEEE PES Innovative Smart Grid TechnologiesConference ISGT 2013 USA February 2013

[64] T Zhu Z Huang A Sharma et al ldquoSharing renewable energyin smart microgridsrdquo in Proceedings of the 2013 ACMIEEEInternational Conference on Cyber-Physical Systems ICCPS2013 USA April 2013

[65] httpswwwmozillaorgen-US[66] httpswwwgooglecomchromebrowserindexhtml[67] A Y Fu W Liu and X Deng ldquoDetecting phishing web

pages with visual similarity assessment based on Earth MoverrsquosDistance (EMD)rdquo IEEE Transactions on Dependable and SecureComputing vol 3 no 4 pp 301ndash311 2006

[68] W Chu B B Zhu F Xue X Guan and Z Cai ldquoProtectsensitive sites from phishing attacks using features extractablefrom inaccessible phishing URLsrdquo in Proceedings of the 2013IEEE International Conference on Communications (IEEE ICC2013) Budapest Hungary 2013

[69] J Ma L K Saul S Savage and G M Voelker ldquoBeyondblacklists learning to detectmaliciousweb sites from suspiciousURLsrdquo in Proceedings of the 15th International Conference onKnowledge Discovery and Data Mining (ACM KDD09) ParisFrance 2009

[70] httpwwwscholarpediaorgarticleDeep belief networks[71] G E Hinton and R R Salakhutdinov ldquoReducing the dimen-

sionality of data with neural networksrdquoThe American Associa-tion for the Advancement of Science Science vol 313 no 5786pp 504ndash507 2006

[72] S Geman and D Geman ldquoStochastic relaxation gibbs distri-butions and the Bayesian restoration of imagesrdquo IEEE Transac-tions on Pattern Analysis and Machine Intelligence vol 6 no 6pp 721ndash741 1984

[73] D E Rumelhart G E Hinton and R J Williams ldquoLearningrepresentations by back-propagating errorsrdquo Nature vol 323pp 533ndash536 1986

[74] G E Hinton P Dayan B J Frey and R M Neal ldquoThe ldquowake-sleeprdquo algorithm for unsupervised neural networksrdquo Sciencevol 268 no 5214 pp 1158ndash1161 1995

[75] Y Tang Deep Learning Using Support Vector Machines volabs13060239 CoRR 2013

[76] H Wang and B Raj A survey Time Travel in Deep LearningSpace An Introduction to Deep LearningModels And How DeepLearning Models Evolved fromThe Initial Ideas 2015

[77] S Bahrampour N Ramakrishnan L Schott and M ShahComparative Study ofDeep Learning Software Frameworks 2015

[78] httpsourceforgenetprojectsgpumlib[79] L McAfee ldquoDocument classification using deep belief netsrdquo in

CS224n Sprint 2008

International Journal of

AerospaceEngineeringHindawiwwwhindawicom Volume 2018

RoboticsJournal of

Hindawiwwwhindawicom Volume 2018


Active and Passive Electronic Components

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawiwwwhindawicom

Volume 2018

Hindawi Publishing Corporation httpwwwhindawicom Volume 2013Hindawiwwwhindawicom

The Scientific World Journal

Volume 2018

Control Scienceand Engineering

Journal of



Journal ofEngineeringVolume 2018

SensorsJournal of



RotatingMachinery


Modelling ampSimulationin EngineeringHindawiwwwhindawicom Volume 2018


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation


Hindawi

wwwhindawicom Volume 2018

Advances in

Multimedia

Submit your manuscripts atwwwhindawicom


be very similar to real websites to the human eye butthey are different in IP The content-based detection usuallyrefers to the detection of phishing sites through the pagesof elements such as form information field names andresource reference

In this paper we will focus on the detection model usinga deep learning framework The main contributions are asfollows

(i) We present two feature types for web phishing detec-tion an original feature and an interaction featureThe original feature is the direct feature of URLincluding special characters in URL and age of thedomain The interacting feature is the interactionbetweenwebsites including in-degree and out-degreeof URL

(ii) We introduce DBN to detect web phishing Wediscuss the training process of DBN and get theappropriate parameters to detect web phishing

(iii) We use real IP flows data from ISP to evaluatethe effectiveness of the detection model on DBNTrue Positive Rate (TPR) with different parameters isanalyzed our TPR is approximately 90

The paper is organized as follows Related works arediscussed in Section 2 The detection model and algorithmare discussed in Section 3 DBN is tested and evaluated inSection 4 The conclusion is drawn in Section 5

2 Related Works

Researchers have conducted lot of work in security [12ndash18]including secure routing [19ndash21] intrusion detection [22ndash27] intrusion prevention [28] and smart grids security [29]Different from research problems in wireless networks [30ndash60] and energy networks [61ndash64] web phishing is the attemptto acquire sensitive information such as usernames pass-words and credit card details often for malicious reasonsby masquerading as a trustworthy website on the InternetResearchers present some solutions to detect web phishing asfollows

When we judge whether a specific website is web phish-ing the direct way is to use a white list or black list Wemay search the URL in some database and decide PawanPrakash et al [10] presented two ways to detect phishingwebsites by the blacklist The first way includes five heuristicsto enumerate simple combinations of known phishing sitesto discover new phishing URLs The second way consists ofan approximate matching algorithm that dissects a URL intomultiple components that are matched individually againstentries in the blacklist Many well-known browser vendorssuch as Firefox [65] and Chrome [66] also used a self-built orthird-party black-white list to identify whether the URL is aphishing siteThis method is very accurate but its blacklist orwhitelist usually relies onmanual maintaining and reviewingObviously these methods are not real time and may cost a lotof time and effort

Another phishing detection way is to analyze the featuresof URL For example sometimes a URL looks similar to the

famous site URL or contains some special characters in theURL Samuel Marchal et al [11] used one concept of intra-URL relatedness and evaluate it using features extracted fromwords that compose a URL based on query data fromGoogleand Yahoo search engines These features are then usedin machine-learning-based classification to detect phishingURLs from a real data set This method is efficient andeconomical because it utilizes the preexisting knowledge ofthe URL which has a fast detection speed and a lowercost However we cannot fully exploit the characteristics ofphishing in terms of an URL only because the essence ofthe scheme is to fraud by means of web content Phishingattackers are very likely familiar with URLs and easily tailortheir URLs to avoid detection therefore this method willresult in a lower detection rate if only the information of theURL is checked

The content-based detection usually refers to the detec-tion of phishing sites through the pages of elements suchas form information field names and resource referenceAnthony Fu et al [67] proposed an approach to detectphishing web page using Earth moverrsquos distance (EMD) tomeasure web page visual similarity The accuracy rate of thismethod is high But at the same time the downside is a needto collect large amounts of data as a priori knowledge

With the popularity of machine learning phishing detec-tion has focused on the use of machine learning algorithmsThis method integrates URL text features domain namefeatures and web content features into a unified detectionbasis W Chu et al [68] presented a machine learningalgorithm based on phishing detection using only lexical anddomain features J Ma et al [69] described an approach toclassifying URLs automatically as either malicious or benignbased on supervised learning across both lexical and host-based features In general the essence of these methods ofmachine learning detection is to map all the features ofthe phishing website into the same space and then to usethe machine learning and data mining algorithms to detectphishing

3 The Phishing Detection Model Basedon DBN

31 Phishing Feature Extraction and Definition First we getreal traffic flow from ISP The data set includes traffic flow for40 minutes and 24 hours We construct the graph structureof traffic flow and analyze the characteristics of web phishingfrom the view of the graph

Each piece of data contains the following fields

(i) 119860119863 user node number(ii) 119868119875 user IP address(iii) 119879119878 access time(iv) 119880119877119871 Uniform Resource Locator access web address(v) 119877119864119865 request page source(vi) 119880119860 user browser type(vii) 119863119878119879 minus 119868119875 server address to access(viii) 119862119870119864 User Cookie




































119862119863119896 (120579 V0) = minussum

ℎ

119901 (ℎ | V0)120597119864 (V0 ℎ)

120597120579

+ sumℎ

119901 (ℎ | V119896)120597119864 (V119896 ℎ)

120597120579

(1)


119886119894 = ln119901 (V119894)

1 minus 119901 (V119894)(2)



119871120579 = ln (119871 (120579 | 119881)) = ln119899

prod119894=1

119901 (V119894 | 120579)

=119899

sum119894=1

ln (119901 (V119894 | 120579))

(3)


120579 larr997888 120579 + 120578120597 ln (119871 (120579))120597120579

(4)



120579 larr997888 120588120579 + 120578120597 ln (119871 (120579))120597120579

(5)












4 Test and Analysis








(i) Accuracy (ACC)119860119862119862 = (119879119875+119879119873)(119879119875+119879119873+119865119875+119865119873)























70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)




0

20

40

60

80

100

True

Pos

itive

Rat

e (

)



50

60

70

80

90

100

True

Pos

itive

Rat

e (

)








5 Conclusions




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia





































119862119863119896 (120579 V0) = minussum

ℎ

119901 (ℎ | V0)120597119864 (V0 ℎ)

120597120579

+ sumℎ

119901 (ℎ | V119896)120597119864 (V119896 ℎ)

120597120579

(1)


119886119894 = ln119901 (V119894)

1 minus 119901 (V119894)(2)



119871120579 = ln (119871 (120579 | 119881)) = ln119899

prod119894=1

119901 (V119894 | 120579)

=119899

sum119894=1

ln (119901 (V119894 | 120579))

(3)


120579 larr997888 120579 + 120578120597 ln (119871 (120579))120597120579

(4)



120579 larr997888 120588120579 + 120578120597 ln (119871 (120579))120597120579

(5)












4 Test and Analysis








(i) Accuracy (ACC)119860119862119862 = (119879119875+119879119873)(119879119875+119879119873+119865119875+119865119873)























70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)




0

20

40

60

80

100

True

Pos

itive

Rat

e (

)



50

60

70

80

90

100

True

Pos

itive

Rat

e (

)








5 Conclusions




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia







119862119863119896 (120579 V0) = minussum

ℎ

119901 (ℎ | V0)120597119864 (V0 ℎ)

120597120579

+ sumℎ

119901 (ℎ | V119896)120597119864 (V119896 ℎ)

120597120579

(1)


119886119894 = ln119901 (V119894)

1 minus 119901 (V119894)(2)



119871120579 = ln (119871 (120579 | 119881)) = ln119899

prod119894=1

119901 (V119894 | 120579)

=119899

sum119894=1

ln (119901 (V119894 | 120579))

(3)


120579 larr997888 120579 + 120578120597 ln (119871 (120579))120597120579

(4)



120579 larr997888 120588120579 + 120578120597 ln (119871 (120579))120597120579

(5)












4 Test and Analysis








(i) Accuracy (ACC)119860119862119862 = (119879119875+119879119873)(119879119875+119879119873+119865119875+119865119873)























70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)




0

20

40

60

80

100

True

Pos

itive

Rat

e (

)



50

60

70

80

90

100

True

Pos

itive

Rat

e (

)








5 Conclusions




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia





4 Test and Analysis








(i) Accuracy (ACC)119860119862119862 = (119879119875+119879119873)(119879119875+119879119873+119865119875+119865119873)























70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)




0

20

40

60

80

100

True

Pos

itive

Rat

e (

)



50

60

70

80

90

100

True

Pos

itive

Rat

e (

)








5 Conclusions




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia





70

75

80

85

90

95

100

True

Pos

itive

Rat

e (

)




0

20

40

60

80

100

True

Pos

itive

Rat

e (

)



50

60

70

80

90

100

True

Pos

itive

Rat

e (

)








5 Conclusions




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia




Data Availability




Acknowledgments


References

















































































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia























































CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia

























CS224n Sprint 2008



RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia




RoboticsJournal of




VLSI Design



Shock and Vibration







Journal of



Volume 2018



Volume 2018


Journal of




SensorsJournal of



RotatingMachinery





Propagation






Hindawi


Advances in

Multimedia


Documents

Web Phishing Detection Using a Deep Learning …downloads.hindawi.com/journals/wcmc/2018/4678746.pdfWeb Phishing Detection Using a Deep Learning Framework PingYi ,1 YuxiangGuan,1 FutaiZou,1