Distributed phishing URL classification: Leveraging modified XGBoost in network environments
TL;DR
A distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), is presented to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network.
Abstract
Phishing is currently one of the most common and most monetarily devastating types of cyberattacks, and hackers are actively employing it to acquire sensitive usernames and financial information with the use of nefarious uniform resource locators (URLs). The traditional intrusion detection system has failed to perform well against these new threats because they are based on traditional rules and sets of constraints which cannot be modified to suit the new trends of intrusion. The article presents a distributed phishing URL classification algorithm, called modified XGBoost (MD-XGBoost), to bridge the gap existing between deep learning (DL) based high-accuracy but computationally-intensive methods and interpretable and computationally-efficient machine learning models to use in practice on a distributed network. The suggested modified XGBoost algorithm is designed to solve the problem of scalability, robustness, and privacy through adapting feature weights, managing features via regularization, and aggregating gradients with the help of encryption. Even though recent advancements in DL architecture, such as convolutional neural networks (CNNs), bidirectional long short-term memory networks, CNN and long short-term memory networks, and deep reinforcement learning have demonstrated competitive performance, they are severely limited, such as high computation complexity and inference latency of between 85 and 145 ms, and hardware requirements based on the use of GPU technology, which is not feasible to implement in a resource-constrained network. The proposed modified XGBoost is characterized by a competitive performance of 96.9% and an F1-score of 0.973, although its inference latency is significantly lower, 18 ms, in the range of 8 times lower than that of DL-based methods, and inherently has the feature-importance analysis that can be interpreted. The importance of such performance increments is checked with the help of one-way analysis of variance and Tukey Honestly Significant Difference tests, the p-value of which is established at 0.0003.