Malicious Website Detection Using BorderlineSMOTE2NCR Sampling and Cost-Sensitive Ensemble Learning

In anomaly detection scenarios such as phishing website detection, the datasets are severely class imbalanced, with majority class instances overwhelming the minority class instances. However, the traditional machine learners assume (a) equal class distribution and (b) equal misclassification costs (He and Garcia in IEEE Trans Knowl Data Eng 21:1–22, 2009; Elrahman and Abraham in J Netw Innov Comput 1:332–340, 2013; Jaya Srivastava and Aditi Sharan in Phishing website detection based on hybrid resampling KMeansSMOTENCR and cost-sensitive classification, 2023). Hence, ML models obtained from class-imbalanced training datasets tend to ignore the minority class over the majority class leading to inaccurate prediction. Researchers have proposed several (a) data-balancing and (b) algorithm-balancing solutions for handling the class imbalance. In this study, we have handled class imbalance at the dataset and the algorithm levels. At the data level, we have proposed a novel hybrid sampling method, ‘BorderlineSMOTE2NCR’, for dataset balancing. At the algorithm level, we have employed cost-sensitive counterparts of ensemble machine learners, i.e., Random Forest, eXtreme Gradient Boosting, and Extra Trees classifiers. As far as we know and understand, our novel proposed class-imbalance handling, i.e., the ‘BorderlineSMOTE2NCR’, technique is yet to be published.