Now 5097 visitors
Today:0 Yesterday:0
Total: 147118 212S 50P 4R
2026-10-20, Week 43
Member Login
TACT Journal Homepage
Call for Paper
Committee
Find My Paper
Author Homepage
Statistics & History
Welcome Message
Paper Procedure
FAQ
Paper Archives
Outstanding Papers
Program & Proceedings
Presentation Platform
Hotel & Travel Info
Photo Gallery
Scheduler Login
Seminar
Archives Login
Sponsors


















Presentation Assistant Go to [Q&A Session]
Paper Number
Paper Title
Keyword
ICACT20260061 Slide.01        [Big Slide] Chrome Click!!
Good morning everyone. Today, I will be presenting my work titled ‘Phishing Detection Using Genetic Algorithm-Based Feature Selection and Boosting Ensemble Learning.’ This study focuses on improving phishing detection accuracy by integrating genetic algorithms for optimal feature selection with boosting-based ensemble learning techniques. I am Dr Nazhatul Hafizah Kamarudin, from the Centre for Cybersecurity, Universiti Kebangsaan Malaysia.
ICACT20260061 Slide.02        [Big Slide] Chrome Click!!
With the increasing frequency and sophistication of cybersecurity threats, particularly phishing attacks, the need for accurate and reliable phishing detection mechanisms has become increasingly critical. This study focuses on identifying the key factors that influence the effectiveness of phishing detection systems. Based on these findings, the research aims to develop an improved phishing detection model and systematically evaluate its performance using established metrics, including accuracy, precision, sensitivity, and F1-score, to ensure its reliability and practical applicability in real-world cybersecurity environments.
ICACT20260061 Slide.03        [Big Slide] Chrome Click!!
Phishing attacks continue to be among the most pervasive and damaging cybersecurity threats, targeting individuals, organizations, and critical infrastructure. By impersonating legitimate websites and services, attackers deceive users into revealing sensitive information such as login credentials, personal identification, or financial data. These widespread and evolving threats have triggered a diverse array of research efforts aimed at combating phishing from multiple dimensions, including detection techniques, user awareness initiatives, and the development of phishing-resistant authentication systems.
ICACT20260061 Slide.04        [Big Slide] Chrome Click!!
In this proposed work, the study aims to address current challenges in phishing detection by introducing an ensemble-based detection system. The system combines intelligent feature selection techniques, high-performance machine learning models, and a reliable voting mechanism to improve overall detection accuracy and robustness. The main contributions of this research include four key aspects. First, the study implements optimized feature selection to ensure only the most relevant phishing indicators are used for detection. Second, it designs a boosting-based ensemble model to enhance prediction performance. Third, it develops a reliable voting mechanism to improve decision consistency among multiple models. Finally, the proposed system is validated using multiple datasets to ensure its effectiveness and generalizability across different phishing scenarios.
ICACT20260061 Slide.05        [Big Slide] Chrome Click!!
In related work, traditional phishing detection methods are mainly based on blacklist databases, rule-based filtering, and heuristic feature analysis. These approaches typically evaluate features such as domain name patterns, URL length, SSL certificate validity, and the presence of suspicious keywords to identify potential phishing websites. Although these methods are computationally efficient and relatively simple to implement, they have several limitations. In particular, they struggle to adapt to new and evolving phishing techniques, often resulting in high false positive rates. This is especially problematic when dealing with zero-day phishing attacks and dynamically generated phishing URLs, which can easily bypass static detection rules.
ICACT20260061 Slide.06        [Big Slide] Chrome Click!!
In recent years, machine learning-based phishing detection models have gained significant attention due to their flexibility and ability to learn patterns from historical data. Commonly used techniques include Random Forest, Support Vector Machine, and Decision Tree models, which have shown strong performance in identifying phishing activities. However, despite their effectiveness, many of these models rely heavily on extensive feature engineering, which can be time-consuming and dataset-dependent. Additionally, these models may face challenges in generalizing when trained on datasets that contain imbalance or noise. Another limitation is the lack of interpretability in some machine learning models, and they often require careful parameter tuning to prevent overfitting and to maintain good performance when deployed in real-world network traffic environments.
ICACT20260061 Slide.07        [Big Slide] Chrome Click!!
Deep learning techniques offer significant advantages in phishing detection, particularly through automated feature extraction. This allows models to identify complex and nonlinear patterns within phishing datasets. Architectures such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks are commonly used to analyze sequential and structured data, including URLs, HTML content, and webpage images. Studies have shown that hybrid deep learning models, such as Deep Neural Network combined with LSTM, can achieve accuracy rates exceeding 99%, especially when integrated with Natural Language Processing techniques like tokenization and character-level embeddings. However, despite their strong performance, deep learning approaches face several practical challenges. These include high computational and training costs, limited model interpretability, and vulnerability to adversarial attacks, which can impact their reliability and deployment in real-world cybersecurity environments.
ICACT20260061 Slide.08        [Big Slide] Chrome Click!!
To address the limitations identified in previous approaches, this study proposes a hybrid phishing detection model designed to improve both detection performance and reliability. The model begins by applying a Genetic Algorithm to identify the most significant and relevant features from the dataset. These selected features are then validated using a Random Forest model to ensure their effectiveness in classification. Next, the optimized features are fed into three different boosting-based classifiers, namely XGBoost, AdaBoost, and Real AdaBoost. Each classifier provides a different learning perspective, which helps strengthen the overall detection capability of the system. To ensure stable and consistent predictions, the outputs from these classifiers are combined using a majority voting mechanism. The proposed hybrid model demonstrated strong performance and robustness when tested across two phishing datasets with different configurations. Overall, this approach helps address common challenges in phishing detection, including overfitting, excessive or irrelevant features, and prediction inconsistency across models.
ICACT20260061 Slide.09        [Big Slide] Chrome Click!!
In this study, we propose a hybrid machine learning framework to improve the accuracy of phishing website detection. The framework integrates three main components, which are feature selection, ensemble learning, and a majority voting mechanism. By combining these techniques, the model is able to produce more reliable and stable detection results compared to single-model approaches. The proposed model is specifically designed to address common challenges in phishing detection, such as imbalanced datasets, redundant or irrelevant features, and the continuously evolving nature of phishing attack strategies. The overall methodology is structured into four main phases: data preprocessing, model development, training, and evaluation. Each phase plays an important role in ensuring that the final detection system is robust, adaptable, and suitable for real-world cybersecurity applications.
ICACT20260061 Slide.10        [Big Slide] Chrome Click!!
First is the data collection and preprocessing phase. This research uses two publicly available datasets from Mendeley, referred to as D1 and D2. These datasets contain labeled examples of both legitimate and phishing websites. Dataset D1 includes 10,000 balanced entries, half legitimate and half phishing, with 48 features each. Dataset D2 is much larger, containing 235,795 samples with a slightly imbalanced split, which consists of 57.2% legitimate and 42.8% phishing, and 54 features. Together, these datasets provide a diverse and up-to-date representation of modern web-based threats. To ensure rigorous evaluation, each dataset was partitioned using stratified random sampling with a preset random state (313) into three subsets: 70% for training, 15% for validation, and 15% for final testing. This approach maintains the original class distributions across all splits while guaranteeing reproducible results. Categorical features were processed using one-hot encoding to ensure compatibility with machine learning algorithms.
ICACT20260061 Slide.11        [Big Slide] Chrome Click!!
In the model development phase, we designed a phishing detection model that combines optimized feature selection with a strong ensemble classification strategy to improve detection efficiency and accuracy. The goal is to ensure that only the most relevant features are used while leveraging the strengths of multiple classifiers. The model is built around three main components. First, automated feature selection is performed using a Genetic Algorithm, which helps identify the most informative phishing-detection features in the dataset. Compared to traditional filter-and-wrapper methods, the GA provides better optimization by balancing exploration and exploitation within the feature search space. Second, the selected features are processed using ensemble classifiers, allowing multiple models to learn from the data and improve prediction performance. Finally, a majority voting mechanism is applied to combine the predictions from the ensemble models, ensuring more stable and consistent final classification results.
ICACT20260061 Slide.12        [Big Slide] Chrome Click!!
This figure illustrates the overall architecture of the proposed phishing detection model. The process begins with the phishing dataset, which is first passed through the feature selection stage. In this stage, a combination of Genetic Algorithm and Random Forest is used to identify and retain only the most relevant features for phishing detection. The selected features are then forwarded to the ensemble classification stage, where three boosting-based models—XGBoost, AdaBoost, and Real AdaBoost—are used to perform classification from different learning perspectives. Each model independently generates prediction results based on the optimized feature set. Finally, the predictions from all classifiers are combined using a majority voting mechanism. This ensures more stable and reliable final decisions. Based on the voting outcome, the system classifies the input as either a phishing website or a legitimate website, providing improved detection accuracy compared to single-model approaches.
ICACT20260061 Slide.13        [Big Slide] Chrome Click!!
In the training phase, a unified phishing dataset was first preprocessed and then divided into three parts: 70% for training, 15% for validation, and 15% for testing. This split was used to ensure that the model can generalize well to unseen data while allowing reliable performance evaluation. Each classifier, including XGBoost, AdaBoost, and Real AdaBoost, was trained independently using the same dataset, but with configurations optimized for each specific algorithm. For the XGBoost model, training was conducted using a learning rate of 0.3 and a multi-class soft probability loss function, with 100 boosting rounds. To reduce overfitting, both L1 and L2 regularization were applied, along with a maximum tree depth of 6. Early stopping was also implemented if no improvement was observed in validation loss for 10 consecutive rounds. For AdaBoost and Real AdaBoost, Random Forest was used as the base classifier. Both models were trained using 10 trees and 10 boosting iterations. AdaBoost focuses on combining weak learners to form a strong learner, while Real AdaBoost uses real-valued predictions and applies a shrinkage factor to control the learning rate. Default feature splitting settings were used for the Random Forest base models to maintain training stability and consistency.
ICACT20260061 Slide.14        [Big Slide] Chrome Click!!
This diagram illustrates the overall training and evaluation workflow of the proposed phishing detection system. The process begins with data preprocessing, where the dataset is cleaned and prepared before being divided into training, validation, and testing datasets. Next, the training data is passed through the automatic feature selection stage using the Genetic Algorithm combined with Random Forest to identify the most relevant features. These optimized features are then used to train the ensemble classification models, which include XGBoost, AdaBoost, and Real AdaBoost. The validation dataset is used to fine-tune model parameters and prevent overfitting during training. Meanwhile, the testing dataset is used to evaluate the final performance of the trained models. The outputs from the ensemble classifiers are then combined using a majority voting mechanism to produce the final classification result, which determines whether a website is phishing or legitimate. Overall, this structured training and evaluation pipeline ensures the model is well-optimized and effective in real-world phishing detection scenarios.
ICACT20260061 Slide.15        [Big Slide] Chrome Click!!
In the results phase, we conducted comprehensive experiments to evaluate how effectively the proposed model can detect phishing websites. The evaluation focuses on both validation and final testing to assess how accurately the model distinguishes between legitimate and phishing webpages. For validation, 15% of each dataset was reserved and used as unseen data to test the model independently. To ensure fairness and avoid bias, the true labels were hidden from the model during prediction and were only revealed after all predictions were completed. This approach helps simulate real-world deployment conditions, ensuring that the evaluation results are reliable, unbiased, and representative of actual performance. Overall, the testing process demonstrates the model’s ability to generalize well and maintain strong detection accuracy when applied to new, unseen phishing data.
ICACT20260061 Slide.16        [Big Slide] Chrome Click!!
These results demonstrate that the proposed validation strategy successfully reflects real-world deployment conditions while maintaining high evaluation reliability. The experimental results show excellent performance during both training and validation across the two phishing datasets tested. As shown in the confusion matrices, the model achieved perfect classification performance for both datasets. For Dataset 1, all phishing and legitimate websites were correctly classified, resulting in 750 true positives and 750 true negatives, with zero false positives and zero false negatives. Similarly, for Dataset 2, the model achieved 15,142 true positives and 20,227 true negatives, again with zero false positives and zero false negatives. These results indicate that the proposed hybrid ensemble model is highly effective in distinguishing phishing websites from legitimate ones. The absence of misclassification errors suggests strong generalization capability and robustness of the model across datasets with different characteristics.
ICACT20260061 Slide.17        [Big Slide] Chrome Click!!
In addition to the confusion matrix, the classification report provides a more detailed evaluation of the model’s predictive performance during the testing phase. It summarizes key performance metrics such as precision, recall, and F1-score, which help us understand how well the model performs in identifying phishing and legitimate URLs. The confusion matrix complements this analysis by providing a detailed breakdown of classification outcomes for both datasets. For Dataset 1, during both validation and testing phases, the model correctly identified all phishing and legitimate URLs. Specifically, the model achieved 750 true positives and 750 true negatives, with zero false positives and zero false negatives. This indicates perfect detection performance for this dataset. For Dataset 2, the results were also very strong. During testing, the model correctly identified 15,141 phishing URLs and 20,228 legitimate URLs. There were no false positives, meaning no legitimate websites were incorrectly classified as phishing. Only one phishing URL was misclassified as legitimate, resulting in one false negative. Overall, these results demonstrate that the proposed model achieves very high detection accuracy while maintaining strong precision and recall performance across different datasets, showing its robustness and reliability for phishing detection tasks.
ICACT20260061 Slide.18        [Big Slide] Chrome Click!!
The confusion matrix results show that for Dataset 1, the model achieved perfect classification performance, with no false positives and no false negatives. This demonstrates the model’s strong capability when working with balanced datasets. For Dataset 2, the model achieved near-perfect performance, with only one false negative recorded. This indicates that the model is also effective in handling imbalanced datasets, which are common in real-world phishing detection scenarios. Overall, these findings confirm that the proposed model achieves very high accuracy and reliability in detecting phishing URLs. The model outperforms many traditional detection approaches by leveraging ensemble learning combined with a majority voting strategy, which improves prediction stability and consistency. In addition, the model uses only 27 highly discriminative features, which improves computational efficiency while maintaining strong detection performance. This also makes the model more robust against class imbalance, redundant features, and potential adversarial manipulation, making it suitable for real-world cybersecurity deployment.
ICACT20260061 Slide.19        [Big Slide] Chrome Click!!
In conclusion, this research proposed a hybrid phishing detection model that integrates Genetic Algorithm-based feature selection with multiple boosting classifiers, including XGBoost, AdaBoost, and Real AdaBoost, combined through a majority voting mechanism. The experimental results on two public phishing datasets demonstrated that the proposed model achieves very high detection accuracy and reliable performance. Compared to existing models such as BMLSELM and MLSELM, the proposed model achieved better accuracy while using only 27 optimized features, compared to 33 and 48 features used in the benchmark models. The ensemble design also enabled the model to effectively handle common real-world challenges such as imbalanced datasets and redundant features. Overall, the consistent strong performance across multiple datasets indicates that the proposed model is robust, efficient, and suitable for practical deployment in real-world phishing detection and cybersecurity applications.
ICACT20260061 Slide.20        [Big Slide] Chrome Click!!
Thank you for your attention and time. In conclusion, this research contributes to improving phishing detection by proposing a hybrid ensemble-based model that demonstrates strong accuracy, reliability, and computational efficiency across multiple datasets. This research work was supported by Universiti Kebangsaan Malaysia under the GGPM-2023-070 grant, and we would like to acknowledge the university for its support in enabling this research. Thank you once again, and I welcome any questions or feedback.