Datasets for Phishing Websites Detection
In this repository the two variants of the phishing dataset are presented.
Web application
To preview the dataset interactively and/or tailor it to your needs, please visit a dedicated web application.
dataset_full.csv
Short description of the full variant dataset:
- Total number of instances: 88,647
- Number of legitimate website instances (labeled as 0): 58,000
- Number of phishing website instances (labeled as 1): 30,647
- Total number of features: 111 (without target)
dataset_small.csv
Short description of the small variant dataset:
- Total number of instances: 58,645
- Number of legitimate website instances (labeled as 0): 27,998
- Number of phishing website instances (labeled as 1): 30,647
- Total number of features: 111 (without target)
Extracted Features
| Feature | Description |
|---|---|
| qty_dot_url | count (.) in URL |
| qty_hyphen_url | count (-) in URL |
| qty_underline_url | count (_) in URL |
| qty_slash_url | count (/) in URL |
| qty_questionmark_url | count (?) in URL |
| qty_equal_url | count (=) in URL |
| qty_at_url | count (@) in URL |
| qty_and_url | count (&) in URL |
| qty_exclamation_url | count (!) in URL |
| qty_space_url | count ( ) in URL |
| qty_tilde_url | count (~) in URL |
| qty_comma_url | count (,) in URL |
| qty_plus_url | count (+) in URL |
| qty_asterisk_url | count (*) in URL |
| qty_hashtag_url | count (#) in URL |
| qty_dollar_url | count ($) in URL |
| qty_percent_url | count (%) in URL |
| qty_tld_url | top-level-domain length |
| length_url | URL length |
| qty_dot_domain | count (.) in domain |
| qty_hyphen_domain | count (-) in domain |
| qty_underline_domain | count (_) in domain |
| qty_slash_domain | count (/) in domain |
| qty_questionmark_domain | count (?) in domain |
| qty_equal_domain | count (=) in domain |
| qty_at_domain | count (@) in domain |
| qty_and_domain | count (&) in domain |
| qty_exclamation_domain | count (!) in domain |
| qty_space_domain | count ( ) in domain |
| qty_tilde_domain | count (~) in domain |
| qty_comma_domain | count (,) in domain |
| qty_plus_domain | count (+) in domain |
| qty_asterisk_domain | count (*) in domain |
| qty_hashtag_domain | count (#) in domain |
| qty_dollar_domain | count ($) in domain |
| qty_percent_domain | count (%) in domain |
| qty_vowels_domain | count vowels in domain |
| domain_length | domain length |
| domain_in_ip | URL domain in IP address format |
| server_client_domain | domain contains the keywords "server" or "client" |
| qty_dot_directory | count (.) in directory |
| qty_hyphen_directory | count (-) in directory |
| qty_underline_directory | count (_) in directory |
| qty_slash_directory | count (/) in directory |
| qty_questionmark_directory | count (?) in directory |
| qty_equal_directory | count (=) in directory |
| qty_at_directory | count (@) in directory |
| qty_and_directory | count (&) in directory |
| qty_exclamation_directory | count (!) in directory |
| qty_space_directory | count ( ) in directory |
| qty_tilde_directory | count (~) in directory |
| qty_comma_directory | count (,) in directory |
| qty_plus_directory | count (+) in directory |
| qty_asterisk_directory | count (*) in directory |
| qty_hashtag_directory | count (#) in directory |
| qty_dollar_directory | count ($) in directory |
| qty_percent_directory | count (%) in directory |
| directory_length | directory length |
| qty_dot_file | count (.) in file |
| qty_hyphen_file | count (-) in file |
| qty_underline_file | count (_) in file |
| qty_slash_file | count (/) in file |
| qty_questionmark_file | count (?) in file |
| qty_equal_file | count (=) in file |
| qty_at_file | count (@) in file |
| qty_and_file | count (&) in file |
| qty_exclamation_file | count (!) in file |
| qty_space_file | count ( ) in file |
| qty_tilde_file | count (~) in file |
| qty_comma_file | count (,) in file |
| qty_plus_file | count (+) in file |
| qty_asterisk_file | count (*) in file |
| qty_hashtag_file | count (#) in file |
| qty_dollar_file | count ($) in file |
| qty_percent_file | count (%) in file |
| file_length | file length |
| qty_dot_params | count (.) in parameters |
| qty_hyphen_params | count (-) in parameters |
| qty_underline_params | count (_) in parameters |
| qty_slash_params | count (/) in parameters |
| qty_questionmark_params | count (?) in parameters |
| qty_equal_params | count (=) in parameters |
| qty_at_params | count (@) in parameters |
| qty_and_params | count (&) in parameters |
| qty_exclamation_params | count (!) in parameters |
| qty_space_params | count ( ) in parameters |
| qty_tilde_params | count (~) in parameters |
| qty_comma_params | count (,) in parameters |
| qty_plus_params | count (+) in parameters |
| qty_asterisk_params | count (*) in parameters |
| qty_hashtag_params | count (#) in parameters |
| qty_dollar_params | count ($) in parameters |
| qty_percent_params | count (%) in parameters |
| params_length | parameters length |
| tld_present_params | TLD presence in arguments |
| qty_params | number of parameters |
| email_in_url | email present in URL |
| time_response | search time (response) domain (lookup) |
| domain_spf | domain has SPF |
| asn_ip | AS Number (or ASN) |
| time_domain_activation | time (in days) of domain activation |
| time_domain_expiration | time (in days) of domain expiration |
| qty_ip_resolved | number of resolved IPs |
| qty_nameservers | number of resolved name servers (NameServers - NS) |
| qty_mx_servers | number of MX Servers |
| ttl_hostname | time-to-live (TTL) value associated with hostname |
| tls_ssl_certificate | valid TLS / SSL Certificate |
| qty_redirects | number of redirects |
| url_google_index | check if URL is indexed on Google |
| domain_google_index | check if domain is indexed on Google |
| url_shortened | check if URL is shortened |
| phishing | is phishing website |
Cite this dataset
G. Vrbančič, I. Jr. Fister, V. Podgorelec. Datasets for Phishing Websites Detection. Data in Brief, Vol. 33, 2020, DOI: 10.1016/j.dib.2020.106438