weltby Ergodic Sign inGet started
All use cases

Is This Website a Phishing Site?

From 30 features of its URL, page content and outside services, is this website trying to steal logins? A good score lets a browser warn people before they type a password.

Use caseTechnologyPredictionModel evaluation

The table

11,055 websites with features such as URL length, use of an IP address, SSL state, domain age and page links, labelled phishing or legitimate. It's in Welt's research catalogue as Phishing Websites, 11,055 rows by 31 columns, licensed CC BY 4.0. The catalogue measures its signal at 0.91. At 11,055 rows and 30 features the table is larger than the model limits allow, so the walkthrough evaluates and fits on a seeded sample of 4,000 rows. TabICLv2 and Kumo Tabular Medium compete.

Walkthrough

  1. Load it from the catalogue

    Find the table, read its recorded target and print the column names.

    import pandas as pd
    from welt import Client
    
    with Client() as client:
        item = client.research_datasets(q="phishing websites", limit=1)["items"][0]
        info = client.research_dataset(item["id"])
        data = client.load_research_dataset(item["id"])
    
    target = info["targets"][0]
    target = target["name"] if isinstance(target, dict) else target
    print([column["name"] for column in info["schema"]], target)
  2. Pick the rows

    Set aside 20 rows to predict at the end. The models learn from a seeded sample of 4,000 of the rest, the most this table's width allows.

    known = data.dropna(subset=[target])
    new_rows = known.sample(20, random_state=1)
    table = known.drop(new_rows.index).sample(4000, random_state=7)
  3. Compare the models and predict

    The models compete on the same folds against a simple guess, then the top-ranked one is fitted on the whole table. ROC AUC runs from 0.5, a coin toss, to 1, a perfect ranking, and a lower Brier score means the probabilities can be trusted more. The last table puts each prediction next to the real answer.

    with Client() as client:
        evaluation = client.evaluate(table, target, task="classification", seed=7,
                                     models=["tabicl-v2", "kumo-medium"])
        model = evaluation.fit()
    
    print(evaluation.summary()[["name", "rank", "roc_auc_mean", "brier_mean"]])
    features = new_rows.drop(columns=target)
    print(pd.DataFrame({"actual": new_rows[target].values, "predicted": model.predict(features),
                        "probability": model.predict_proba(features).max(axis=1)}))

What you get

A phishing probabilityFor any site you can describe.
Earlier warningsBlock the riskiest sites first.
A very strong signalThe catalogue measures one of its highest signals.

Try it

Use Open with to run the research datasets notebook in Colab, Kaggle or Jupyter and search for "phishing websites", or run the code above after pip install "welt-client[parquet]".