REVIEW 4 major objections 5 minor 10 references
A Predicting Phishing Websites Using Support Vector Machine and MultiClass Classification Based on Association Rule Techniques
T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read A hybrid of association rules and SVM predicts phishing websites with 98.30% accuracy.
desk verdict The abstract claims the MCAR-SVM hybrid is more accurate, but the paper's own Table 1 shows plain SVM wins, so the central claim is self-refuted. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the MCAR-SVM hybrid pipeline. MCAR (Multi-Class Classification based on Association Rules) generates frequent rule items in a single scan, ranks candidate rules by confidence, support, and rule size, then prunes redundant rules through database coverage; SVM then uses the remaining rules as features and constructs the separating hyperplane $W^T X = C$ by maximizing the margin between classes. The work this machinery does is to convert raw webpage features into a small set of high-confidence association rules that SVM can separate linearly.
What would settle it
Reproduce the comparison on the same 11,056 websites with 10-fold cross-validation and compute a confidence interval for the difference in accuracy; if MCAR-SVM is not significantly better than SVM trained on the original features, the central claim that the hybrid 'produced a more accurate result' is falsified by the paper's own Table 1.
Extended reading notes
Core claim
The study proposes that phishing detection should not choose between rule-based associative classification and geometric classification but should sequence them: MCAR scans the training data once, discovers frequent rule items, ranks rules by confidence, support, and size, and prunes redundant rules by database coverage; the surviving rules define a reduced feature space in which SVM finds the hyperplane with the largest margin between the legitimate and phishing classes. On the authors' evaluation, this MCAR-SVM pipeline reaches a classification accuracy of 98.30%, an AUC of 98%, and a pseudo-$R^2$ of 0.8284, with an error rate of 0.06, which they take to show that the two techniques together produce a more accurate phishing predictor than either alone. The same table reports SVM alone at 99.1% accuracy, 99% AUC, 0.8402 pseudo-$R^2$, and a lower false-positive rate, so the paper's stated rationale and its reported evidence point in opposite directions.
Load-bearing premise
The load-bearing premise is that the association rules generated and pruned by MCAR give SVM a better feature representation than the raw website features alone; if those rules add no predictive value, the hybrid's reason for existing collapses.
Editorial extensions
If this is right
- If the hybrid's reported figures hold, phishing detectors can be built by letting association-rule mining select the features and letting SVM classify, without manual feature engineering.
- An AUC of 98% implies the model ranks phishing above legitimate sites almost always, which would make it usable as a pre-filter in browsers or mail servers.
- The pseudo-$R^2$ of 82.84% indicates that most of the variance in website status is captured by the rule-based feature space.
- Since Table 1 shows SVM alone at 99.1% accuracy in less time, a direct corollary is that on this dataset the hybrid does not beat its SVM component; the integration's benefit would need to be demonstrated on other datasets or with different rule budgets.
Reading between the lines
- A testable extension: train SVM on raw features and on MCAR-selected rules under identical cross-validation folds, since the paper does not report such a matched comparison.
- The accuracy gap between 98.30% and 99.1% is small enough that statistical significance tests or confidence intervals, absent from the paper, would decide whether the hybrid is genuinely worse or merely noisily equal.
- Another extension would use only the pruned MCAR rules' support and confidence as SVM features on newer PhishTank data; if a hybrid advantage appears there, the mechanism is rule-based feature selection rather than MCAR training per se.
- Because the dataset mixes 5,005 PhishTank entries with Yahoo directory entries, per-class precision and recall would clarify whether the hybrid helps specifically on rare phishing patterns rather than on the overall accuracy.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a hybrid phishing-detection pipeline that combines Multi-Class Classification based on Association Rules (MCAR) for feature extraction and rule generation with Support Vector Machines (SVM) for classification. Experiments are run on 11,056 websites drawn from PhishTank and a Yahoo directory. The abstract claims that combining the two techniques produces a more accurate result than either technique alone, and reports 98.30% accuracy, 98% AUC, and 82.84% pseudo-R² for the hybrid. The full text also reports results for SVM and Decision Tree on the same data, and Section IV explicitly states that MCAR-SVM did not achieve better accuracy than SVM.
Significance. Phishing detection is a practically relevant problem, and the paper addresses it with a plausible hybrid idea: use association-rule mining to generate features or rules and then use SVM for classification. The manuscript honestly reports the outcome of the comparison in Section IV, where SVM alone outperforms MCAR-SVM in accuracy, computation time, AUC, and pseudo-R². That factual reporting is a strength, as is the use of a publicly sourced dataset of over 11,000 websites. However, the central claim—that the hybrid is more accurate than either technique alone—is contradicted by the paper's own results. No code, data, or parameter settings (e.g., MCAR minimum confidence, SVM kernel and cost) are provided, so the experiments are not reproducible from the manuscript. The contribution as stated cannot stand without either a corrected framing or substantially different evidence.
major comments (4)
- [Abstract and Section V vs. Section IV, Table 1] The central claim is internally contradicted. The abstract states that using MCAR and SVM together 'produced a more accurate result,' but Table 1 reports SVM accuracy of 99.1% versus 98.30% for MCAR-SVM, and the text in Section IV states verbatim that 'the MCAR-SVM algorithm did not yield a better classification accuracy than SVM.' The conclusion similarly acknowledges SVM's higher accuracy. Since the claimed advantage of the hybrid is the rationale for the entire paper, this contradiction is load-bearing and cannot be resolved by interpretation.
- [Section IV, narrative text vs. Table 1] The reported SVM accuracy is internally inconsistent: the narrative text near Figure 10 says SVM achieved 98.59% accuracy, while Table 1 reports 99.1% for SVM. The same section later repeats 99.1%. This discrepancy means the reader cannot determine which value is the actual experimental result, undermining the comparison that is central to the paper's conclusion.
- [Section IV, Table 2] Table 2 reports error rates of 0.05 for SVM and 0.06 for MCAR-SVM, with corresponding TP rates of 0.530 and 0.534. These numbers are not evidently reconcilable with the classification accuracies of 99.1% and 98.30% in Table 1, nor with the qualitative claim that MCAR-SVM 'correctly classified 53.4%' of phishing websites while achieving 98.30% overall accuracy. The table needs a clear definition of how these weighted averages are computed and why they do not conflict with the accuracies.
- [Section III.C and Section IV] The proposed algorithm is underspecified for reproducibility. No values are given for the MCAR minimum confidence threshold, SVM kernel type or cost parameters, the rule-ranking details, or the train/test split used for MCAR-SVM (only the SVM experiment is described as using 7,739 training and 3,317 test websites). Without these parameters and without the code or dataset, the reported results cannot be independently verified or compared with prior work.
minor comments (5)
- [Title and Abstract] The title contains a grammatical error: 'A Predicting Phishing Websites' should likely be 'Predicting Phishing Websites' or 'A Predictive Approach to Phishing Websites.'
- [Section IV, Figure 6 caption] The phrase 'generating newer futures' should read 'generating newer features.'
- [Section II.C, Reference [6]] The related-work entry describes the cited study as 'Detecting Phishing Websites Using Associative Classification (MCAR, CBA)' but the reference list title is 'Detecting Phishing Websites Using Associative Classification'; the entry also includes email addresses and incomplete bibliographic information that should be formatted consistently.
- [Section IV, Figures 11-16] The AUC and pseudo-R² values are reported only in figure captions and are not discussed in the text; a concise table summarizing these metrics would improve clarity and allow direct comparison with Table 1.
- [General] Several sentences in Sections IV and V repeat information nearly verbatim (e.g., the description of MCAR scanning the training data set), and the paper would benefit from tighter editing to remove redundancies.
Circularity Check
No circularity found: the paper reports direct benchmark results of existing algorithms; its internal contradiction is a correctness concern, not a circularity.
full rationale
This paper does not attempt a derivation from first principles. It applies two existing, externally defined algorithms—SVM and MCAR—to a fixed phishing dataset and reports the measured accuracy, computation time, AUC, and pseudo-R-squared of each. The reported accuracies (SVM 99.1%, MCAR-SVM 98.30%, Decision Tree 90.85%) are benchmark results on a test split, not quantities defined by fitted parameters or by the conclusion. There is no equation in which the claimed result is inserted as an input, no self-citation is load-bearing, and no uniqueness theorem is imported to force a choice. The central weakness is that the paper's own abstract says the hybrid 'produced a more accurate result,' while Section IV and Table 1 state that SVM alone outperforms MCAR-SVM on every reported metric; this is an internal consistency or correctness problem, not circular reasoning. Because the reported numbers are independent of the claim being tested, the appropriate circularity score is 0.
Assumptions & free parameters
free parameters (2)
- MCAR minimum confidence threshold (minconf)
- SVM hyperparameters (kernel, cost)
assumptions (3)
- standard math SVM hyperplane optimization via Lagrangian and KKT conditions is valid.
- domain assumption Website features extracted from URLs and HTML are sufficient to distinguish phishing from legitimate sites.
- ad hoc to paper Combining MCAR-generated rules with SVM classification improves prediction accuracy.
Cite this review
Pith. "Pith review of A Predicting Phishing Websites Using Support Vector Machine and MultiClass Classification Based on Association Rule Techniques." pith.science (2026). https://pith.science/paper/CV5ADI57
@misc{pith2026250521141,
author = {Pith},
title = {Pith review of: A Predicting Phishing Websites Using Support Vector Machine and MultiClass Classification Based on Association Rule Techniques},
year = {2026},
howpublished = {\url{https://pith.science/paper/CV5ADI57}},
note = {Machine review of arXiv:2505.21141}
}
read the original abstract
Phishing is a semantic attack which targets the user rather than the computer. It is a new Internet crime in comparison with other forms such as virus and hacking. Considering the damage phishing websites has caused to various economies by collapsing organizations, stealing information and financial diversion, various researchers have embarked on different ways of detecting phishing websites but there has been no agreement about the best algorithm to be used for prediction. This study is interested in integrating the strengths of two algorithms, Support Vector Machines (SVM) and Multi-Class Classification Rules based on Association Rules (MCAR) to establish a strong and better means of predicting phishing websites. A total of 11,056 websites were used from both PhishTank and yahoo directory to verify the effectiveness of this approach. Feature extraction and rules generation were done by the MCAR technique; classification and prediction were done by SVM technique. The result showed that the technique achieved 98.30% classification accuracy with a computation time of 2205.33s with minimum error rate. It showed a total of 98% Area under the Curve (AUC) which showed the proportion of accuracy in classifying phishing websites. The model showed 82.84% variance in the prediction of phishing websites based on the coefficient of determination. The use of two techniques together in detecting phishing websites produced a more accurate result as it combined the strength of both techniques respectively. This research work centralized on this advantage by building a hybrid of two techniques to help produce a more accurate result.
Figures
Figures from the paper (7 more)
Reference graph
Works this paper leans on
-
[1]
Phishing exposed. Tech target article sponsored by: Sunbelt software
James, L. (2006), “Phishing exposed. Tech target article sponsored by: Sunbelt software”, available at: searchexchange.com
work page 2006
-
[2]
Fortune Magazine (2011). The Problem of Phishing. USA: Academic Press
work page 2011
-
[3]
Phishing Attacks in recent times
Anti-Phishing Working Group, (2011). Phishing Attacks in recent times. In Proceedings of 2nd Annual eCrime Researchers Summit (eCrime '07) (pp. 60 -69). Pittsburgh, USA: ACM
work page 2011
-
[4]
Rule-based phishing attack detection and phishing vectors
Nate, Lord (2017). Rule-based phishing attack detection and phishing vectors. In Proceedings of the International Conference on Security and Management (SAM '11). Las Vegas, USA
work page 2017
-
[5]
Ligier, S. (2016). Threat Vectors. What are they and why do you need to know them. Barracuda Blog . Retrieved 2nd July, 2017
work page 2016
-
[6]
Detecting Phishing Websites Using Associative Classification
Ajlouni, Moh'd Iqbal AL, Hadi, Wa'el, and Alwedyan, Jaber (2013). Detecting Phishing Websites Using Associative Classification. Dept of Business Administration, Al - Zaytoonah University, Jordan, m.alajlouny@zuj.edu.jo2. Dept of MIS, University of Petra, whadi@uop.edu.jo3. ITC Dept, Arab Open University, j.alwedyan@arabou.edu.sa* E -mail of the correspond...
work page 2013
-
[7]
(2016), Phishing Attacks and various Anti Phishing techniques
Suganya, V. (2016), Phishing Attacks and various Anti Phishing techniques. Depa rtment of Computer Science Al Albayt University. Retrieved 2nd August 2017
work page 2016
-
[8]
Amrit Kaur (2016), Detecting of Phishing Websites using SVM Technique
Leena and Er. Amrit Kaur (2016), Detecting of Phishing Websites using SVM Technique. Dept of Business Administration, Al - Zaytoonah University, Jordan. Dept of MIS, University of Petra
work page 2016
Show all 10 references
-
[9]
and Pawar, S
Kadam, Archana S. and Pawar, S. S. (2012) Comparison of Association Rule with Pruning and Adaptive technique for classification of phishing dataset
2012
-
[10]
(2005) MCAR: Multi -class Classification based on Association Rule
Thabtah, Fadi, Cowling, Peter, and peng, Yonghong. (2005) MCAR: Multi -class Classification based on Association Rule. O - 7803-8735-X/05/$20.00©2005IEEE
2005
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.