LegitPhish Dataset
收藏资源简介：
The dataset contains 101,219 URLs and 18 features (including the label). Here's a description of each attribute: Phishing (0): 63,678 URLs Legitimate (1): 37,540 URLs These URLs have been sourced from the URLHaus database, scraped from many sites and other well-known repositories malicious websites actively used in phishing attacks. Each entry in this subset has been manually verified and is labeled as a phishing URL, making this dataset highly reliable for identifying harmful web content. The legitimate URLs have been collected from reputable sources such as Wikipedia and Stack Overflow. These websites are known for hosting user-generated content and community discussions, ensuring that the URLs represent safe, legitimate web addresses. The URLs were randomly scraped to ensure diversity in the types of legitimate sites included. Dataset Features: URL: The full web address of each entry, providing the primary feature for analysis. Label: A binary label indicating whether the URL is legitimate (1) or phishing (0). Applications: This dataset is suitable for training and evaluating machine learning models aimed at distinguishing between phishing and legitimate websites. It can be used in a variety of cybersecurity research projects, including URL-based phishing detection, web content analysis, and the development of real-time protection systems. Usage: Researchers can leverage this balanced dataset to develop and test algorithms for identifying phishing websites with high accuracy, using features such as URL structure, and class label attributes. The inclusion of both phishing and legitimate URLs provides a comprehensive basis for creating robust models capable of detecting phishing attempts in diverse online environments. Feature Name Description URL The full URL string. url_length - Total number of characters in the URL. has_ip_address - Binary flag (1/0): whether the URL contains an IP address. dot_count - Number of . characters in the URL. https_flag - Binary flag (1/0): whether the URL uses HTTPS. url_entropy - Shannon entropy of the URL string – higher values indicate more randomness. token_count - Number of tokens/words in the URL. subdomain_count - Number of subdomains in the URL. query_param_count - Number of query parameters (after ?). tld_length - Length of the Top-Level Domain (e.g., "com" = 3). path_length - Length of the path part after the domain. has_hyphen_in_domain Binary flag (1/0): whether the domain contains a hyphen (-). number_of_digits - Total number of numeric characters in the URL. tld_popularity Binary flag (1/0): whether the TLD is popular. suspicious_file_extension Binary flag (1/0): indicates if the URL ends with suspicious extensions (e.g., .exe, .zip). domain_name_length - Length of the domain name. percentage_numeric_chars - Percentage of numeric characters in the URL. ClassLabel Target label: 1 = Legitimate, 0 = Phishing.
本数据集包含101219条URL与18项特征（含标签）。以下为各属性说明：钓鱼网址（Phishing，标签0）共63678条，合法网址（Legitimate，标签1）共37540条。 这些URL源自URLHaus数据库，通过爬取大量站点及其他知名仓库中的活跃钓鱼攻击恶意网站构建而成。该子集的每一条条目均经过人工核验并标注为钓鱼URL，因此本数据集在识别有害网络内容方面具备极高的可靠性。 合法URL采集自维基百科（Wikipedia）、Stack Overflow等权威来源。这些平台以承载用户生成内容与社区讨论著称，确保所收录的URL均为安全合法的网络地址。本次采集通过随机爬取的方式，保证了合法站点类型的多样性。 数据集特征： 1. URL：每条条目对应的完整网络地址，为分析提供核心特征。 2. 标签（Label）：二元标签，用于指示该URL为合法（1）或钓鱼（0）网址。 应用场景： 本数据集适用于训练与评估旨在区分钓鱼与合法网站的机器学习模型，可广泛应用于各类网络安全研究项目，包括基于URL的钓鱼检测、网络内容分析以及实时防护系统的开发。 使用方式： 研究人员可借助该均衡数据集，基于URL结构、类别标签等特征开发并测试高精度钓鱼网站识别算法。数据集同时包含钓鱼与合法URL，为构建能够在多样化在线环境中有效检测钓鱼攻击的鲁棒模型提供了全面基础。 特征名称与说明： - URL：完整URL字符串。 - url_length（URL长度）：URL包含的总字符数。 - has_ip_address（含IP地址标识）：二元标记（1/0），用于指示URL是否包含IP地址。 - dot_count（点号数量）：URL中.字符的总数。 - https_flag（HTTPS标识）：二元标记（1/0），用于指示URL是否使用HTTPS协议。 - url_entropy（URL香农熵（Shannon entropy））：URL字符串的香农熵，数值越高代表随机性越强。 - token_count（Token数量）：URL中的Token/单词数量。 - subdomain_count（子域名数量）：URL包含的子域名数量。 - query_param_count（查询参数数量）：URL中?后的查询参数总数。 - tld_length（顶级域名（Top-Level Domain，TLD）长度）：顶级域名的长度，例如“com”的长度为3。 - path_length（路径长度）：域名后路径部分的字符长度。 - has_hyphen_in_domain（域名含连字符标识）：二元标记（1/0），用于指示域名是否包含连字符（-）。 - number_of_digits（数字字符总数）：URL中包含的数字字符总数量。 - tld_popularity（顶级域名流行度标识）：二元标记（1/0），用于指示该顶级域名是否为流行域名。 - suspicious_file_extension（可疑文件扩展名标识）：二元标记（1/0），用于指示URL是否以可疑扩展名结尾，例如.exe、.zip。 - domain_name_length（域名长度）：域名的总字符长度。 - percentage_numeric_chars（数字字符占比）：URL中数字字符所占的百分比。 - 类别标签（ClassLabel）：目标标签，1代表合法网址，0代表钓鱼网址。
