Implementation of the Random Forest Algorithm for Anomaly Detection of Phishing Attacks on Computer Networks

Abstract

Phishing attacks are among the most common and dangerous cyber security threats, as they exploit manipulation techniques to steal sensitive user information. This research focuses on leveraging the Random Forest algorithm to identify anomalies caused by phishing attacks in computer network environments. Random Forest was selected for its superior classification performance and its capability to handle a wide variety of data types with minimal over fitting. The experimental dataset consists of captured network traffic, containing both benign activities and malicious events labeled as phishing. The data underwent pre-processing, feature selection, and model training using Random Forest. The experimental results show that the model achieved 98% accuracy, with precision 98%, recall 98%, and F1-score 98%. This study also reveals that URL features such as the percentage of external links redirecting back to the original domain, frequent domain name mismatches, the number of hyphens (-) in the URL, and the presence of data submission via email are relevant and effective in distinguishing phishing from non-phishing URLs. These findings confirm that Random Forest can serve as an effective method for identifying phishing attacks based on URL characteristics.