{'fraction_non_alphanumeric': 0.02766406153082744, 'fraction_numerical': 0.007319191167348964, 'mean_word_length': 4.657543859649123, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 1, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Phishing Site Detection Analysis Using Artificial Neural Network

Phishing site is a fake website that is designed specifically to provide false information or instructions. One of the sites most targeted for phishing scams by cybercriminals is an e-commerce. However, there is also a social media-based website that is a target for cybercriminals. Phishing sites are also used to commit fraud action on behalf of the original site and as a medium for distributing malware/virus computer by cybercriminals. Based on these problems, the researchers will conduct an analysis of phishing sites using neural network perceptron algorithm to determine the value of accuracy, precision and recall value.


Introduction
The number of phishing sites has been detected in the fourth quarter was 180.577 sites based on the APWG (Anti-Phishing Working Group) report. At the end of 2016, phishing sites were found on https infrastructure less than 5%. In 2017, one-third of total phishing attacks discovered attacks on websites that had https and SSL certificates, but there were still many attacks on the domain as much as 20% [1].
A phishing is a fake website designed similar to the original site. Display or phishing website interface will make unsuspecting victims. In addition, the phishing website can also be designed to provide information or further instructions from the original website by asking the victim to fill certain data required by phisher via the form available on the website of the phishing [2] [3]. Phishing also has an impact as a victim of data loss and the data used by the phisher and the impact that could have fatal namely to harm the victim of financial terms [2]. The objective of these phishing websites is as varied as social media, telecommunications, hosting, financial institutions, webmail, payment, e-commerce and much more.
Previous research revealed that human resources are also an important factor for the prevention of phishing sites, the study also discusses phishing on social networking sites and explain the details of the risk of phishing in companies [4]. Other studies are testing whether conceptual knowledge or procedural knowledge has a positive effect on the user to thwart phishing threats and the study found that the effects of the interaction of conceptual and procedural knowledge have a positive impact on users' computers with the security education [5]. While the research conducted by [6] developed a resistance against phishing attacks. The aspect of the security in both side of server and client is also very important to do in overcoming of the vulnerability of confidentiality and integrity of data [7]. This research will conduct an analysis to detect phishing sites using neural network perceptron algorithm. Based on previous research, neural network perceptron algorithm widely implemented in the study because the neural network perceptron has the ability to model the nonlinear system with conditions very complex relationship between variables [8].

Phising
The threats on the Internet that uses the host program, virus, phishing and more. Phishing is a new attack that could threaten the security of user data, which the user or the victim will be redirected to another website. At first, the phisher will create a fake website and send hundreds of emails containing links phony websites, and the victim would visit a link that is believed to be the link is legitimate, then the victim will include the identity or data, the offender will utilize the identity or the data to commit a crime which benefits the phisher as account sales, even falsification of data [9]. The flow diagram of the phising works is shown in figure 1.

Harvest new credentials
Email Account Phishing Site

Neural Network
The mimic human brain function is a concept of Neural Network. Neurons are thousands and even millions of small processing contained in the human brain are connected to one another through the connection of neurons. In the human brain, there is a set of neurons that can be used as input and output is processed and passed through each set of neurons [10]. This architecture could be shown in Figure 2.

Figure 2. Neural Network Perceptron Architecture
Feed Forward Neural (FNN) network perceptron and Back Propagation (BPP) Neural network perceptron does not have a significant difference, the difference between the two is the process of calculating the weight for each link.

Research Method 3.1.1 Research Design.
This research is an experimental research investigation using parameters or variables that have been defined and the use of the test or tests with the research method as follows: 1. Data collection Finding data is available, obtain additional data required and determine the required variables.

Data processing
Perform data selection, do a cleaning of data for subsequent modeling.

The method used
Perform data analysis, grouping variable, then made application of the model that corresponds to the type of data and sharing of data into two parts, namely the training data (training data) and test data (testing data).

Experiment
Tests on a model that has been determined to make decisions or find out the results.

Evaluation and validation
To evaluate the model has been determined to know the accuracy of the model.

Data collection.
The uci repository provides secondary data used for the study. Data obtained by 2,455 phishing sites, which will be divided into two as training data as much as 80% or 1964 data and test data as much as 20% or 491 of data [11]. Data phishing site has 18 features [11]. Such features are as follows: having an IP address, URL length, shortening service, having @ symbol, the double slash redirecting, prefix suffix, having subdomains, SSL final state, domain registration length, favicon, port, HTTPS token, request a URL, the URL of anchor, links in tags, SFH, submitting to email and abnormal URL. This feature will be categorized as shown in Table 1.

Having @ Symbol
URLs using the symbol @ will lead to the browser to ignore everything that precedes the @ symbol.
Rules: IF{ Url Having @ Symbol → Phishing Otherwise → Legitimate

Double Slash Redirecting
Double slash or "//" indicates that the user or the user will be redirected to another site. The position of the use of double slash usually appears at the sixth position as written at this link http://amikom.ac.id. However, if the double slash appears in the seventh position as https://amikom.ac.id it can be suspected as a phishing site.

Rules: IF{
The Position of the Last Occurrence of "//" in the URL > 7 → ℎ ℎ Otherwise → Legitimate

Prefix Suffix
Rarely a legitimate URL using symbols dashboard, but phisher will add a prefix or suffix to be separated by (-)

Having Sub Domains
The domain name may have a code for each country (cc TLD) such as "id", or for an academic educational institution "ac" and combined "ac.id" or also called two-level domain (SLD). Stages for extracting the feature of the first to do is remove the "www" in the URL and remove cc DTL if any. Then calculate the remaining dots, if the number of points is greater than one, then the URL can be classified as "suspect" because of only the subdomain. However, if the number of points greater than the two it will be categorized as a phishing because it has several subdomains, and sites categorized as legitimate if it does not have a subdomain.

Favicon
Favicon is an image used as an icon on a website, favicon also indicates the identity of the website. However, if the favicon is displayed apart in the address bar, it can be suspected that the website is a phishing website.

Rules: IF{
Favicon Loaded From External Domain → Phishing Otherwise → Legitimate

Port
Port used to validate certain services such as HTTP. The use of a firewall, proxy, and Network Address Translation or NAT can perform automatic blocking and can be opened in accordance with the wishes. But if all the ports are opened, then the phisher will find loopholes and enable any desired services such as stealing information.