Datasetpublic

feti-ai/phiusiil-if3070-stei-itb-2024-2025-1

PhiUSIIL Phishing URL Dataset — IF3070 Coursework Split IF3070 Foundations of Artificial Intelligence · STEI ITB · 2024/2025-1 The PhiUSIIL Phishing URL Dataset as it was distributed for the IF3070 Foundations of Artificial Intelligence course at STEI ITB in the 2024/2025-1 semester — resampled, split into a labelled training file and an unlabelled held-out file, and republished here unmodified. This is the coursework distribution, not the upstream dataset.… See the full description on the dataset page: https://huggingface.co/datasets/feti-ai/phiusiil-if3070-stei-itb-2024-2025-1.

sourceHugging Facecc-by-4.0updated 1mo agoView on Hugging Face

1likes32downloads

Dataset Card

PhiUSIIL Phishing URL Dataset — IF3070 Coursework Split

IF3070 Foundations of Artificial Intelligence · STEI ITB · 2024/2025-1

</div>

The PhiUSIIL Phishing URL Dataset as it was distributed for the IF3070 Foundations of Artificial Intelligence course at STEI ITB in the 2024/2025-1 semester — resampled, split into a labelled training file and an unlabelled held-out file, and republished here unmodified.

This is the coursework distribution, not the upstream dataset. It is not the full 235,795-row PhiUSIIL corpus: the class balance was changed, an id column was added, and the labels were withheld from the held-out file. If you want the original, take it from UCI ML Repository ID 967. Use this copy when you want to reproduce or compare against IF3070 2024/2025-1 coursework.

Task — tabular classification · binary · phishing detection

Files

File	Rows	Columns	Labelled
`train.csv`	140,404	56	yes
`test.csv`	10,000	55	no

test.csv carries every column of train.csv except label. No test score can be computed from this dataset, and any accuracy reported against it in coursework built on this split is a validation score under another name. Hold out a slice of train.csv instead, and say so.

Both files are byte-identical to what was handed out. Nothing was re-encoded, re-sorted, or cleaned.

Columns

Identifiers (2) — id, FILENAME. Row keys, not features. FILENAME refers to a page capture that is not part of any public release, upstream or here.

Text intermediates (4) — URL, Domain, TLD, Title. Raw strings that several numeric columns are derived from. Usable as features only after encoding.

URL-string features (21) — computable from the URL alone, with no page fetch:

URLLength  DomainLength  IsDomainIP  CharContinuationRate  TLDLegitimateProb
URLCharProb  TLDLength  NoOfSubDomain  HasObfuscation  NoOfObfuscatedChar
ObfuscationRatio  NoOfLettersInURL  LetterRatioInURL  NoOfDegitsInURL
DegitRatioInURL  NoOfEqualsInURL  NoOfQMarkInURL  NoOfAmpersandInURL
NoOfOtherSpecialCharsInURL  SpacialCharRatioInURL  IsHTTPS

Page features (28) — derived from the fetched HTML, so they cannot be recomputed for a new URL without retrieving it:

LineOfCode  LargestLineLength  HasTitle  DomainTitleMatchScore  URLTitleMatchScore
HasFavicon  Robots  IsResponsive  NoOfURLRedirect  NoOfSelfRedirect  HasDescription
NoOfPopup  NoOfiFrame  HasExternalFormSubmit  HasSocialNet  HasSubmitButton
HasHiddenFields  HasPasswordField  Bank  Pay  Crypto  HasCopyrightInfo  NoOfImage
NoOfCSS  NoOfJS  NoOfSelfRef  NoOfEmptyRef  NoOfExternalRef

Target (1) — label.

Three column names carry typos from upstream — NoOfDegitsInURL, DegitRatioInURL, SpacialCharRatioInURL. They are preserved verbatim; correcting them would break every script written against the file.

Missing values are pervasive, and deliberate

train.csv holds roughly 2.98M missing cells and test.csv roughly 164k — spread across almost every column, in both the URL-derived and page-derived groups. The upstream UCI dataset has none. The missingness was introduced when this split was prepared, and handling it is part of the exercise rather than a sign of a corrupted download.

The practical consequence: imputing from the training distribution pulls a row toward the majority class, which here is legitimate. For a phishing detector that is the wrong direction to fail in, and it is worth measuring rather than assuming away.

Class balance

`label`	Meaning	Rows	Share
`1`	legitimate	129,850	92.48%
`0`	phishing	10,554	7.52%

Read every accuracy against 0.9248. Predicting 1 for every row scores 92.48% while catching no phishing whatsoever, so accuracy alone cannot distinguish a working detector from a constant. Report recall on class 0, or precision–recall AUC, alongside it.

Note the polarity: 0 is phishing and is the useful positive class. It is easy to invert by accident, and a confusion matrix read the wrong way round looks excellent.

Loading

python

import pandas as pd

train = pd.read_csv("train.csv")
test = pd.read_csv("test.csv")     # no `label` column

X = train.drop(columns=["id", "FILENAME", "label"])
y = train["label"]

Or with datasets:

python

from datasets import load_dataset

ds = load_dataset("csv", data_files={"train": "train.csv", "test": "test.csv"})

Source and licence

<https://archive.ics.uci.edu/dataset/967/phiusiil+phishing+url+dataset>

Prasad, A. & Chandra, S. (2024). PhiUSIIL Phishing URL (Website) [Dataset]. UCI Machine Learning Repository. <https://doi.org/10.1016/j.cose.2023.103545>.

PhiUSIIL Phishing URL Dataset (Prasad & Chandra), available from the UCI Machine Learning Repository, licensed under CC BY 4.0.

This redistribution is likewise licensed under **CC BY 4.0**. Reuse it freely, including commercially, provided you keep the attribution above.

Acknowledgements

Prepared and distributed by the Teaching Assistants of IF3070 Foundations of Artificial Intelligence, STEI ITB, 2024/2025-1, and the Artificial Intelligence Laboratory of STEI ITB, 2024/2025-1. The resampling, the train/test split, and the held-out labels are theirs; this repository only republishes their files unchanged.

IF3070 Foundations of Artificial Intelligence · STEI ITB · 2024/2025-1

</div>