  Phishing as one of the most well-known cybercrime activities is a deception
of online users to steal their personal or confidential information by
impersonating a legitimate website. Several machine learning-based strategies
have been proposed to detect phishing websites. These techniques are dependent
on the features extracted from the website samples. However, few studies have
actually considered efficient feature selection for detecting phishing attacks.
In this work, we investigate an agreement on the definitive features which
should be used in phishing detection. We apply Fuzzy Rough Set (FRS) theory as
a tool to select most effective features from three benchmarked data sets. The
selected features are fed into three often used classifiers for phishing
detection. To evaluate the FRS feature selection in developing a generalizable
phishing detection, the classifiers are trained by a separate out-of-sample
data set of 14,000 website samples. The maximum F-measure gained by FRS feature
selection is 95% using Random Forest classification. Also, there are 9
universal features selected by FRS over all the three data sets. The F-measure
value using this universal feature set is approximately 93% which is a
comparable result in contrast to the FRS performance. Since the universal
feature set contains no features from third-part services, this finding implies
that with no inquiry from external sources, we can gain a faster phishing
detection which is also robust toward zero-day attacks.
