A Fault Tolerant Approach for Malicious URL Filtering

Ahmed, Mansoor; Khan, Abid; Saleem, Osama; Haris, Muhammad

doi:10.1109/isncc.2018.8530984

Cited by 3 publications

(2 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These domains are used for phishing [2][3][4][5][6] (e.g., spear phishing), Command and Control (C&C) [7] and a vast set of virus and malware [8] attacks. Therefore, the ability to identify a malicious domain in advance is a massive game-changer [9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26]. A common way of identifying malicious/compromised domains is to collect information about the domain names (alphanumeric characters) and network information (such as DNS and passive DNS data).…”

Section: Introductionmentioning

confidence: 99%

Less Is More: Robust and Novel Features for Malicious Domain Detection

2022

View full text Add to dashboard Cite

Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.

show abstract

Section: Introductionmentioning

confidence: 99%

Less Is More: Robust and Novel Features for Malicious Domain Detection

2022

View full text Add to dashboard Cite

show abstract

“…In such attacks, the adversary can utilize a set of domains and IP addresses to orchestrate sophisticated attacks [56,12]. Therefore, the ability to identify a malicious domain in advance is a massive game-changer [11,12,14,15,18,20,22,25,26,27,37,45,49,56,60,61,64].…”

Section: Introductionmentioning

confidence: 99%

Less is More: Robust and Novel Features for Malicious Domain Detection

Hajaj

Hason²,

Harel

et al. 2020

Preprint

View full text Add to dashboard Cite

Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting these attacks, many alarming problems remain open, such as the weak spots of the defense mechanisms. Since machine learning has become one of the most prominent methods of malware detection, A robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is reduced by half (from nine to four features), the performance of the classifier is still improved (an increase in the model's F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust to the adversary's manipulation. Based on extensive evaluation of the different feature sets and commonly used classification models this paper show that models which are based on robust features are resistant to malicious perturbations, and at the same time useful for classifying non-manipulated data.

show abstract