A Malicious URL Detection Model Based on Convolutional Neural Network

Abstract

With the development of Internet technology, network security is under diverse threats. In particular, attackers can spread malicious uniform resource locators (URL) to carry out attacks such as phishing and spam. The research on malicious URL detection is significant for defending against these attacks. However, there are still some problems in the current research. For instance, malicious features cannot be extracted efficiently. Some existing detection methods are easy to evade by attackers. We design a malicious URL detection model based on a dynamic convolutional neural network (DCNN) to solve these problems. A new folding layer is added to the original multilayer convolution network. It replaces the pooling layer with the k-max-pooling layer. In the dynamic convolution algorithm, the width of feature mapping in the middle layer depends on the vector input dimension. Moreover, the pooling layer parameters are dynamically adjusted according to the length of the URL input and the depth of the current convolution layer, which is beneficial to extracting more in-depth features in a wider range. In this paper, we propose a new embedding method in which word embedding based on character embedding is leveraged to learn the vector representation of a URL. Meanwhile, we conduct two groups of comparative experiments. First, we conduct three contrast experiments, which adopt the same network structure and different embedding methods. The results prove that word embedding based on character embedding can achieve higher accuracy. We then conduct the other three experiences, which use the same embedding method proposed in this paper and use different network structures to determine which network is most suitable for our model. We verify that the model designed in this paper has the highest accuracy (98%) in detecting malicious URL through these experiences.

Developing a Framework for Detecting Phishing URLs using Machine Learning

“…Regarding the problem of detecting phishing URLs, there are two main methods: rule-based detection method and behavior analysis-based detection method [1,2,3]. In which, the behavior-based detection method using machine learning and deep learning algorithms is developing a lot nowadays.…”

“…Behaviorbased detection methods often seek ways to analyze anomalous behavior based on URL information. Some information is often applied to extract such as [1,3,4,5,6,7,8,9,10] domain, HTTP protocol, body, DNS query, lexical, host-based, etc. In this paper, we propose some new features representing abnormal behaviors of phishing URLs.…”

“…to classify these URLs. Similarly, in the research [3], the authors proposed a method to detect malicious URLs using the dynamic convolutional neural network model. In the experimental part, the authors conducted experiments and proved that this proposal is superior to other methods using convolutional neural networks.…”

An intelligent identification and classification system for malicious uniform resource locators (URLs)

“…An ensemble model was built aiming to improve the detection rate. Wang et al [ 28 ] proposed a model using Dynamic Convolutional Neural Network (DCNN) for malicious URLs detection. Stating that their model can prevent attackers from passing the current detection model, and the problem of not having the malicious features extracted properly is solved.…”

“…al [ 27 ] RD, DT, NB, AdaBoost, KNN, XGBoost, SVM, Ensemble Private 2-Classes XGBoost is a powerful algorithm Fast Approach, Applying ensemble model Good features extraction The main focus was on feature extraction only It might get bypassed in modern ways Wang et. al [ 28 ] DCNN Private 2-Classes Good learning mechanism There is a low possibility of mixing benign and dangerous URLs High accuracy The model is heavy-weight Dark web URLs cannot be classified In real-time, the detection process will affect the network performance Manoj et al [ 29 ] Logistic regression, SVM, XGBoost, MLP, and Auto-Encoders Alexa, Dmoz, personal web history, PhishTank, whois 2-Classes Several classifiers were used Using XGBoost and MLP Good analyzing process Small dataset Low accuracy Slow in real-time Relying on 3rd-parties Rana et al [ 30 ] LMT Phish Tank (2015) 2-Classes Multilayer deep learning Approach for better detection Old and small dataset, Modern phishing URLs might not be detected …”