A Study on Techniques for Proactively Identifying Malicious URLs

Popescu, Adrian; Prelipcean, Dumitru Bogdan; Gavriluţ, Dragoş Teodor

doi:10.1109/synasc.2015.40

Cited by 5 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[137] follow another style of integration of supervised and unsupervised where first k-means clustering is performed, and the cluster ID is used as a feature to train a classifier. [138] proposed the usage of an unsupervised hashbased clustering system, wherein specific clusters were labeled as malicious or benign (based on majority of the training data).…”

Section: Other Learning Methodsmentioning

confidence: 99%

“…Similarity Learning [57], [58], [58]-[60] Unsupervised Learning [94], [137], [138] String Pattern Matching [31]- [33], [54], [88], [148], [149] (ii) Fast Detection: The detection speed is another important concern for a practical malicious URL detection system, particularly for online systems or cybersecurity applications. For example, when deploying the malicious URL detection service in online social networks like Twitter, whenever a user posts any new URL, an ideal system should be able to detect the malicious URL immediately and then block the URL and its related tweets in real time to prevent any threats and harms to public.…”

Section: A Design Principlesmentioning

confidence: 99%

See 1 more Smart Citation

Malicious URL Detection using Machine Learning: A Survey

Sahoo,

Liu,

Hoi

2017

Preprint

View full text Add to dashboard Cite

Malicious URL, a.k.a. malicious website, is a common and serious threat to cybersecurity. Malicious URLs host unsolicited content (spam, phishing, drive-by exploits, etc.) and lure unsuspecting users to become victims of scams (monetary loss, theft of private information, and malware installation), and cause losses of billions of dollars every year. It is imperative to detect and act on such threats in a timely manner. Traditionally, this detection is done mostly through the usage of blacklists. However, blacklists cannot be exhaustive, and lack the ability to detect newly generated malicious URLs. To improve the generality of malicious URL detectors, machine learning techniques have been explored with increasing attention in recent years. This article aims to provide a comprehensive survey and a structural understanding of Malicious URL Detection techniques using machine learning. We present the formal formulation of Malicious URL Detection as a machine learning task, and categorize and review the contributions of literature studies that addresses different dimensions of this problem (feature representation, algorithm design, etc.). Further, this article provides a timely and comprehensive survey for a range of different audiences, not only for machine learning researchers and engineers in academia, but also for professionals and practitioners in cybersecurity industry, to help them understand the state of the art and facilitate their own research and practical applications. We also discuss practical issues in system design, open research challenges, and point out some important directions for future research.

show abstract

Section: Other Learning Methodsmentioning

confidence: 99%

Section: A Design Principlesmentioning

confidence: 99%

Malicious URL Detection using Machine Learning: A Survey

Sahoo,

Liu,

Hoi

2017

Preprint

View full text Add to dashboard Cite

show abstract

“…In the Appendix, we give tables with bibliographic numbers of the papers, so that interested readers can easily find the original sources for each entry in our tables in the main part of the paper. Accuracy 28 [21], [29], [30], [34]- [36], [42], [63], [64], [69], [80] [33], [44], [53], [55], [56], [66], [79], [86], [89] [22], [48], [50]- [52], [77], [81], […”

Section: Appendixmentioning

confidence: 99%

“…Recall F-score 20 [30], [33]- [35], [47], [58]- [60], [69], [86] [22], [29], [50]- [52], [62]- [64], [70], [89] Error Rate 13 [21], [28], [34], [39], [40], [43], [49] [38], [65], [67], [73], [85], [89] Confusion Matrix a 20 [35], [43]- [46], [48], [57], [69], [76], [80], [82] [29], [50], [51], [58], [66], [78], [79], [88], [89] Area Under Curve 4 [33], [35], [50], [51] Others b 6 [42], [57],…”

Section: ] Precisionmentioning

confidence: 99%

“…Misspelled/Bad domain name 8 U [36], [42], [43], [56], [69], [72], [80], [89] Top Level Domain features 22 U,W,E [36], [38], [43], [46], [65], [69], [70], [78], [85], uW: [105], [107], [110], [113], [138], [139], [152], [154], [157], uE: [163], [170], [182], [194] TTL c value of DNS 9 U,W,E [28], [43], [47], [70], uW: [93], [102], [132], [144], uE: [186] Age of Domain 13 U,W,E [52], uW: [107], [113], [119], [120], [124], [125], [127], [132], [150],…”

Section: Dns Basedmentioning

confidence: 99%

See 1 more Smart Citation

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

109

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

Feature optimization and hybrid classification for malicious web page detection

Deng

Peng

Yang

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Summary The security threats from malicious web pages have become a hot topic for cyber security. One goal pursued by current research is to identify malicious web pages quickly, accurately, and efficiently. Considering the high detection costs and potential dimensionality curse of malicious webpage detection, in this article, we proposes a detection framework based on feature optimization and hybrid classification. It provides three properties: more new malicious webpage features, information gain‐based feature selection method, and integrating multiple machine learning method. A comprehensive experimental evaluation demonstrates that the proposed framework has remarkable advantages in aspects of detection accuracy and detection performance.

show abstract

A Study on Techniques for Proactively Identifying Malicious URLs

Cited by 5 publications

References 10 publications

Malicious URL Detection using Machine Learning: A Survey

Malicious URL Detection using Machine Learning: A Survey

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Feature optimization and hybrid classification for malicious web page detection

Contact Info

Product

Resources

About