Improved Detection of Malicious Domain Names Using Gradient Boosted Machines and Feature Engineering

Alhogail, Areej; Al-Turaiki, Isra

doi:10.5755/j01.itc.51.2.30380

Cited by 6 publications

(3 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The first work for a browser-based application utilizing only machine learning is MADMAX [3], including feature selection. In recent years, MADDONA [4] was proposed as an extension of MADMAX to optimize feature selection and neural network architectures further in accordance with the latest feature engineering [30]. We combine our dataset with MADMAX and then show that its resultant performance outperforms MAD-DONA.…”

Section: Further Related Workmentioning

confidence: 98%

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

Komiya,

Yanai,

Yamashita

et al. 2024

Journal of Information Processing

View full text Add to dashboard Cite

Machine learning is often used for malicious website detection, but an approach incorporating WebAssembly as a feature has not been explored due to a limited number of samples, to the best of our knowledge. In this paper, we propose JABBERWOCK (JAvascript-Based Binary EncodeR by WebAssembly Optimization paCKer), a tool to generate WebAssembly datasets in a pseudo fashion via JavaScript. Loosely speaking, JABBERWOCK automatically gathers JavaScript code in the real world, converts them into WebAssembly, and then outputs vectors of the WebAssembly as samples for malicious website detection. We experimentally evaluate JABBERWOCK from three perspectives. First, we measure its processing time. Second, we compare the samples generated by JABBERWOCK with the actual WebAssembly gathered from the Internet. Third, we investigate if JABBERWOCK can be used in malicious website detection. Regarding the processing time, we show that JABBERWOCK can construct a dataset in 4.5 seconds per sample for any number of samples. Next, comparing 10,000 samples output by JABBERWOCK with 168 gathered WebAssembly samples, we believe that the generated samples by JABBERWOCK are similar to those in the real world. We then show that JABBERWOCK can provide malicious website detection with 99% F1-score because JABBERWOCK makes a gap between benign and malicious samples as the reason for the above high score. We also confirm that JABBERWOCK can be combined with an existing malicious website detection tool to improve F1-scores. JABBERWOCK is publicly available via GitHub (https://github.com/c-chocolate/Jabberwock).

show abstract

Section: Further Related Workmentioning

confidence: 98%

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

Komiya,

Yanai,

Yamashita

et al. 2024

Journal of Information Processing

View full text Add to dashboard Cite

show abstract

“…To choose the most influential feature, we utilize the automatic feature engineering technique to improve the model performance employing the power of the most relevant features [23]. Automatic feature engineering is the process of automatically selecting or building new features from existing features [24], which trade-off between feature complexity and model performance.…”

Section: E Automatic Feature Engineeringmentioning

confidence: 99%

Protecting Smart-Home IoT Devices From MQTT Attacks: An Empirical Study of ML-Based IDS

Alasmari,

Alhogail

2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

Smart homes are becoming more and more popular in the world, and they are mainly on Internet of Things (IoT) technologies to enable their functionality. However, since IoT devices have limited computing power and resources, implementing strong security measures is difficult, which makes the use of intrusion detection systems (IDS) an appropriate option. In this paper, we propose an optimized model with high performance for intrusion detection in Message Queue Telemetry Transport protocol (MQTT)based IoT networks for smart homes. This is done by studying a total of 22 Machine Learning (ML) algorithms based on an extended two-stage evaluation approach that includes several aspects for optimizing and validating performance for finding the ideal model. Based on the empirical evaluation, the GLM classifier with the random over-sampling technique produces the best detection performance with 100% accuracy and an f-score of 100%, outperforming the previous studies. This paper also investigates the influence of automatic feature engineering technique on the performance of algorithms. With the automatic feature engineering technique, the performance increased by up to 38.9%, and the time consumed to classify attacks decreased by up to 67.7%. This shows that automatic feature engineering can improve performance and reduce detection time.

show abstract

“…Entropy measures the uncertainty of the data. From a different perspective, entropy measures how difficult it is to guess the label of a random sample from a dataset, where low entropy indicates that the data labels are quite uniform, and high entropy indicates that the labels are in confusion [21]. Information gain computes the difference between the entropy before and after a split and specifies class element impurity.…”

Section: Feature Importancementioning

confidence: 99%

Machine-Learning-based User Behavior Classification for Improving Security Awareness Provision

Al-Mashhour,

Alhogail

2023

IJACSA

View full text Add to dashboard Cite

Users of information technology are regarded as essential components of information security. Users' lack of cybersecurity awareness can result in external and internal security attacks and threats in any organization that has several users or employees. Although various security methods have been designed to protect organizations from external intrusions and attacks, the human factor is also essential because security risks by "insiders" can occur due to a lack of awareness. Therefore, instead of general nontargeted security training, comprehensive cybersecurity awareness should be provided based on employees' online behavior. This study seeks to provide a machine-learning-based model that provides user behavior analysis in which organizations can profile their employees by analyzing their online behavior to classify them into different classes and, thus, help provide them with appropriate awareness sessions and training. The model proposed in this paper will be evaluated and assessed through its implementation on a sample dataset that reflects users' online activities over a specific period to measure the model's accuracy and effectiveness. A comparison between six classification techniques has been made, and random forest classification had the best performance regarding classification accuracy and performance time. After users are classified, each group can be provided with the appropriate training material. This study will stimulate additional research in this area, which has not been widely investigated, and it will provide a useful point of reference for other studies. Additionally, it should provide insightful information to help decision-makers in organizations provide necessary and effective security awareness.

show abstract

Improved Detection of Malicious Domain Names Using Gradient Boosted Machines and Feature Engineering

Cited by 6 publications

References 31 publications

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

Protecting Smart-Home IoT Devices From MQTT Attacks: An Empirical Study of ML-Based IDS

Machine-Learning-based User Behavior Classification for Improving Security Awareness Provision

Contact Info

Product

Resources

About