MALURLS: A Lightweight Malicious Website Classification Based on URL Features

Abstract

<span style="font-family: Times New Roman; font-size: small;"> </span><p style="margin: 0cm 0cm 0pt; layout-grid-mode: char;" class="Abstract"><span style="font-weight: normal; mso-bidi-font-size: 9.0pt;"><span style="font-size: x-small;"><span style="font-family: Times New Roman;">Surfing the World Wide Web (WWW) is becoming a dangerous everyday task with the Web becoming rich in all sorts of attacks. Websites are a major source of many scams, phishing attacks, identity theft, SPAM commerce and malwares. However, browsers, blacklists and popup blockers are not enough to protect users. That requires fast and accurate systems with the ability to detect new malicious content. We propose a lightweight system to detect malicious websites online based on URL lexical and host features and call it MALURLs. The system relies on Na&iuml;ve Bayes classifier as a probabilistic model to detect if the target website is a malicious or benign. It introduces new features and employs self learning using Genetic Algorithm to improve the classification speed and precision. A small dataset is collected and expanded through GA mutations to learn the system over short time and with low memory usage. A completely independent testing dataset is automatically gathered and verified using different trusted web sources. They algorithm achieves an average precision of 87%.</span></span></span></p><span style="font-family: Times New Roman; font-size: small;"> </span

Investigating the Influence of Feature Sources for Malicious Website Detection

“…To further emphasize, there are studies which display more accurate and logical representations of their JavaScript feature sets. Studies [33][34][35][36] are of varying times and datasets which plot distributions and t-SNE plots of their JavaScript features, which count deobfuscated code length, number of events and various vector embedding representations. These features are quite similar to the ones considered in this study, which allows us to benchmark the extent of the bias.…”

Booter blacklist: Unveiling DDoS-for-hire websites

“…For this work ( § IV) we surveyed several classification methods, highlighting those that could potentially be used for the Booters case, named: Euclidean distance [19], [24], Squared Euclidean distance [22], Manhattan distance [20], Fractional distance [19], [23], Cosine distance [20], K-Nearest Neighbors [21], [25], [26], and Naive Bayes [14], [15], [25], [13]. From all the studied methods Support Vector [27], [28], Hamming distance [29] and Genetic Algorithm [30] were not tested in our classification investigation. However, we consider these three methods as a future work opportunity to improve our classification accuracy.…”

Detecting Malicious URLs Using Machine Learning Techniques: Review and Research Directions

“…This type of attack redirects the user to a malicious website that has been altered by hackers in one or more aspects, such as its visual appearance or some of the site's contents. Hacktivists strive to take down a website for several reasons [13]. This form of action occurs when the attackers discover the vulnerabilities of the website and utilize those vulnerabilities to compromise the website and modify the content on the web page without the owner's authorization, which is technically known as penetrating a website [11].…”