URL Classification based on Active Learning Approach

Cyprienna, Rakotoasimbahoaka Antsa; Yannick, Raharijaona Zo Lalaina; Randria, Iadaloharivola; Raft, Razafindrakoto Nicolas

doi:10.1109/crc50527.2021.9392555

Cited by 1 publication

(2 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the most common approach to identifying malicious domains is by means of machine learning (ML) and Deep Learning (DL) [11,14,20,23,24,27,28,[34][35][36][37][38][39][40][41][42]. Researchers can train ML algorithms to label URLs as malicious or benign using a set of extracted features.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Less Is More: Robust and Novel Features for Malicious Domain Detection

2022

View full text Add to dashboard Cite

Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.

show abstract

Section: Related Workmentioning

confidence: 99%

“…However, Segugio is a system that can only detect malware-related domains based on their relationship to previously known domains and therefore cannot detect new (unrelated to previous malicious domains) malicious domains. Additional information concerning malicious domain filtering and malicious URL detection can be found in [34,42].…”

Section: Related Workmentioning

confidence: 99%