Towards the Detection of Malicious URL and Domain Names Using Machine Learning - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2020

Towards the Detection of Malicious URL and Domain Names Using Machine Learning

Nastaran Farhadi Ghalati
  • Function : Author
  • PersonId : 1153127
Nahid Farhady Ghalaty
  • Function : Author
  • PersonId : 1153128
José Barata
  • Function : Author
  • PersonId : 976746


Malicious Uniform Resource Locator (URL) is an important problem in web search and mining. Malicious URLs host unsolicited content (spam, phishing, drive-by downloads, etc.) and try to lure uneducated users into clicking in such links or downloading malware which will result in critical data exfiltration. Traditional techniques in detecting such URLs have been to use blacklists and rule-based methods. The main disadvantage of such problems is that they are not resistant to 0-day attacks, meaning that there will be at least one victim for each URL before the blacklist is created. Other techniques include having sandbox and testing the URLs before clicking on them in the production or main environment. Such methods have two main drawbacks which are the cost of the sandboxing as well as the non-real-time response which is due to the approval process in the test environment. In this paper, we propose a method that exploits semantic features in both domains and URLs as well. The method is adaptive, meaning that the model can dynamically change based on the new feedback received on the 0-day attacks. We extract features from all sections of a URL separately. We then apply three methods of machine learning on three different sets of data. We provide an analysis of features on the most efficient value of N for applying the N-grams to the domain names. The result shows that Random Forest has the highest accuracy of over 96% and at the same time provides more interpretability as well as performance benefits.
Fichier principal
Vignette du fichier
496588_1_En_10_Chapter.pdf (491.62 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03741567 , version 1 (01-08-2022)





Nastaran Farhadi Ghalati, Nahid Farhady Ghalaty, José Barata. Towards the Detection of Malicious URL and Domain Names Using Machine Learning. 11th Doctoral Conference on Computing, Electrical and Industrial Systems (DoCEIS), Jul 2020, Costa de Caparica, Portugal. pp.109-117, ⟨10.1007/978-3-030-45124-0_10⟩. ⟨hal-03741567⟩
57 View
29 Download



Gmail Facebook Twitter LinkedIn More