An intelligent identification and classification system for malicious uniform resource locators (URLs)

Abstract

Uniform Resource Locator (URL) is a unique identifier composed of protocol and domain name used to locate and retrieve a resource on the Internet. Like any Internet service, URLs (also called websites) are vulnerable to compromise by attackers to develop Malicious URLs that can exploit/devastate the user’s information and resources. Malicious URLs are usually designed with the intention of promoting cyber-attacks such as spam, phishing, malware, and defacement. These websites usually require action on the user’s side and can reach users across emails, text messages, pop-ups, or devious advertisements. They have a potential impact that can reach, in some cases, to compromise the machine or network of the user, especially those arriving by email. Therefore, developing systems to detect malicious URLs is of great interest nowadays. This paper proposes a high-performance machine learning-based detection system to identify Malicious URLs. The proposed system provides two layers of detection. Firstly, we identify the URLs as either benign or malware using a binary classifier. Secondly, we classify the URL classes based on their feature into five classes: benign, spam, phishing, malware, and defacement. Specifically, we report on four ensemble learning approaches, viz. the ensemble of bagging trees (En_Bag) approach, the ensemble of k-nearest neighbor (En_kNN) approach, and the ensemble of boosted decision trees (En_Bos) approach, and the ensemble of subspace discriminator (En_Dsc) approach. The developed approaches have been evaluated on an inclusive and contemporary dataset for uniform resource locators (ISCX-URL2016). ISCX-URL2016 provides a lightweight dataset for detecting and categorizing malicious URLs according to their attack type and lexical analysis. Conventional machine learning evaluation measurements are used to evaluate the detection accuracy, precision, recall, F Score, and detection time. Our experiential assessment indicates that the ensemble of bagging trees (En_Bag) approach provides better performance rates than other ensemble methods. Alternatively, the ensemble of the k-nearest neighbor (En_kNN) approach provides the highest inference speed. We also contrast our En_Bag model with state-of-the-art solutions and show its superiority in binary classification and multi-classification with accuracy rates of 99.3% and 97.92%, respectively.

An ensemble classification method based on machine learning models for malicious Uniform Resource Locators (URL)

“…The work in [5] developed two layers of detection. Initially, the URLs are identified as either benign or malware using a binary classifier.…”

“…Detecting multi-class malicious URLs is more challenging compared to binary classification since it requires rigorous feature extraction and classification to identify the types of malicious URLs. Albeit the high accuracy obtained in [4,5,13], the works in [4,13] focused on binary classification only instead of multi-class classification while the work in [5] includes limited data of 57,000 URLs only. Most of previous works applied much lesser data compared to this study with 651191 URLs which offers better generalisation.…”

“…Thirdly, a defacement URL leads to an online defacement attack that occurs when a fraudster breaks into a website and changes its content with different messages that may include vulgar language or other abusive messages. Unexpected modifications to the files that are saved on the website could signify a defacement assault and a security breach [3][4][5].…”

“…Multi-class classification is more challenging to solve due to the complex features that differentiate between types of malicious URLs. The classification challenge of malicious URL detection entails intricate capabilities such as data gathering, feature extraction, pre-processing, and classification [3][4][5][6][7].…”

Data correlation matrix-based spam URL detection using machine learning algorithms

“…In particular, we present findings on four ensemble learning methodologies, namely the ensemble of bagging trees (En_Bag) approach, the ensemble of k-nearest neighbor (En_kNN) approach, the ensemble of boosted decision trees (En_Bos) approach, and the ensemble of subspace discriminator (En_Dsc) approach. They also compare their En_Bag model with state-of-the-art solutions, demonstrating its superiority in both binary classification and multi-classification tasks, achieving accuracy rates of 99.3% and 97.92%, respectively [19].…”