DeMalFier: Detection of Malicious web pages using an effective classifier

Abstract

The web has become an indispensable global platform that glues together daily communication, sharing, trading, collaboration and service delivery. Web users often store and manage critical information that attracts cybercriminals who misuse the web and the internet to exploit vulnerabilities for illegitimate benefits. Malicious web pages are transpiring threatening issue over the internet because of the notoriety and their capability to influence. Detecting and analyzing them is very costly because of their qualities and intricacies. The complexities of attacks are increasing day by day because the attackers are using blended approaches of various existing attacking techniques. In this paper, a model DeMalFier (Detection of Malicious Web Pages using an Effective ClassiFier) has been developed to apply supervised learning approaches to identify malicious web pages relevant to malware distribution, phishing, drive-by-download and injection by extracting the content of web pages, URL-based features and features based on host information. Experimental evaluation of DeMalFier model achieved 99.90/0 accuracy recommending the impact of our approach for real-life deployment.

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

“…mentioned in the paper [80] [100], [112]- [114], [120]- [123], [156] [96], [132], [135], [141], [157], [158] [106], [144], [150], [152], [155] Naïve Bayes 12 [93], [101], [112], [141], [154], [156] [106], [118], [136], [148]- [150] Logistic Regression 14 [93], [96], [101], [112], [141], [150], [154]- [156] [106], [118], [120], [127], [129] Random Tree 2 [93], [151] Random Forest 7 [93], [101], [102], [106], [120], [148], [150] Decision Tree 14 [93], [101], [105],…”

“…Matrix a 20 [35], [43]- [46], [48], [57], [69], [76], [80], [82] [29], [50], [51], [58], [66], [78], [79], [88], [89] Area Under Curve 4 [33], [35], [50], [51] Others b 6 [42], [57], [80], [54], [78], [81] a Consists of the raw True Positive, False Positive, True Negative, False Negative values as well as rates like TPR, FPR, TNR, FNR, specificity and sensitivity calculated from the confusion matrix. b Balanced Success Rate [38], Root Mean Square Error [42], effective rules/patterns [54], Cost/Sum of classification [80], False Alarm rate [78] [100], [112]- [114], [120]- [123], [156] [96], [132], [135], [141], [157], [158] [106], [144], [150], [152], [155] Naïve B...…”

“…Registration details 14 U,W [36], [40], [43], [47], [58], [80], uW: [96], [127], [130], [131], [134], [152], [154], [158] Creation/Update/Expiration time 27 U,W,E [28], [30], [36], [40], [43], [47], [58], [66], [76], [80], uE: [177], [182], [193] uW: [93], [102], [106], [112], [119], [122], [124], [126], [127], [132], [148], [150], [152], [158] AS number 8 U,W,E [36], [40], [44], uW: [94], [104], [152], [158], uE: [182] Status of WHOIS entry 7 U [28], …”

“…Location e of IP address origin 20 U,W,E [28], [40], [43], [46], [49], [79], [80], [82] uW: [93], [94], [96], [112], [113], [121], [129], [152], [157], [158], uE: [191], [195] Nature/speed of connection 5 U [28], [36], [43], [46], [49] Shortened URL features Initial and Landing URL 6 U,W [60], [69], uW: [129], [138], [140], [157] Redirects on each page 5 U,W [62], [64], [87], uW: [129], [155] URL Redirect Chain length 16 U,W [29], [30], [60], [62], [79], uW: [100], [105], [112], [124], [125], [127], [129],…”

An efficient malicious webpage static detection framework based on optimized Bayesian and hybrid machine learning

“…Web page features are extracted using HTML analysis and the regular expression matching by Jsoup. Through consulting the related literatures [11][12][13]21,22,24,38,39 and analyzing of a large number of webpage samples, we divide the extracted features into three categories, including URL feature, HTML feature, JavaScript feature. A total of 44 characteristics are summarized, as shown in Table 1.…”