Malicious URL Detection via Machine Learning Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional blacklisting systems are ineffective in detecting unknown malicious URLs, allowing cyber attackers to evade detection by continuously modifying their configurations, thereby posing a risk to web users and computing systems.
Innovation Solution
The use of classification models trained with machine learning algorithms to detect and categorize malicious URLs as phishing, spamming, or malware URLs by extracting features such as lexicology, link popularity, web page content, network properties, and DNS fluxiness, enabling continuous adaptation to new threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If blacklisting is used to identify malicious URLs, then known malicious URLs can be detected, but unknown malicious URLs cannot be detected
Solution Approach 1:
The patent transitions from a static blacklisting approach to a dynamic machine learning-based detection system. The classification models are continuously trained with new data and adapt to evolving attack patterns, enabling detection of both known and unknown malicious URLs through feature extraction and predictive analysis rather than simple pattern matching
Solution Approach 2:
The patent changes the detection parameters from exact URL matching (blacklisting) to multi-feature analysis including lexicology, link popularity, web page content, network properties, and DNS fluxiness. This parameter transformation enables the system to identify malicious URLs based on their characteristics rather than requiring prior knowledge of specific malicious addresses
2Ease of manufacture
If blacklisting systems are used, then implementation is simple, but detection capability against evolving attacks is insufficient
Solution Approach 1:
The patent replaces the mechanical blacklisting system (simple URL matching) with a machine learning-based classification system. This substitution introduces automated feature extraction, model training, and predictive classification that significantly improves reliability and adaptability while maintaining implementation feasibility through modular architecture
3Adaptability or versatility
If machine learning classification models are used to detect unknown malicious URLs, then detection capability improves, but system complexity increases
Solution Approach 1:
The patent segments the malicious URL detection system into distinct functional modules: feature extraction module, classification model training module, and URL classification module. This segmentation manages complexity by organizing the machine learning pipeline into manageable, independent components that can be developed and maintained separately
Data Source
AI summary
This document describes techniques for using features extracted from a URL to detect a malicious URL and categorize the malicious URL as one of a phishing URL, a spamming URL, a malware URL or a multi-type attack URL. The techniques employ one or more machine learning algorithms to train classification models using a set of training data which includes a known set of benign URLs and a known set of malicious URLs. The classification models are then employed to detect and/or categorize a malicious URL.