高效的基于段模式的恶意URL检测方法

doi:10.11959/j.issn.1000-436x.2015293

Journal on Communications ›› 2015, Vol. 36 ›› Issue (Z1): 141-148.doi: 10.11959/j.issn.1000-436x.2015293

• Academic paper • Previous Articles Next Articles

Efficient segment pattern based method for malicious URL detection

Hai-lun LIN¹,Yan LI²,Wei-ping WANG¹,Yin-liang YUE¹,Zheng LIN¹

¹ Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China
² National Computer Network Emergency Response and Coordination Center,Beijing 100029,China

Online:2015-11-25 Published:2015-12-29
Supported by:
The National High Technology Research and Development Program of China (863 Program);The National Natural Science Foundation of China;The National Natural Science Foundation of China;The National Natural Science Foundation of China;The National Natural Science Foundation of China

Abstract

Abstract:

An efficient segment based method for detecting malicious URL was proposed.Firstly it analyzed the annotated malicious URLs in terms of three semantic segments,i.e.,domain segment,path segment and file segment.Secondly it quickly calculated the common pattern of each semantic segment exploiting the tri-gram model based inverted index.Finally it decided whether a given URL was malicious based on the segment patterns returned by searching the inverted index.Moreover,this method also supported the Jaccard based random domain name identification technique for deciding malicious URLs with random domain name.Experimental results show that proposed method outperforms the state-of-the-art baseline methods,and can achieve good efficiency and scalability on malicious URL detection.

Key words: malicious URL, segment pattern, tri-gram, inverted index, random name

Hai-lun LIN,Yan LI,Wei-ping WANG,Yin-liang YUE,Zheng LIN. Efficient segment pattern based method for malicious URL detection[J]. Journal on Communications, 2015, 36(Z1): 141-148.

Figures/Tables 7

References 18

[1]	Ponenom Institute . 2014 Global Report on the Cost of Cyber Crime[R]. 2014.
[2]	PORRAS P , SAIDI H . YEGNESWARAN V . Conficker C P2P Protocol and Implementation[R]. SRI International Tech.Rep. 2009.
[3]	PORRAS P , SAIDI H , YEGNESWARAN V . An Analysis of Conficker’s Logic and Rendezvous Points[R]. SRI International Tech.Rep, 2009.
[4]	https://url.spec.whatwg.org/[EB/OL]. 2015.
[5]	HENZINGE T A , RASKIN J C C O . The equivalence problem for finite automata:technical perspective[J]. Communications of the ACM, 2015,58(2): 86-86.
[6]	PRAKASH P , KUMAR M , KOMPELLA R R , et al. Phishnet:predictive blacklisting to detect phishing attacks[A]. Proceedings of IEEE International Conference on Computer Communications[C]. 2010. 1-5.
[7]	LIKARISH P , JUNG E . Leveraging Google safe browsing to characterize Web-based attacks[A]. Association for Computing Machinery[C]. 2009.
[8]	PROVOS N , MAVROMMATIC P , RAJAB M A , et al. All your iframes point to us[A]. Proceedings of the 17th Usenix Security Symposium[C]. 2008. 1-16.
[9]	MOSHCHUK A , BRAGIN T , GRIBBLE S D , et al. A crawler-based study of spyware in the Web[A]. Proceedings of the Network and Distributed System Security Symposium[C]. 2006.
[10]	ZHANG Y , HONG J , CRANOR L . Cantina:a content-based approach to detecting phishing Web sites[A]. Proceedings of 16th International Conference on World Wide Web[C]. 2007. 639-648.
[11]	许杰 . 云安全模式下恶意URL实时检测系统的设计与测试[D]. 北京:北京邮电大学, 2014. XU J . Design and Testing of Malicious URL Real-time Detecting System Working in the Mode of Cloud Security[D]. Beijing University of Posts and Telecommunications, 2014.
[12]	GARERA S , PROVOS N , CHEW M . A framework for detection and measurement of phishing attacks[A]. Proceedings of 5th ACM Workshop on Recurring Malcode[C]. 2007. 1-8.
[13]	MA J , SAUL L K , SAVAGE S , et al. Beyond blacklists:learning to detect malicious Web sites from suspicious URLs[A]. Proceedings of the 15th ACM SIGKDD Conference on Knowledge Discovery and Data Mining[C]. 2009. 1245-1254.
[14]	MA J , SAUL L K , SAVAGE S , et al. Identifying suspicious URLs:an application of large-scale online learning[A]. Proceedings of the 26th International Conference on Machine Learning[C]. 2009. 681-688.
[15]	THOMAS K , GRIER C , MA J , et al. Design and evaluation of a real-time url spam filtering service[A]. Proceedings of the 2011 IEEE Symposium on Security and Privacy[C]. 2011. 447-462.
[16]	HUANG D , XU K , PEI J . Malicious URL detection by dynamically mining patterns without pre-defined elements[J]. World Wide Web, 2014,17(6): 1375-1394.
[17]	HAN J W , KAMBER M , PEI J . Data Mining:Concepts and Techniques[M]. Beijing:China Machine Press. 2012.
[18]	YADAV S , REDDY A K , RANJAN S . Detecting algorithmically generated malicious domain names[A]. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement[C]. 2010. 48-61.

Metrics

Recommended 0

No Suggested Reading articles found!

URL类型	训练数据规模/万	测试数据规模/万
恶意URL	400	80
正确URL	800	120
共计	1 200	200

Efficient segment pattern based method for malicious URL detection

RichHTML

PDF

Knowledge

Cited

Abstract

Cite this article

share this article

Figures/Tables 7

References 18

Related Articles 1

Metrics

Recommended 0