Beyond blacklists: learning to detect malicious web sites from suspicious URLs

By Justin Ma, Lawrence K. Saul, Stefan Savage, Geoffrey M. Voelker. Knowledge Discovery and Data Mining, 2009

956 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/6589b93c229b079cc8138c7db35ad7ff9c7dd37d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

PhishNet: Predictive Blacklisting to Detect Phishing Attacks (2010, background): “consider the problem of matching URLs with blacklist entries in [10].”
Graph based anomaly detection and description: a survey (2014, background): “2005), malicious cargo shipments (Das and Schneider 2007; Eberle and Holder 2007) malware/spyware detection (Invernizzi and Comparetti 2012; Ma et al. 2009; Provos et al. 2007), false advertising (Lee et al.”
Malicious URL Detection using Machine Learning: A Survey (2017, methodology): “In particular, [12] used the presence in a blacklist as a feature,”
PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration (2016, methodology): “A related approach is to use various lexical and host-based features of the URL for detection, but exclude Web page content [38, 39, 65].”
Clustering Potential Phishing Websites Using DeepMD5 (2012, background): “Gyawali et al. and Ma et al. proposed solutions to phishing identification by using features that can be derived from a URL [6][9].”
Detecting algorithmically generated malicious domain names (2010, background): “While they classify each URL independently, our work is focused on classifying a group of URLs as algorithmically generated or not, solely by making use of the set of alphanumeric characters used.”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, methodology): “[27] study a number of statistical methods for ma-”
Large-Scale Automatic Classification of Phishing Pages (2010, methodology): “Despite the noise in the training data, our classifier learns a robust model for identifying phishing pages which correctly classifies more than 90% of phishing pages several weeks after training concludes.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, neutral): “Starting from a hint host (case 3).”
On the Security of Machine Learning in Malware C&C Detection (2016, positive): “While not explicitly analysing DNS trafﬁc, Ma et al. [2009] test the effectiveness of three popular classiﬁers (bayes, SVM and logistic regression (LR) ) in identifying malicious domains.”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “[28] extract lexical and host-based URL features from spam emails and use active DNS probing on domain names to identify malicious websites.”
URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection (2018, methodology): “However, the most commonly used features are lexical features, as they have demonstrated good performance and are relatively easy to obtain [2, 26].”
High-performance content-based phishing attack detection (2011, methodology): “URL-based detection techniques use features of the URLs themselves to determine whether the link is malicious [9] [10] [11].”