MALICIOUS UNIFORM RESOURCE LOCATOR DETECTION

摘要

The techniques described herein use training data to train classification models to detect malicious Uniform Resource Locators (URLs) that target authentic resources (e.g., Web page, Web site, or other network locations accessed via a URL). The techniques train the classification models using one or more machine learning algorithms. The training data may include known benign URLs and known malicious URLs (e.g., training URLs) that are associated with a target authentic resource. The techniques then use the trained classification models to determine whether an unknown URL is a malicious URL. The malicious URL determination may be based on one or more lexical features (e.g., brand name edit distances for a domain and path of the URL) and/or site/page features (e.g., a domain age and a domain confidence level) extracted.

主权项

1. A method comprising:
receiving a uniform resource locator (URL) that includes one or more substrings, wherein each substring comprises a plurality of alphanumeric characters; extracting, via one or more processors, a plurality of features associated with the URL; determining, as at least one of the plurality of features, a similarity measure between a whole or part of the URL and a brand name associated with an authentic resource or a legitimate entity; and applying one or more classification models to the one or more features to determine whether a resource located by the URL is an unauthentic resource.