URL Classification with Intrusion Detection System

The generation we live in has almost everything processed through the internet. When a user wants a question to be answered they open their web browser and search for a query, many websites show up on the screen which the user can choose from. Dozens of Uniform Resource Locator (URLs) are created everyday, not all of them are safe and some are built for malicious purposes. The attacker who creates these malicious URLs can send multiple responses thereby disrupting the traffic and delaying the process. Our aim is to build and incorporate models which can classify that website and identify the category using URL and check for the presence of any application layer attacks. Our paper deals with capturing live network traffic and packets, extracting relevant values and feed these to URL and Intrusion Detection System (IDS) modules. We use certain heuristics, train and build the Machine Learning (ML) models like Multinomial Naive Bayes and Logistic Regression giving accuracy of 87.51 and 95.89% respectively. Inspection of traffic from the website is analyzed by building a network traffic analyzer using pyshark to capture traffic in real time. For the detection method of IDS, we would be using Anomaly-Based methods and for identifying malicious traffic we would be using Support Vector Machine (SVM) to classify attacks into application layer attacks namely Distributed Denial of Service (DDoS), Cross-site Scripting (XSS), BruteForce, Denial of Service (DoS), Botnets, Structured Query Language (SQL) Injection.