An Efficient Malicious URL Detection Approach Using Machine Learning Techniques

IT security is a major concern for everyone. Malicious Uniform Resource Locators (URLs) are major source of cyber-attacks. Blacklisting of malicious IP addresses is a primary technique used for safeguarding mission critical IT systems. It is repetitive, time-consuming, computationally intensive, and incapable of detecting new URLs. Heuristic classification is an improvement to blacklisting approach. Cyber-attacks are increasing at a rate of 20–25% per year, with newly generated URLs serving as a primary attack surface. Techniques currently used are ineffective because they cannot classify newly generated URLs. This issue is handled by maintaining and updating a comprehensive database of millions of URLs with the new URLs at regular interval. In spite of having greater accuracy, it requires human involvement to update and maintain URL databases, which is a big concern. To overcome these limitations, machine learning (ML) is used for detecting malicious URLs efficiently. The feature set composed of lexical, binary, address bar, domain, and HTML-JavaScript-based features is used with the logistic regression, decision tree, and random forest algorithms. These models are compared for accuracy, recall, and precision over malicious and benign URL datasets. Methodology to update URL datasets using security logs is discussed to improve efficiency of ML model. Innovatively, a parallel programming technique to improve training time of the ML models is also presented. The presented malicious URL detection approach is efficient, and accuracy is approximately 99%. It can be used to build a malicious URL block list and prevent accesses to or from malicious URLs to safeguard clients against potential cyber-attacks.