Performance Evaluation of Machine Learning Techniques for Identifying Forged and Phony Uniform Resource Locators (URLs)
Abstract
Since invention of Information and Communication Technology (ICT), there has been a great shift from erstwhile traditional approach of handling information across the globe to the usage of this innovation. The application of this initiative cut across almost all areas of human endeavors. ICT is widely being utilized in education and production sectors as well in financial institutions. It is of note that many people are using it genuinely to carry out their day to day activities while others are using it to perform nefarious activities at the detriment of other cyber users. According to several reports which are discussed in the introductory part of this work, millions of people have become victims of fake Uniform Resource Locators (URLs) sent to their mails by spammers. Financial institutions are not left out in the monumental loss recorded through this illicit act over the years. It is however, worthy of note that, despite several approaches currently in place, none could confidently be confirmed to provide the best and reliable solution. In the recent works, researchers have demonstrated how machine learning algorithms could be employed to verify and confirm compromised and fake URLs in the cyberspace. Inconsistencies have however been noticed in the researchers’ (Vanhoenshoven et. al, 2016 and Choudhary & Jain, 2017) work and also their corresponding results are not dependable based on the values obtained and conclusions drawn from them. Against this backdrop, the authors carried out a comparative analysis of three learning algorithms (Naïve Bayes, Decision Tree and Logistics Regression Model) for verification of compromised, suspicious and fake URLs and determine which is the best of all based on the metrics (F-Measure, Precision and Recall) used for evaluation. Based on the confusion metrics measurement, the result obtained shows that the Decision Tree (ID3) algorithm achieves the highest values for recall, precision and f-measure. It unarguably provides efficient and credible means of maximizing the detection of compromised and malicious URLs. Finally, for future work, authors are of the opinion that two or more supervised learning algorithms can be hybridized to form a single effective and more efficient algorithm for fake URLs verification.
References
Alnajim, A., & Munro, M. (2009). An Anti-Phishing Approach that Uses Training Intervention for Phishing Websites Detection. 2009 Sixth International Conference on Information Technology: New Generations. Las Vegas, NV, USA, USA: IEEE.
APWG. (2016). Phishing Activity Trends Report. USA: www.apwg.org.
Azeez, N. A., & Ademolu, O. (2016). CyberProtector: Identifying Compromised URLs in Electronic Mails with Bayesian Classification. 2016 International Conference Computational Science and Computational Intelligence (CSCI) (pp. 959-965). Las Vegas, NV, USA: IEEE.
Azeez, N. A., & Iliyas, H. D. (2016). Implementation of a 4-tier cloud-based architecture for collaborative health care delivery. Nigerian Journal of Technological Development, 13(1), 17-25.
Azeez, N. A., & Venter, I. M. (2013). Towards ensuring scalability, interoperability and efficient access control in a multi-domain grid-based environment. SAIEE Africa Research Journal, 104(2), 54-68.
Campbell, D., & Campbell, S. (2008 , October 28). StatLab-IntroRegressionFa08. Retrieved May 04, 2017, from http://statlab.stat.yale.edu: http://statlab.stat.yale.edu/workshops/IntroRegression/StatLab-IntroRegressionFa08.pdf
Choudhary, N., & Jain, A. K. (2017). Towards Filtering of SMS Spam Mesages Using Machine Learning Based Technique. Advanced Informatics for Computing Research, First International Conference, ICAICR 2017 (pp. 18-30). Jalandhar, India: Springer Nature Singapore.
Joshi, Y., Saklikar, S., Das, D., & Saha, S. (2008). PhishGuard: A browser plug-in for protection from phishing. 2008 2nd International Conference on Internet Multimedia Services Architecture and Applications. Bangalore, India: IEEE.
Kirda, E., & Kruegel, C. (2005). Protecting users against phishing attacks with AntiPhish. 29th Annual International Computer Software and Applications Conference (COMPSAC'05) (pp. 1-8). Edinburgh, UK: IEEE.
Kolter, J. Z., & Maloof, A. M. (2006, Dec.). Learning to detect and classify malicious executables in the wild. Journal of Machine Learning Research, 7, 2721-2744.
Lee, S., & Kim, J. (2013, May). WarningBird: A Near Real-Time Detection System for Suspicious URLs in Twitter Stream. IEEE Transactions on Dependable and Secure Computing, 10(3), 183-195 •.
Ma, J., Saul, L., Savage, S., & Voelker, G. (2011). Learning to Detect Malicious URLs. ACM Transactions on Intelligent Systems and Technology, Vol. 2, No. 3, Article 30, Publication date: April 2011., 1-24.
Nivedha, S., Gokulan, S., Karthik, C., & Gopinath, R. (2017). Improving Phishing URL Detection Using Fuzzy Association Mining. International Journal of Engineering and Science (IJES), 21-31.
Polat, H., & Du, W. (2003). Privacy-preserving collaborative filtering using randomized perturbation techniques. Third IEEE International Conference on Data Mining (pp. 1-15). Melbourne, FL, USA, USA: IEEE.
Rokach, L., & Maimon, O. (2008). Data Mining with Decision Trees: Theroy and Applications. River Edge, NJ, USA: World Scientific Publishing Co., Inc. .
Seifert, C., Welch, I., & Komisarczuk, P. (2007). HoneyC - The Low-Interaction Client Honeypot. Proceedings of the 2007 NZCSRCS (pp. 1–8). Hamilton, New Zealand: Waikato University: http://citeseerx.ist.psu.edu.
Surana, N., Singh, P., Warade, U., & Sabe , N. (2015). Detection and Prevention of Phishing Attacks in Web. International Journal of Scientific Engineering and Technology Research, 1595-1598.
Vanhoenshoven, F., Napoles, G., Falcon, R., Vanhoof, K., & Koppen, M. (2016). Detecting Malicious URLs using Machine Learning Techniques. 2016 IEEE Symposium Series on Computational Intelligence (SSCI) (pp. 1-8). Athens, Greece: IEEE.
Heartfield, R. & Loukas, G. “A taxonomy of attacks and a survey of defence mechanisms for semantic social engineering attacks,” ACM Computing Surveys (CSUR), vol. 48, no. 3, p. 37, 2015.
Ma, J. Saul, L. K., Savage, S & Voelker, G. M “Beyond blacklists: learning to detect malicious web sites from suspicious urls,” in Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM, 2009, pp. 1245–1254.
Eshete, B, Villafiorita, A &Weldemariam, K. “Binspect: Holistic analysis and detection of malicious web pages,” in Security and Privacy in Communication Networks. Springer, 2013, pp. 149–166.
Seifert, C. Welch, C. & Komisarczuk, P. “Identification of malicious web pages with static heuristics,” in Telecommunication Networks and Applications Conference, 2008. ATNAC 2008. Australasian. IEEE, 2008, pp. 91–96.
Kim, B,I. Im, C,T & Jung, H, C. “Suspicious malicious web site detection with strength analysis of a javascript obfuscation,” International Journal of Advanced Science and Technology, vol. 26, pp. 19–32, 2011.
Ma, J, Saul, L, K Savage, S & Voelker, G. M. “Identifying suspicious urls: an application of large-scale online learning,” in Proceedings of the 26th Annual International Conference on Machine Learning. ACM, 2009, pp. 681–688.
Crawford, M. Khoshgoftaar, T. M. Prusa, A. N. Richter, and H. Al Najada, “Survey of review spam detection using machine learning techniques,” Journal of Big Data, vol. 2, no. 1, p. 23, 2015.
Tao, Y. “Suspicious url and device detection by log mining,” Ph.D. dissertation, Applied Sciences: School of Computing Science, 2014.
Sun, B. Akiyama, M. Yagi, T. Hatada, M. &Mori, T. “Autoblg: Automatic url blacklist generator using search space expansion and filters,” in 2015 IEEE Symposium on Computers and Communication (ISCC). IEEE, 2015, pp. 625–631.
Bo, S. Akiyama, M. Takeshi, Y.& Hatada, M. “Automating url blacklist generation with similarity search approach,” IEICE TRANSACTIONS on Information and Systems, vol. 99, no. 4, pp. 873–882, 2016.
Qassrawi M. T.& Zhang, H. “Detecting malicious web servers with honeyclients,” Journal of Networks, vol. 6, no. 1, pp. 145–152, 2011.
Kim, B.-I. Im, C.-T.&Jung, H.-C. “Suspicious malicious web site detection with strength analysis of a javascript obfuscation,” International Journal of Advanced Science and Technology, vol. 26, pp. 19–32, 2011.
Kolbitsch, C. Livshits, B. Zorn, B. & Seifert, C. “Rozzle: De-cloaking internet malware,” in Security and Privacy (SP), 2012 IEEE Symposium on. IEEE, 2012, pp. 443–457.
Felegyhazi, M. Kreibich, C. & Paxson, V. “On the potential of proactive domain blacklisting.” LEET, vol. 10, pp. 6–6, 2010.
Blum, A. Wardman, B. Solorio, T. & Warner, G. “Lexical feature based phishing url detection using online learning,” in Proceedings of the 3rd ACM Workshop on Artificial Intelligence and Security. ACM, 2010, pp. 54–60.
Zhang, W. Ding, Y.-X. Tang, Y. & Zhao, B. “Malicious web page detection based on on-line learning algorithm,” in Machine Learning and Cybernetics (ICMLC), 2011 International Conference on, vol. 4. IEEE, 2011, pp. 1914–1919.
Pao, H.-K. Chou, Y.-L.& Lee, Y.-J. “Malicious url detection based on kolmogorov complexity estimation,” in Proceedings of the The 2012 IEEE/WIC/ACM International Joint Conferences on Web Intelligence and Intelligent Agent Technology-Volume 01. IEEE Computer Society, 2012, pp. 380–387.
Chu, W. Zhu, B. B. Xue, F. Guan, X.& Cai, Z. “Protect sensitive sites from phishing attacks using features extractable from inaccessible phishing urls,” in Communications (ICC), 2013 IEEE International Conference on. IEEE, 2013, pp. 1990–1994.
Sorio, E. Bartoli, A. & Medvet, E. “Detection of hidden fraudulent urls within trusted sites using lexical features,” in Availability, Reliability and Security (ARES), 2013 Eighth International Conference on. IEEE, 2013, pp. 242–247.
Chiba, D. Yagi, T. Akiyama, M. Shibahara, T. Yada, T. Mori, T. & Goto, S. “Domainprofiler: Discovering domain names abused in future,” in Dependable Systems and Networks (DSN), 2016 46th Annual IEEE/IFIP International Conference on. IEEE, 2016, pp. 491–502.
Hou, Y.-T. Chang, Y. Chen, T.. Laih, C.-S & Chen, C.-M. “Malicious web content detection by machine learning,” Expert Systems with Applications, vol. 37, no. 1, pp. 55–60, 2010.
Abu-Nimeh, S. Nappa, D. Wang, X. &Nair, S. “A comparison of machine learning techniques for phishing detection,” in Proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit. ACM, 2007, pp. 60–69.
Cao, J. Li, Q. Ji, Y. He, Y. & Guo, D. “Detection of forwardingbased malicious urls in online social networks,” International Journal of Parallel Programming, pp. 1–18, 2014.
Thomas, K. Grier, C. Ma, J. Paxson, V. & Song, D. “Design and evaluation of a real-time url spam filtering service,” in Security and Privacy (SP), 2011 IEEE Symposium on. IEEE, 2011, pp. 447–462.
Zhang, G. Liu, T. W. Chow, and W. Liu, “Textual and visual content-based anti-phishing: a bayesian approach,” IEEE Transactions on Neural Networks, vol. 22, no. 10, pp. 1532–1546, 2011.
Seifert, C. Welch, I.& Komisarczuk, P. “Identification of malicious web pages with static heuristics,” in Telecommunication Networks and Applications Conference, 2008. ATNAC 2008. Australasian. IEEE, 2008, pp. 91–96.
Pao, H.-K. Chou, Y,L. & Lee, Y,J. “Malicious url detection based on kolmogorov complexity estimation,” in Proceedings of the The 2012 IEEE/WIC/ACM International Joint Conferences on Web Intelligence and Intelligent Agent Technology-Volume 01. IEEE Computer Society, 2012, pp. 380–387.
Wang, J. , Hoi, S. C, Zhao, P Zhuang, J. & Liu, Z. “Large scale online kernel classification,” in Proceedings of Twenty-Third international joint conference on Artificial Intelligence, 2013, pp. 1750–1756.
Xiong, C. Li, P. Zhang, P. Liu, Q. & Tan, J. “Mird: Trigrambased malicious url detection implanted with random domain name recognition,” in Applications and Techniques in Information Security. Springer, 2015, pp. 303–314.
Wardman, B. Shukla, G. & Warner, G. “Identifying vulnerable websites by analysis of common strings in phishing urls,” in eCrime Researchers Summit, 2009. eCRIME’09. IEEE, 2009, pp. 1–13.
McDonald, R. Hall, K. & Mann, G. “Distributed training strategies for the structured perceptron,” in Human Language Technologies: The 2010 Annual Conference of the North American Chapter of the Association for Computational Linguistics, 2010, pp. 456–464.
Fan, R.-E, Chang, K.-W , Hsieh, C.-J, Wang, . X.-R. & Lin, C.-J. “Liblinear: A library for large linear classification,” The Journal of Machine Learning Research, vol. 9, pp. 1871–1874, 2008.
Hu, J. Gao, H. Li, Z. & Chen, Y “Poster: Cud: crowdsourcing for url spam detection,” in Proceedings of the 18th ACM conference on Computer and communications security. ACM, 2011, pp. 785–788.
Doan, A Ramakrishnan, R. & Halevy, A. Y “Crowdsourcing systems on the world-wide web,” Communications of the ACM, vol. 54, no. 4, pp. 86–96, 2011.
Singh J. & Nene, M. J. “A survey on machine learning techniques for intrusion detection systems,” International Journal of Advanced Research in Computer and Communication Engineering, vol. 2, no. 11, pp. 4349–4355, 2013.
Downloads
Published
Issue
Section
License
In accordance with the Copyright Act of 1976, which became effective January 1, 1978, the following statement signed by each author must accompany the manuscript submitted: "I, the undersigned author, transfer all copyright ownership of the manuscript referenced above to the Nigerian Journal of Technological Development, in the event the work is published. I warrant that the article is original, does not infringe upon any copyright or other proprietary right of any third party, is not under consideration by another journal, and has not been published previously. I have reviewed and approve the submitted version of the manuscript and agree to its publication in the Nigerian Journal of Technological Development." A copyright transfer form should be downloaded from the NJTD Website ( http://njtd.com.ng/index.php/njtd). Author(s) will be consulted, whenever possible, regarding republication of material. All authors must have access to the data presented and the authors and sponsor (if applicable) must agree to share original data with the editor if requested.
