Error-Bounded URL Manipulation Detection via Symbolic Analysis
Malicious web sites hosted via manipulated URL strings present users with phishing, malware and defacement. This research presents a framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound. Model is trained on a Kaggle dataset of 651191 URLs (4,28,103 benign, 96,457 defacement, 94,111 phishing and 32,520 malware). After tokenization, feature extraction and then a logistic-like function which gives a probability score, calibration applies a constraint on the amount of error. In comparative tests, the proposed model results in an accuracy, precision, recall, F1-score and AUC of 98.64%, 98.12%, 97.89%, 98.00% and 0.99, which is about 1-3 % better than that of logistic regression, random forest, XGBoost and CNN classifiers. These results show that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.