Error-Bounded URL Manipulation Detection via Symbolic Analysis
TL;DR
A framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound is presented, which shows that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.
Abstract
Malicious web sites hosted via manipulated URL strings present users with phishing, malware and defacement. This research presents a framework for a symbolic analysis which transforms URL strings into lexical features, and uses an explicit error bound. Model is trained on a Kaggle dataset of 651191 URLs (4,28,103 benign, 96,457 defacement, 94,111 phishing and 32,520 malware). After tokenization, feature extraction and then a logistic-like function which gives a probability score, calibration applies a constraint on the amount of error. In comparative tests, the proposed model results in an accuracy, precision, recall, F1-score and AUC of 98.64%, 98.12%, 97.89%, 98.00% and 0.99, which is about 1-3 % better than that of logistic regression, random forest, XGBoost and CNN classifiers. These results show that the symbolic framework discriminates manipulated and legitimate URLs well and gives a statistically significant guarantee on its predictions.