Study of high-speed malicious Web page detection system based on two-step classifier

Zheng-qi WANG; Xiao-bing FENG; Chi ZHANG

doi:10.11959/j.issn.2096-109x.2017.00186

您当前的位置：

首页 >

文章列表页 >

Study of high-speed malicious Web page detection system based on two-step classifier

Papers | 更新时间：2024-06-03

- Study of high-speed malicious Web page detection system based on two-step classifier
- Chinese Journal of Network and Information Security Vol. 3, Issue 8, Pages: 44-60(2017)
- 作者机构：
  
  1. 中国科学技术大学，安徽合肥 230026
  2. 中国科学院电磁空间信息重点实验室，安徽合肥 230026
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00186
  CLC： TP393
- Online First：2017-08，
  
  Published：15 August 2017
- 稿件说明：
移动端阅览
Zheng-qi WANG, Xiao-bing FENG, Chi ZHANG. Study of high-speed malicious Web page detection system based on two-step classifier[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 44-60.
DOI：

Zheng-qi WANG, Xiao-bing FENG, Chi ZHANG. Study of high-speed malicious Web page detection system based on two-step classifier[J]. Chinese Journal of Network and Information Security, 2017, 3(8): 44-60. DOI： 10.11959/j.issn.2096-109x.2017.00186.

摘要

针对当前传统静态恶意网页检测方案在面对海量的新增网页时面临的压力，引入了两段式的分析检测过程，并依次为每段检测提出相应的特征提取方案，通过层次化使用优化的朴素贝叶斯算法和支持向量机算法，设计并实现了一种兼顾效率和功能的恶意网页检测系统——TSMWD（two-step malicious Web page detection system）。第一层检测系统用于过滤大量的正常网页，其特点为效率高、速度快、更新迭代容易，真正率优先。第二层检测系统追求性能，对于检测的准确率要求较高，时间和资源的开销上适当放宽。实验结果表明，该架构能够在整体检测准确率基本不变的情况下，提高系统的检测速度，在时间一定的情况下，接纳更多的检测请求。

Abstract

In view of the increasing number of new Web pages and the increasing pressure of traditional detection methods

the naive Bayesian algorithm and the support vector machine algorithm were used to design and implement a malicious Web detection system with both efficiency and function

TSMWD

two-step malicious Web page detection.The first step of detection system was mainly used to filter a large number of normal Web pages

which was characterized by high efficiency

speed

update iteration easy

real rate priority.After the former filter

due to the limited number of samples

the main pursuit of the second step was the detection rate.The experimental results show that the proposed scheme can improve the detection speed of the system under the condition that the overall detection accuracy is basically the same

and can accept more detection requests in certain time.

关键词

Keywords

references

中国互联网信息中心 . 第37次中国互联网络发展状况统计报告 [R ] . 北京:CNNIC , 2016 .

CNNIC . The 37th report of China Inter development statistics [R ] . Beijing:CNNIC , 2016 .

[EB/OL ] . http://www.securelist.com/en/analysis/ http://www.securelist.com/en/analysis/ .

PROVOS N , MAVROMMATIS P , RAJAB M A , et al . All your iFRAMEs point to us [C ] // Conference on Security Symposium . 2008 : 1 - 15 .

SHENG S , WARDMAN B , WARNER G , et al . An empirical analysis of phishing blacklists [C ] // The Sixth Conference on Email and Anti-Spam (CEAS) . 2009 .

ESHETE B , VILLAFIORITA A , WELDEMARIAM K . Malicious website detection:effectiveness and efficiency issues [C ] // SysSec Workshop . 2011 : 123 - 126 .

Making the Web safer [R/OL ] . http://www.google.com/ transparencyreport/safebrowsing/?hl=en http://www.google.com/ transparencyreport/safebrowsing/?hl=en .

Malware domain list [EB/OL ] . http://www.malwaredomainlist.com http://www.malwaredomainlist.com .

OpenDNS,PhishTank [EB/OL ] . http://www.phishtank.com http://www.phishtank.com .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . Phishnet:predictive blacklisting to detect phishing attacks [C ] // INFOCOM . 2010 : 1 - 5 .

CHRISTODORESCU M , JHA S . Testing malware detectors [J ] . ACM Sigsoft Software Engineering Notes , 2004 , 29 ( 4 ): 34 - 44 .

CHOU , NEIL , ROBERT LEDESMA , YUKA TERAGUCHI , et al . Client-side defense against Web-based identity theft [C ] // The 11th Annual Network ＆ Distributed System Security Symposium (NDSS) . 2004 : 1 - 16 .

HOU Y T , CHANG Y , CHEN T , et al . Malicious Web content detection by machine learning [J ] . Expert Systems with Applications , 2010 , 37 ( 1 ): 55 - 60 .

ROESCH M . Snort-lightweight intrusion detection for networks [J ] . Lisa , 1999 : 229 - 238 .

LIN S F , HOU Y T , CHEN C M , et al . Malicious webpage detection by semantics-aware reasoning [C ] // The Eighth International Conference on Intelligent Systems Design and Applications . 2008 : 115 - 120 .

ZHANG Y , HONG J I , CRANOR L F . Cantina:a content-based approach to detecting phishing web sites [C ] // The 16th International Conference on World Wide Web . 2007 : 639 - 648 .

HOU Y T , CHANG Y , CHEN T , et al . Malicious Web content detection by machine learning [J ] . Expert Systems with Applications , 2010 , 37 ( 1 ): 55 - 60 .

JUSTIN M , SAUL L K , SAVAGE S , et al . Beyond blacklists:learning to detect malicious Web sites from suspicious URLs [C ] // The 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2009 : 1245 - 1254 .

YOO S , KIM S , CHOUDHARY A , et al . Two-phase malicious web page detection scheme using misuse and anomaly detection [J ] . International Journal of Reliable Information and Assurance , 2014 , 2 ( 1 ).

CANALI D , COVA M , VIGNA G , et al . Prophiler:a fast filter for the large-scale detection of malicious web pages [C ] // The 20th International Conference on World Wide Web . 2011 : 197 - 206 .

The German honeyclient project [EB/OL ] . http://www.chicagohoneynet.org/german-honeypot-holz http://www.chicagohoneynet.org/german-honeypot-holz .

The Honeynet Project . Know your enemy:honeynets [EB/OL ] . http://old.honeynet.org/papers/honeynet/ http://old.honeynet.org/papers/honeynet/ .

MAYNOR D . Metasploit toolkit for penetration testing,exploit development,and vulnerability research [M ] . Elsevier , 2011 .

HAUTUS M L J . The formal Laplace transform for smooth linear systems [M ] // Mathematical Systems Theory . Berlin : Springer , 1976 : 29 - 47 .

GOLUB G H , HEATH M , WAHBA G . Generalized cross-validation as a method for choosing a good ridge parameter [J ] . Technometrics , 1979 , 21 ( 2 ): 215 - 223 .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . Phishnet:predictive blacklisting to detect phishing attacks [C ] // INFOCOM . 2010 : 1 - 5 .

LEE S , KIM J . Warningbird:a near real-time detection system for suspicious URLs in twitter stream [J ] . IEEE Transactions on Dependable and Secure Computing , 2013 , 10 ( 3 ): 183 - 195 .

LIKARISH P , JUNG E , JO I . Obfuscated malicious javascript detection using classification techniques [C ] // The 4th International Conference on Malicious and Unwanted Software (MALWARE) . 2009 : 47 - 54 .

MA J , SAUL L K , SAVAGE S , et al . Beyond blacklists:learning to detect malicious Web sites from suspicious URLs [C ] // The 15th ACM SIGKDD international conference on knowledge discovery and data mining . 2009 : 1245 - 1254 .

LIU G , QIU B , WENYIN L . Automatic detection of phishing target from phishing webpage [C ] // The 20th International Conference on Pattern Recognition (ICPR) . 2010 : 4153 - 4156 .

Views

2252

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Security scheme for time-critical TRDP message

Research on adversarial examples defense method based on multi-modal feature fusion

Related Author

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

LI Qinghao

LIU Chunling

TANG Yonghe

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰