A hybrid features based malevolent domain detection in cyberspace using machine learning

Abstract

The rise of social media has changed modern communication, placing information at our fingertips. While these developments have made our lives easier, they have also increased cybercrime. Cyberspace has become a refuge for modern cybercriminals to conduct destructive actions. Most cyberattacks are carried out through malicious links shared on social media platforms, emails, or messaging services. These attacks can have serious consequences for individuals and organizations, including financial losses, sensitive data breaches, and damage to reputation. Early identification and blocking of such links are crucial to protecting internet users and securing cyberspace. Current research uses machine learning (ML) algorithms to detect malicious hyperlinks based on observed patterns in uniform resource locators (URLs) or web content. However, cyberattack tactics are constantly changing. To address this challenge, this paper introduces a robust method that performs a fine-grained analysis of URLs for classification. Lexical and n-gram features are examined separately, with URL n-grams represented using Word2Vec embeddings. The results from hybrid feature sets are combined using a logistic regression (LR) model to increase overall classification accuracy. This robust method allows the system to use both the structural components of the URL and the fine-grained patterns obtained by the n-grams.