1. Malicious URL Protection based on Attackers’ Habitual Behavioral Analysis
Source: Computer & Security, Vol. 77, No. 1, pp , Aug
Author: Sungjin Kim, Jinkook Kim, and Brent ByungHoon Kang
Speaker: Ren-Kai Yang
Date: 2019/02/14

2. Outline Introduction Related works Proposed scheme
Performance evaluation
Conclusions

3. Introduction(1/3) www.youtub.com www.facebookc.om
Which one is the real Google site? 1. 2. 3.
Malicious URL(Uniform Resource Locator)
植入網址(在網站建立新的網頁) 內容 程式碼(在HTML中植入javascript讓你網站的訪客重新導向到預先建立的惡意網站)

4. Introduction(2/3)
Phishing

5. Introduction(3/3)
Source:

6. Related works(1/4)
Web-filtering

7. Related works(2/4)
WHOIS

8. Related works(3/4)
Alexa

9. Related works(4/4) URL: 140.134.131.145/discussion/Query.php
Feature-based
URL: /discussion/Query.php
Hostname
Pathname
Filename

10. Proposed scheme(1/4)
Fuzzy-based similarly matching

11. Optimizing URLs to three malicious pools
Proposed scheme(2/4)
(39%)
50-70 (19%)
(17%)
(10%)
Feature extraction and grouping
Training
Optimizing URLs to three malicious pools
1. Domain pool
2. Path pool
3. Filename pool
Classifier
Based on similarity matching
Domain
Pathname
Filename
/images/index.html
/PEG/ad/index1.html
/PEG/js/index.php
Classifier

12. Proposed scheme(3/4) 110.34.196.113/PEG/js/index2.html
Similarity measure and modeling
/PEG/js/index2.html
Parsing
1. Domain string
2. Path string
3. Filename string
Fuzzing Classifier
Result
Input
URL
A parsed
URL
Output
New URLs
(Malicious & Benign)
Levenshtein distance
Domain
Pathname
Filename
images
index.html
PEG/js
index1.html
PEG/ad
index.php

13. Proposed scheme(4/4) Similarity measure and modeling(cont.)
Malicious or Benign?
/PEG/jslab/index2.html
Domain
＊ Threshold = 0.9
Filename
index.html
index1.html
index.php
(0.45)
index2.html (0.9)
(0.72)
index2.html (0.9)
(0.72)
index2.html (0.54)
Pathname
images
PEG/js
PEG/ad
＊ Levenshtein distance = 7 (0.93)
PEG/jslab (0)
PEG/jslab (0.66)
PEG/jslab (0.55)

14. Performance evaluation(1/3)
The average of the similarity probability ratio related to three finite feature sets.

15. Performance evaluation(2/3)
Variation in detection rate according to manipulation of FW threshold.
Same
Different
Same
Different

16. Performance evaluation(3/3)
Performance results
Test
Fuzzy
Benign
573
6.885s
Malicious
1301
56.083s
Total
1874
62.968s

17. Conclusions
Behaviors

18. Optimizing URLs to three malicious pools
Training
Optimizing URLs to three malicious pools
1. Domain pool
2. Path pool
3. Filename pool
Classifier
Based on similarity matching
Dataset
selection
Feature
extraction
Malicious URLs
Distribution URLs
Test Step
Parsing
1. Domain string
2. Path string
3. Filename string
Fuzzing Classifier
Result
Input
URL
A parsed
URL
Output
New URLs
(Malicious & Benign)