基于机器学习的恶意URL识别  

Malicious URL Detection based on Machine Learning Models

作　　者：李泽宇 施勇[1] 薛质[1] LI Ze-yu;SHI Yong;XUE Zhi(School of Electronic Information and Electrical Engineering,Shanghai Jiaotong University,Shanghai 200240,China)

机构地区：[1]上海交通大学电子信息与电气工程学院

出　　处：《通信技术》2020年第2期427-431,共5页Communications Technology

基　　金：国家重点研发计划项目“网络空间安全”重点专项（No.2017YFB0803200）~~

摘　　要：网络攻击成为日益重要的安全问题,而多种网络攻击手段多以恶意URL为途径。基于黑名单的恶意URL识别方法存在查全率低、时效性差等问题,而基于机器学习的恶意URL识别方法仍在发展中。对多种机器学习模型特别是集成学习模型在恶意URL识别问题上的效果进行研究,结果表明,集成学习方法在召回率、准确率、正确率、F1值、AUC值等多项指标上整体优于传统机器学习模型,其中随机森林算法表现最优。可见,集成学习模型在恶意URL识别问题上具有应用价值。Cyber attacks have become an increasingly important security issue,and many cyber attacks use malicious URLs as a means.Blacklist-based malicious URL detection methods have problems such as low recall rate and poor timeliness.Malicious URL detection methods based on machine learning is still under research.Various machine learning models on malicious URL detection are explored,especially the integrated learning models.The experimental results indicate that on many metrics,such as recall rate,accuracy rate,correct rate,F1 value and AUC value,the overall performance of integrated learning models is better than the traditional machine learning models,among which the random forest algorithm performs best.Therefore,the integrated learning model has application value in the problem of malicious URL detection.

关 键 词：恶意URL 机器学习 集成学习 特征工程 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]