融合多种特征的恶意URL检测方法  

Malicious URL Detection Based on Multiple Feature Fusion

作　　者：吴森焱 罗熹[2] 王伟平[1] 覃岩 WU Sen-Yan;LUO Xi;WANG Wei-Ping;QIN Yan(School of Computer Science and Engineering,Central South University,Changsha 410083,China;Department of Information Technology,Hunan Police Academy,Changsha 410083,China)

机构地区：[1]中南大学计算机学院,湖南长沙410083 [2]湖南警察学院信息技术系,湖南长沙410083

出　　处：《软件学报》2021年第9期2916-2934,共19页Journal of Software

基　　金：国家自然科学基金(61672543);网络犯罪侦查湖南省普通高校重点实验室开放课题(2017WLFZZC002)。

摘　　要：随着Web应用的日益广泛,Web浏览过程中,恶意网页对用户造成的危害日趋严重.恶意URL是指其所对应的网页中含有对用户造成危害的恶意代码,会利用浏览器或插件存在的漏洞攻击用户,导致浏览器自动下载恶意软件.基于对大量存活恶意URL特征的统计分析,并重点结合了恶意URL的重定向跳转、客户端环境探测等逃避检测特征,从页面内容、JavaScript函数参数和Web会话流程这3个方面设计了25个特征,提出了基于多特征融合和机器学习的恶意URL检测方法——HADMW.测试结果表明:该方法取得了96.2%的精确率和94.6%的召回率,能够有效地检测恶意URL.与开源项目以及安全软件的检测结果相比,HADMW取得了更好的效果.With the popularity of Web applications,malicious webpages are increasingly harmful to users in the process of Web browsing.The malicious URL mentioned in this paper refers that the corresponding webpage contains malicious codes that are harmful to users.These malicious code exploits the vulnerabilities of browsers or plugins to attack users with download malware automatically.Based on the statistics and analysis of amounts of living malicious URL,and considering the anti-detection technologies being more used in malicious webpage such as the client environment detection and redirections,25 features in three aspects are designed,namely,content of webpage,parameters of JavaScript function,and Web session flows.And a detection method-HADMW is proposed based on these 25 features and machine learning.The experimental results suggest that HADMW can achieve 96.2%accuracy and 94.6%recall rate,and it can detect malicious URL effectively.At the same time,compared with the detection results of open projects and security software,HADMW achieves better results.

关 键 词：WEB安全 恶意URL检测 多特征融合 机器学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]