一种应用于机器学习的恶意网页特征提取方法  

A feature extraction method for malicious web pages applied on machine learning

作　　者：张珂伟 郑世普 程永灵 王长帅 Zhang Kewei;Zheng Shipu;Cheng Yongling;Wang Changshuai(CEC Joint Innovation Research Institute,Chengmai 571924,China;Key Laboratory of PK System Technologies Research of Hainan Province,Chengmai 571924,China)

机构地区：[1]中电(海南)联合创新研究院有限公司,海南澄迈571924 [2]海南省PK体系关键技术研究重点实验室,海南澄迈571924

出　　处：《电子技术应用》2022年第12期122-127,共6页Application of Electronic Technique

摘　　要：基于机器学习的恶意网页检测技术进行研究。目前流行的“特征码”“白名单”等方式,仅能够检测已知的恶意网页;机器学习方法,能够检测出未知的恶意网页,但在处理网页特征时要面临数据量大、复杂和繁琐的问题。提出一种哈希压缩的方法,用于处理网页的特征数据。该方法在保证检测模型的漏报率和误报率下可实现将150万的特征映射在2万的特征空间内,对提取出的特征数据运用K折交叉验证法训练多个传统机器学习模型和集成学习模型。并通过评估模型的检测效果,筛选出表现最好的分类检测模型。Applied on machine learning,malicious web page detection technology is studied in this paper.At present,popular methods of“feature code”or“whitelist”can only detect known malicious web pages.The method of machine learning can detect unknown malicious web pages,but it has to face the problem of that the data is large,complex and tedious when processing web page features.In this paper,a Hash compression method is proposed.The method can map 1.5 million features into 20,000 feature space,and train multiple traditional machine learning models and integrated learning models using k-fold cross-validation method for extracted feature data.The best classification detection model will be selected by evaluating the detection effect of the model.

关 键 词：机器学习 恶意网页检测 哈希压缩 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]