Less Is More: Robust and Novel Features for Malicious Domain Detection
Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical w...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-03-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/11/6/969 |
| _version_ | 1797471852060213248 |
|---|---|
| author | Chen Hajaj Nitay Hason Amit Dvir |
| author_facet | Chen Hajaj Nitay Hason Amit Dvir |
| author_sort | Chen Hajaj |
| collection | DOAJ |
| description | Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data. |
| first_indexed | 2024-03-09T19:53:56Z |
| format | Article |
| id | doaj.art-415c8388cf1441c38bc6410d92d91069 |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-09T19:53:56Z |
| publishDate | 2022-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-415c8388cf1441c38bc6410d92d910692023-11-24T01:01:30ZengMDPI AGElectronics2079-92922022-03-0111696910.3390/electronics11060969Less Is More: Robust and Novel Features for Malicious Domain DetectionChen Hajaj0Nitay Hason1Amit Dvir2Ariel Cyber Innovation Center, Data Science and Artificial Intelligence Research Center, Department of Industrial Engineering and Management, Ariel University, Ariel 4076414, IsraelAriel Cyber Innovation Center, Department of Computer Science, Ariel University, Ariel 4076414, IsraelAriel Cyber Innovation Center, Department of Computer Science, Ariel University, Ariel 4076414, IsraelMalicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.https://www.mdpi.com/2079-9292/11/6/969malware detectionrobust featuresdomain |
| spellingShingle | Chen Hajaj Nitay Hason Amit Dvir Less Is More: Robust and Novel Features for Malicious Domain Detection Electronics malware detection robust features domain |
| title | Less Is More: Robust and Novel Features for Malicious Domain Detection |
| title_full | Less Is More: Robust and Novel Features for Malicious Domain Detection |
| title_fullStr | Less Is More: Robust and Novel Features for Malicious Domain Detection |
| title_full_unstemmed | Less Is More: Robust and Novel Features for Malicious Domain Detection |
| title_short | Less Is More: Robust and Novel Features for Malicious Domain Detection |
| title_sort | less is more robust and novel features for malicious domain detection |
| topic | malware detection robust features domain |
| url | https://www.mdpi.com/2079-9292/11/6/969 |
| work_keys_str_mv | AT chenhajaj lessismorerobustandnovelfeaturesformaliciousdomaindetection AT nitayhason lessismorerobustandnovelfeaturesformaliciousdomaindetection AT amitdvir lessismorerobustandnovelfeaturesformaliciousdomaindetection |