Increasing Protection Against Internet Attacks through Contextual Feature Pairing

Abstract

Cyberattacks have evolved from infecting computers using floppy disks or USB drives to the point where Internet, through malicious URLs or spear phishing, has become the main infection vector. In order for these attacks to succeed and avoid detection, an attacker must often change the location where the malicious content is hosted. The short life span of a malicious URL has forced many security vendors to search for different proactive methods for detection. Therefore, machine learning algorithms have become a powerful tool against this kind of attack vectors. The paper presents multiple approaches to combine features obtained from URL body and from its content in order to increase the detection rate for Internet attacks, taking into consideration the short life span of malicious URLs and the high importance of keeping the false positives rate to a minimum.