关键词: 恶意网页检测, 缩短服务, 链接层次语义树, 成本敏感

Abstract:

Aiming at the problem that attackers use URL shortening services to cause invalid detection of malicious webpages that rely only on URL characteristics, and the problem of highly unbalanced malicious and benign webpages in malicious webpage detection, this paper proposes a cost-sensitive learning method for malicious webpages that incorporates the features of the hierarchical semantic tree of webpage content. This method solves the problem of feature invalidation caused by URL shortening service by constructing a semantic tree of webpage content link hierarchy and extracting features based on the semantic tree. It constructs a cost-sensitive learning detection model to solve the problem of imbalanced data. Experimental results show that compared with the existing methods, the method proposed in this paper can not only deal with the problem of shortening the service, but also show a lower false negative rate of 2.1% and a false negative rate of 3.3% in the detection of unbalanced malicious web pages. In addition, on 250,000 unlabeled data sets, the method improves the recall rate by 38. 2% compared to the anti-virus tool VirusTotal.

Key words: malicious webpage detection, URL shortening service, link level semantic tree, cost sensitive