URL Analysis Research Articles

Improve the effectiveness of machine learning models in detecting website phishing using morphological features in URL analysis

With the proliferation of the Internet, the emergence of various threats has become increasingly prevalent, particularly the danger posed by phishing websites. These websites are designed with malicious content aimed at exploiting users who inadvertently access them. This method of attack represents a significant potential risk for users in cyberspace. The problem of detecting and eliminating phishing websites has garnered significant interest and research within the community. In this study, we propose a set of morphological features in URL path analysis, combined with machine learning methods, to detect phishing website URLs. Experimental evaluation with the UCI Repository dataset results have demonstrated the effectiveness of the proposed feature set in terms of all metrics (Accuracy, Precision, Recall, and F1 Score) compared to previous methods.

A COMPREHENSIVE REVIEW OF ARTIFICIAL INTELLIGENCE APPLICATIONS IN ENHANCING CYBERSECURITY THREAT DETECTION AND RESPONSE MECHANISMS

This literature review explores the transformative impact of artificial intelligence (AI) on enhancing cybersecurity measures across various domains. The study systematically examines the integration of AI in Intrusion Detection Systems (IDS), malware detection, phishing detection, threat intelligence, network security, and endpoint protection. Key findings reveal that AI-driven techniques significantly outperform traditional methods, particularly in real-time threat detection, accuracy, and adaptive response capabilities. Network-based IDS benefit from supervised and unsupervised learning algorithms, improving the identification of malicious network traffic and novel attack patterns. In malware detection, AI-enhanced static and dynamic analysis methods surpass signature-based approaches by detecting previously unknown malware and complex behaviors. Phishing detection has seen substantial improvements with AI applications in email filtering and URL analysis, reducing phishing incidents despite challenges like false positives. AI's role in threat intelligence is critical, automating data analysis to uncover hidden threats and employing predictive analytics to anticipate and mitigate cyber attacks. AI techniques in network security and endpoint protection enhance real-time monitoring and authentication processes, providing robust defenses against cyber intrusions. Despite these advancements, challenges such as handling high data volumes and the need for continuous learning to adapt to emerging threats remain. This review underscores the significant advancements, practical implementations, and ongoing challenges of leveraging AI in cybersecurity, highlighting its potential to fortify digital defenses and address the complexities of contemporary cyber threats.

Phishing detection tool for financial emails

Phishing attacks have emerged as a significant cybersecurity threat, especially within the financial domain, where email serves as a prevalent vector for malicious activities. This project report outlines the development and evaluation of a Chrome browser extension tailored to bolster email security, specifically focusing on detecting and mitigating phishing attempts in financial communications. The study begins with a thorough examination of the techniques and tactics used by phishing attackers in financial email campaigns. A sophisticated awareness of the changing landscape of phishing assaults is required to develop successful defences. The key contribution of this work is the development of a powerful Chrome browser extension that easily integrates with common email services in the financial sector. This extension harnesses a blend of machine learning algorithms, URL analysis, and user-friendly interfaces to identify potentially malicious financial emails. It rigorously scans email content, scrutinizing hyperlinks and attachments for signs of phishing. The extension evaluates URL reputations, checks for typical phishing indicators, and examines email headers. In case any suspicious elements are identified, users receive real-time alerts, enabling them to make informed decisions about the safety of financial emails. To ensure the extension’s accuracy and effectiveness within the financial context, an extensive dataset of real-world phishing emails and legitimate financial messages is employed for training and testing. The report offers a comprehensive analysis of the extension’s performance, emphasizing its capability to detect and prevent phishing attempts in financial emails while minimizing false positives. In addition to its detection capabilities, the extension actively promotes user awareness and education regarding phishing threats within the financial sector. It provides guidance on recognizing phishing red flags and offers educational resources to enhance user security practices. This work concludes with an evaluation of the extension’s usability and its potential impact on enhancing email security within the financial domain. It underscores the critical role of proactive measures, such as this extension, in addressing the evolving threat landscape of phishing attacks in the digital age, particularly within financial communications.

Detection of Phishing Websites by Using URL Analysis

Abstract: In recent years, with the increasing use of mobile devices, there is a growing trend to move almost all real-world operations to the cyberworld. Although this makes easy our daily lives, it also brings many security breaches due to the anonymous structure of the Internet. Used antivirus programs and firewall systems can prevent most of the attacks. However, experienced attackers target on the weakness of the computer users by trying to phish them with bogus webpages. These pages imitate some popular banking, social media, e-commerce, etc. sites to steal some sensitive information such as, user-ids, passwords, bank account, credit card numbers, etc. Phishing detection is a challenging problem, and many different solutions are proposed in the market as a blacklist, rule-based detection, anomaly-based detection, etc. In the literature, it is seen that current works tend on the use of machine learning-based anomaly detection due to its dynamic structure, especially for catching the “zero-day” attacks. In this paper, we proposed a machine learning-based phishing detection system by using eight different algorithms to analyse the URLs, and three different datasets to compare the results with other works. The experimental results depict that the proposed models have an outstanding performance with a success rate.

MalwareHunter: A Unified Antivirus Scanning Platform

This research paper aims to develop a website that allows users to upload files and scan them for malware. The website will use a variety of malware scanning technologies, including signature-based detection to identify any malicious code in the uploaded files. Upload a file for scanning, analysis your file with few antivirus products, dynamic analysis sandboxes and a myriad of other security tools to produce a threat score and relevant context to understand it. Get a file report by hash, given a {md5, sha1, sha256} hash, retrieves the pertinent analysis report including threat reputation and context produced by antivirus products, dynamic analysis sandboxes and a myriad of other security tools, and datasets. In the same manner the URL can also be scanned, analysis of the scanned URL with few antivirus products/blocklists and a myriad of other security tools occurs to produce a threat score and relevant context to understand it. Get an URL analysis report, given an URL, retrieves the pertinent analysis report including threat reputation and context produced by antivirus products/blocklists and a myriad of other security tools and datasets. For domain reports, get a domain report, given a domain, retrieves the pertinent analysis report including threat reputation and context produced by antivirus products/blocklists and a myriad of other security tools and datasets. Get an IP address report, given an IP address, retrieves the pertinent analysis report including threat reputation and context produced by antivirus products/ blocklists and a myriad of other security tools and datasets. Keywords: Upload, Malware, Sandbox, Hash, URLs, Signature-based detection.

HyperFusion: Combating Phishing Attacks through URL, Hyperlink, and User Behavior Analysis

Abstract: Phishing attacks remain a persistent threat in cyberspace, demanding innovative solutions for timely detection. In this paper, HyperFusion, a pioneering approach that combines machine learning with user behavior analysis, is introduced to enhance the real-time identification of phishing websites. By integrating features derived from URL and hyperlink characteristics with dynamic user interaction patterns, HyperFusion achieves unprecedented accuracy without reliance on thirdparty systems. Traditional anti-phishing methods often falter against zero-hour attacks or novel phishing websites, underscoring the need for novel strategies. The methodology addresses this challenge by leveraging user behavior data alongside client-side information, thereby eliminating external dependencies and fortifying defense mechanisms. Additionally, a tailored dataset for rigorous experimentation is presented, facilitating a comprehensive evaluation of the approach. Experimental results demonstrate HyperFusion's superior efficacy, boasting a remarkable detection accuracy of 99.37% with the XG Boost technique.

Towards Enhanced Security: An improved approach to Phishing Email Detection

Email phishing assaults remain a widespread catastrophe to individuals and businesses, using human weaknesses to obtain unauthorised access to sensitive information. This research study presents an upgraded email phishing detection system that uses machine learning approaches. To construct a robust and adaptable model, the system includes a complete feature set such as email content analysis, sender reputation, and behavioural patterns. The one that has been proposed uses a new combination of supervised and unsupervised machine learning algorithms to analyse email properties and user behaviour, allowing for the detection of subtle phishing signs. The term of body content analysis, URL analysis, and QR code information are among the features retrieved and analysed utilising advanced natural language processing and pattern recognition algorithms. Novelty lies in the integration of supervised and unsupervised machine learning algorithms to identify subtle phishing indicators, along with advanced natural language processing and pattern recognition algorithms for analyzing email properties. A benchmark dataset is used for the proposed system's validation, and a comparison with other phishing detection techniques shows improved, lower false-positive rates. The results indicate the system's ability to effectively discern phishing emails while minimizing the impact on legitimate communication. The system demonstrates a notable improvement by including a diverse range of features and state-of-the-art machine learning algorithms, which makes it a valuable asset to the cybersecurity toolkit for safeguarding email correspondence.

Impact Of Web (URL) Phishing and Its Detection

Abstract: Web phishing is a persuasive and evolving cyber threat that poses significant risks to individuals, businesses, and organizations in the modern digital age. This paper aims to provide an overview of web phishing, focusing on its methods, detection techniques, and prevention. Phishing attacks occur when malicious actors use deceptive practices to trick people into divulging sensitive or classified information such as passwords, credit card details, or personal data. These attacks primarily manifest through emails, websites, or social engineering tactics. Phishing emails often impersonate trusted entities and lure recipients into clicking on malicious links or downloading harmful attachments. Web phishing involves using fraudulent websites that mimic legitimate ones to steal user information or deliver malware. Detecting web phishing attacks is an ongoing challenge due to the sophistication of attackers. Several detection techniques have been developed, including heuristic analysis, machine learning algorithms, and real-time URL analysis. These methods analyze various attributes of websites and emails to identify suspicious patterns or behaviors. Detecting web phishing is equally essential. Effective prevention strategies include user education and awareness programs, using two-factor authentication, regular software updates, and deploying advanced email filtering and anti-phishing tools. User training is crucial in helping individuals recognize phishing attempts and avoid falling victim to them.

A Two-Stage Hybrid Approach for Phishing Attack Detection Using URL and Content Analysis in IoT

The goal of phishing assaults is to trick users into giving up personal information by making them believe they need to act quickly on critical information. The creation of efficient solutions, such as phishing attack detection systems backed by AI, is essential for the safety of users. This research suggests a two-stage hybrid strategy that uses both URL and content analysis to identify phishing assaults. In the first step of the suggested method, URL analysis is used to determine the legitimacy of suspected phishing assaults. If the site is still live, the second check uses content analysis to determine how serious the attack is. Both analysis' findings are taken into account in the decision-making procedure. As can be seen from the experiments, the hybrid system obtains an astounding 99.06% accuracy rate. This research adds to the existing body of knowledge by providing a massive dataset of over 14 million data samples that includes both legal and phishing URLs. Furthermore, when content analysis is required for phishing URL detection, the two-stage hybrid technique significantly outperforms URL analysis alone by 70.23 %. The proposed method provides better defense against phishing attempts and is practical enough for widespread use.

Detection of malicious websites across multiple classes using n-gram features and VGG based on URL analysis

Due to the ubiquity of the internet, cyber-attacks implemented through websites have become a severe issue with high frequency and appreciable overall financial damage. Detecting malicious URLs has become one of the most common solutions to tackle this threat, which is widely applied in the market and researched. Inspired by relevant work on URL classification using n-gram techniques and convolutional neural networks in other research areas, a method for detecting malicious websites using n-gram statistical features of URLs and a VGG-style neural network has been developed, which aims to provide classification for multiple website classes with arbitrary URL input lengths. Experimental results show that the method proposed in this paper provides an average accuracy of 96.60% on the 5-class ISCX-URL2016 dataset and 96.33% on the 4-class Malicious URLs dataset, which is 1.5 times larger. A further comparison reveals that the accuracies are competitive with similar methods for binary classifications that also use either n-gram features or a VGG-based network.

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Phishing poses a significant threat to the financial and privacy security of internet users and often serves as the starting point for cyberattacks. Many machine-learning-based methods for detecting phishing websites rely on URL analysis, offering simplicity and efficiency. However, these approaches are not always effective due to the following reasons: (1) highly concealed phishing websites may employ tactics such as masquerading URL addresses to deceive machine learning models, and (2) phishing attackers frequently change their phishing website URLs to evade detection. In this study, we propose a robust, multi-view Transformer model with an expert-mixture mechanism for accurate phishing website detection utilizing website URLs, attributes, content, and behavioral information. Specifically, we first adapted a pretrained language model for URL representation learning by applying adversarial post-training learning in order to extract semantic information from URLs. Next, we captured the attribute, content, and behavioral features of the websites and encoded them as vectors, which, alongside the URL embeddings, constitute the website’s multi-view information. Subsequently, we introduced a mixture-of-experts mechanism into the Transformer network to learn knowledge from different views and adaptively fuse information from various views. The proposed method outperforms state-of-the-art approaches in evaluations of real phishing websites, demonstrating greater performance with less label dependency. Furthermore, we show the superior robustness and enhanced adaptability of the proposed method to unseen samples and data drift in more challenging experimental settings.

A Novel Logo Identification Technique for Logo-Based Phishing Detection in Cyber-Physical Systems

The first and foremost task of a phishing-detection mechanism is to confirm the appearance of a suspicious page that is similar to a genuine site. Once this is found, a suitable URL analysis mechanism may lead to conclusions about the genuineness of the suspicious page. To confirm appearance similarity, most of the approaches inspect the image elements of the genuine site, such as the logo, theme, font color and style. In this paper, we propose a novel logo-based phishing-detection mechanism that characterizes the existence and unique distribution of hue values in a logo image as the foundation to unambiguously represent a brand logo. Using the proposed novel feature, the detection mechanism optimally classifies a suspicious logo to the best matching brand logo. The experiment is performed over our customized dataset based on the popular phishing brands in the South-Asia region. A set of five machine-learning algorithms is used to train and test the prepared dataset. We inferred from the experimental results that the ensemble random forest algorithm achieved the high accuracy of 87% with our prepared dataset.

An Exploratory Study of Tweets about the SARS-CoV-2 Omicron Variant: Insights from Sentiment Analysis, Language Interpretation, Source Tracking, Type Classification, and Embedded URL Detection

This paper presents the findings of an exploratory study on the continuously generating Big Data on Twitter related to the sharing of information, news, views, opinions, ideas, knowledge, feedback, and experiences about the COVID-19 pandemic, with a specific focus on the Omicron variant, which is the globally dominant variant of SARS-CoV-2 at this time. A total of 12,028 tweets about the Omicron variant were studied, and the specific characteristics of the tweets that were analyzed include sentiment, language, source, type, and embedded URLs. The findings of this study are manifold. First, from sentiment analysis, it was observed that 50.5% of tweets had a ‘neutral’ emotion. The other emotions—‘bad’, ‘good’, ‘terrible’, and ‘great’—were found in 15.6%, 14.0%, 12.5%, and 7.5% of the tweets, respectively. Second, the findings of language interpretation showed that 65.9% of the tweets were posted in English. It was followed by Spanish or Castillian, French, Italian, Japanese, and other languages, which were found in 10.5%, 5.1%, 3.3%, 2.5%, and <2% of the tweets, respectively. Third, the findings from source tracking showed that “Twitter for Android” was associated with 35.2% of tweets. It was followed by “Twitter Web App”, “Twitter for iPhone”, “Twitter for iPad”, “TweetDeck”, and all other sources that accounted for 29.2%, 25.8%, 3.8%, 1.6%, and <1% of the tweets, respectively. Fourth, studying the type of tweets revealed that retweets accounted for 60.8% of the tweets, it was followed by original tweets and replies that accounted for 19.8% and 19.4% of the tweets, respectively. Fifth, in terms of embedded URL analysis, the most common domain embedded in the tweets was found to be twitter.com, which was followed by biorxiv.org, nature.com, wapo.st, nzherald.co.nz, recvprofits.com, science.org, and other domains. Finally, to support research and development in this field, we have developed an open-access Twitter dataset that comprises Tweet IDs of more than 500,000 tweets about the Omicron variant, posted on Twitter since the first detected case of this variant on 24 November 2021.

Hidden online customer journey: How unseen activities affect media mix modelling and multichannel attribution

The purpose of this article is to verify the impact of missing the earned media and category media in multichannel conversion attribution models on digital media budget allocation. The analysis is based on a very unique approach: 532 users who declared their will to purchase a selected product in the next 3–5 months agreed to install special addons on all their devices connected to the Internet. These devices will register all the users’ activities throughout three months. All user activities on the path to purchase were extracted by means of text mining (URL analysis) techniques. Finally, 5171 activities were found and assigned to particular media areas and media channels. The average user spends 20 per cent of his time in the paid media and owned media areas. However, from the point of view of the number of touchpoints, 29 per cent of the activities occur in these two areas. The obtained results clearly show how much of consumers’ activity in the decision-making process is beyond the control of marketers who, on the basis of this partial data, have to make daily decisions about allocating advertising budgets. The study compared the results of conversion attribution for the full funnel (paid media, owned media, earned media, category media) with the conversion attribution based only on paid media and owned media. The results indicate that not all attribution models lead to similar conclusions in both approaches.

Phishing URL Detection: A Real-Case Scenario Through Login URLs

Phishing is a social engineering cyberattack where criminals deceive users to obtain their credentials through a login form that submits the data to a malicious server. In this paper, we compare machine learning and deep learning techniques to present a method capable of detecting phishing websites through URL analysis. In most current state-of-the-art solutions dealing with phishing detection, the legitimate class is made up of homepages without including login forms. On the contrary, we use URLs from the login page in both classes because we consider it is much more representative of a real case scenario and we demonstrate that existing techniques obtain a high false-positive rate when tested with URLs from legitimate login pages. Additionally, we use datasets from different years to show how models decrease their accuracy over time by training a base model with old datasets and testing it with recent URLs. Also, we perform a frequency analysis over current phishing domains to identify different techniques carried out by phishers in their campaigns. To prove these statements, we have created a new dataset named Phishing Index Login URL (PILU-90K), which is composed of 60K legitimate URLs, including index and login websites, and 30K phishing URLs. Finally, we present a Logistic Regression model which, combined with Term Frequency - Inverse Document Frequency (TF-IDF) feature extraction, obtains 96.50% accuracy on the introduced login URL dataset.

An adaptive approach for internet phishing detection based on log data

The Internet has become one of the most important daily socials, financial and other activities. the number of customers who use the Internet to conduct their business and purchases is very large. This results in billions of dollars being transferred every day online. Such a large amount of money attracts the attention of cybercriminals to carry out their illegal activities. “Fraud” is one of the most dangerous of these methods, especially phishing, where attackers try to steal user credentials using fraudulent emails, fake websites, or both. The proposed system for this paper includes efficient data extraction from the web file through data collection and preprocessing. and web usage mining procedure to extract features that demonstrate user behavior. and feature-extracting URL analysis to detect website phishing addresses. After that, the features from the above two parts are combined to make the number of features sixty-three. Finally, a classification algorithm (Random Forests) is applied to determine if website addresses are phishing or legitimate. Suggested algorithms performance is determined by using a confusion matrix and a number of metrics that shows the robustness of the proposed system.

Fraud usage detection in internet users based on log data

The Internet has become one of the most important daily social, financial and other activities. The number of customers who use the Internet to conduct their business and purchases is very large. This results in billions of dollars being transferred every day online. Such a large amount of money attracts the attention of cybercriminals to carry out their illegal activities. “Fraud” is one of the most dangerous of these methods, especially phishing, where attackers try to steal user credentials using fraudulent emails, fake websites, or both. The proposed system in this paper includes efficient data extraction from the web file through data collection and preprocessing. and web usage mining procedure to extract features that demonstrate user behavior. And feature-extracting URL analysis to detect website phishing addresses. After that, the features from the above two parts are combined to make the number of features sixty-three. Finally, a classification algorithm (Random Forests) is applied to determine if website addresses are phishing or legitimate. Suggested algorithms performance is determined by using a confusion matrix that shows the robustness of the proposed system.

A survey on detection of Phishing Websites using Machine Learning

Phishing internet sites contents and internet-predicated consummately data includes varied hints. The victim’s personal and sensitive records is obtained by phishing sites which lead them to surf a phishing internet site that resembles a valid internet site, that's one of the illegal assaults triumphing with inside the cyber world. The proposed a brilliant version for detecting phishing internet pages primarily predicated on Extreme Learning Machine. Types of internet pages are one of a kind in phrases in their features. Hence, we require to utilize a web page feature set to preserve any phishing assault. A Machine Learning approach is implemented to resist these attacks. The projected technique for importing phishing dataset, legitimate URLs from the database, and also data that is obtained are pre-processed. Phishing website detection is performed on four classes of URL features: domain, address, abnormal based, HTML, JavaScript features. With the aid of processed data URL features are extracted also values for URL attribute are generated. URL analysis is performed by ML techniques that calculates the threshold value as well as range value for URL attributes. The objective of this project is to implement an ELM classification for several features and some phishing sites within the database.

Feature Engineering Framework to detect Phishing Websites using URL Analysis

Phishing is a most popular and dangerous cyber-attack in the world of internet. One of the most common attacks in cyber security is to access the personal information of internet users through “Phishing Website”. The major element through which hacker can do this job is through URL. Hacker creates an almost replica of original URL in which there is a very small difference, generally not revealed without keen observation. By pipelining various machine learning algorithms, the proposed model aims to recognize the important features to classify the URL using a recursive feature elimination process. In this work the data set of various URL records has been collected with 112 features including one target value. In this work a Machine Learning based model is proposed to identify the significant features, used to classify a URL, the wrapper method recursive feature elimination compares different bagging and boosting machine learning approaches .Ensemble algorithms, Bootstrap Aggregation Algorithms, Boosting and stacking algorithms are used for feature selection. The proposed work has five sections: work on the pre-processing phase, finding the relation between the features of the dataset, automatic selection of number of features using Extra Tree Classifier, comparison of the various ensemble algorithm and finally generates the best features for URL analysis. This paper, designs meta learner with XG BOOST classifier as base classifier and achieved an accuracy of 93% Out of 112 features, this model has performed an extensive comparative study on feature selection and identified 29 features as core features by performing URL analysis.

Global mapping of artificial intelligence in Google and Google Scholar

The worldwide presence of AI needs to be quantified. This study proposes a descriptive approach and the use of multiple methods and data. An extensive electronic corpus of books was utilized to see the worldwide drift of intellectuals’ minds toward AI and identified related terms, their future trends, and convergence. Using the best bigram proposed by Ngrams Viewer, this study explores the human mind through Google query data, linking popular regions, countries, and related topics to the concept of AI. URL datasets were collected using two popular search engines (SEs), Google and Google Scholar (GS). A URL analysis identified key entities (organizations, institutes, and countries) and their yearly trends. Top-level domains revealed the global web ecology and the annual information growth of AI in SE environments. Information gathered through one approach was fed into the other, revealing a complementary relationship. AI is popular across the globe, and has left traces in many different countries. In this field, GS dominates Google, in relation to the number of sites and domains it includes. Top results reveal the popularity of AI among professionals, artists, programmers, and researchers. The pros and cons of the approaches are also discussed. In addition, this study aims to predict the impact of AI on society, as interpreted through the lenses of well-established theories. The dominance of AI may trap society into aspiring toward an easy life, dependent on intelligent machines. Consistent policies are needed to smooth out future economic cycles in the AI field.