A Study on Techniques for Proactively Identifying Malicious URLs

As most of the malware nowadays use Internet as their main doorway to infect a new system, it has become imperative for security vendors to provide cloud-based solutions that can filter and block malicious URLs. This paper presents different practical considerations related to this problem. The key points that we focus on are the usage of different machine learning techniques and unsupervised learning methods for detecting malicious URLs with respect to memory footprint. The database that we have used in this paper was collected during a period of 48 weeks and consists in approximately 6,000,000 benign and malicious URLs. We also evaluated how detection rate and false positive rate evolved during that period and draw some conclusions related to current malware landscape and Internet attack vectors.