Method and Apparatus for Detecting Malicious Websites
A method and apparatus for detecting malicious websites is disclosed.
1 . A system for detecting a malicious website, comprising:
a domain classification engine, running on a computer, configured to receive a domain name, perform Markov analysis and random forest classification on the domain name, and generate a maliciousness rating for the domain name; and
an execution engine, running on a computer, that performs an action based on the maliciousness rating.
2 . The system of claim 1 , wherein the action is generating a notification.
3 . The system of claim 1 , wherein the action is preventing access by another computer to a website associated with the domain name.
4 . The system of claim 1 , wherein the action is allowing access by another computer to a website associated with the domain name.
5 . The system of claim 1 , wherein the Markov analysis comprises determining the probability of the occurrence of a digit following two preceding digits in the domain name.
6 . The system of claim 1 , wherein the domain classification engine is further configured to perform feature extraction.
7 . The system of claim 6 , wherein the feature extraction comprises determining the number of digits in one or more subdomains of the domain name.
8 . The system of claim 6 , wherein the feature extraction comprises determining the number of vowels in a high level domain of the domain name.
9 . The system of claim 6 , wherein the feature extraction comprises determining the length of the domain name.
10 . The system of claim 6 , wherein the feature extraction comprises determining the number of domain levels in the domain name.
11 . A method of detecting a malicious website, comprising:
receiving, by a computer, a URL comprising a domain name;
performing Markov analysis, by the computer, on the domain name;
performing random forest classification, by the computer, on the domain name;
generating, by the computer, a maliciousness rating based on a result of the Markov analysis and a result of the random forest classification; and
performing an action, by the computer, based on the maliciousness rating.
12 . The system of claim 11 , wherein the action is generating a notification.
13 . The system of claim 11 , wherein the action is preventing access by another computer to a website associated with the domain name.
14 . The system of claim 11 , wherein the action is allowing access by another computer to a website associated with the domain name.
15 . The system of claim 11 , wherein the Markov analysis comprises determining the probability of the occurrence of a digit following two preceding digits in the domain name.
16 . The system of claim 11 , wherein the domain classification engine is further configured to perform feature extraction.
17 . The system of claim 16 , wherein the feature extraction comprises determining the number of digits in one or more subdomains of the domain name.
18 . The system of claim 16 , wherein the feature extraction comprises determining the number of vowels in a high level domain of the domain name.
19 . The system of claim 16 , wherein the feature extraction comprises determining the length of the domain name.
20 . The system of claim 16 , wherein the feature extraction comprises determining the number of domain levels in the domain name.