Systems and methods for detection of infected websites
System and method for detecting an infected website are disclosed. A semantic finder receives top-level domains and identifies keywords of the top-level domains representing a predetermined semantics. The keywords are compared with irrelevant bad terms to find at least one irrelevant term. An inconsistency searcher searches the top-level domains and detects at least one fully-qualified domain name carrying the at least one irrelevant term. A context analyzer evaluates context information associated with the irrelevant term, identifies at least one frequently-used term identified in the context information, and determines whether the at least one frequently-used term is unrelated to a generic content of the at least one fully-qualified domain name An irrelevant bad term collector extracts the at least one frequently-used term unrelated to the generic content and adds the extracted frequently-used term to an irrelevant bad term list for detecting the infected website.
1. A system having at least one processor configured to execute at least one computer-executable instruction for detecting an infected website, comprising:
a semantic finder configured to receive a set of top-level domains and identify a plurality of keywords of the set of top-level domains representing a predetermined semantics through a search of one or more sources of information relating to the set of top-level domains, the plurality of keywords representing the predetermined semantics being compared with a seed set of irrelevant bad terms to find at least one irrelevant term;
an inconsistency searcher configured to search the set of top-level domains and detect at least one fully-qualified domain name carrying the at least one irrelevant term;
a context analyzer configured to evaluate context information associated with the at least one irrelevant term, identify at least one frequently-used term identified in the context information, and determine whether the at least one frequently-used term is unrelated to a generic content of the at least one fully-qualified domain name; and
an irrelevant bad term collector configured to extract the at least one frequently-used term unrelated to the generic content and add the extracted at least one frequently-used term to an irrelevant bad term list for detecting the infected website.
2. The system of claim 1 , wherein the semantic finder is further configured to calculate a semantic distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
3. The system of claim 2 , wherein the sematic finder is further configured to calculate the semantic distance based on a cosine distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
4. The system of claim 2 , wherein the inconsistency searcher is further configured to detect the at least one fully-qualified domain name carrying the at least one irrelevant term based on the semantic distance.
5. The system of claim 1 , wherein the context analyzer is further configured to convert the context information into a dimensional vector having a frequency of each keyword of the plurality of keywords representing the predetermined semantics.
6. The system of claim 1 , wherein the context analyzer is further configured to evaluate the context information associated with the at least one irrelevant term using a differential analysis.
7. The system of claim 1 , wherein the context analyzer is further configured to determine whether the context information is compatible with a theme of the at least one fully-qualified domain name based on a semantic distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
8. The system of claim 1 , wherein the irrelevant bad term collector is further configured to detect the infected website based on the irrelevant bad term list.
9. The system of claim 1 , wherein the irrelevant bad term collector is further configured to detect an additional infected website based on an URL pattern of the infected website.
10. The system of claim 1 , wherein the irrelevant bad term collector is further configured to add the extracted at least one frequently-used term having a largest semantic distance from the set of top-level domains to the irrelevant bad term list.
11. A method of detecting an infected website using at least one processor configured to execute at least one computer-executable instruction, the method comprising:
receiving, using a semantic finder, a set of top-level domains and identifying a plurality of keywords of the set of top-level domains representing a predetermined semantics, the plurality of keywords representing the predetermined semantics being compared with a seed set of irrelevant bad terms to find at least one irrelevant term, and wherein the keywords are identified through a search of one or more sources of information relating to the set of top-level domains;
searching, using an inconsistency searcher, the set of top-level domains and detecting at least one fully-qualified domain name carrying the at least one irrelevant term;
evaluating, using a context analyzer, context information associated with the at least one irrelevant term, identifying at least one frequently-used term identified in the context information, and determining whether the at least one frequently-used term is unrelated to a generic content of the at least one fully-qualified domain name; and
extracting, using an irrelevant bad term collector, the at least one frequently-used term unrelated to the generic content and add the extracted at least one frequently-used term to an irrelevant bad term list for detecting the infected website.
12. The method of claim 11 , further comprising, calculating, using the semantic finder, a semantic distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
13. The method of claim 12 , further comprising, calculating, using the sematic finder, the semantic distance based on a cosine distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
14. The method of claim 12 , further comprising, detecting, using the inconsistency searcher, the at least one fully-qualified domain name carrying the at least one irrelevant term based on the semantic distance.
15. The method of claim 11 , further comprising, converting, using the context analyzer, the context information into a dimensional vector having a frequency of each keyword of the plurality of keywords representing the predetermined semantics.
16. The method of claim 11 , further comprising, evaluating, using the context analyzer, the context information associated with the at least one irrelevant term using a differential analysis.
17. The method of claim 11 , further comprising, determining, using the context analyzer, whether the context information is compatible with a theme of the at least one fully-qualified domain name based on a semantic distance between the plurality of keywords of the set of top-level domains and the seed set of irrelevant bad terms.
18. The method of claim 11 , further comprising, detecting, using the irrelevant bad term collector, the infected website based on the irrelevant bad term list.
19. The method of claim 11 , further comprising, detecting, using the irrelevant bad term collector, an additional infected website based on an URL pattern of the infected website.
20. The method of claim 11 , further comprising, adding, using the irrelevant bad term collector, the extracted at least one frequently-used term having a largest semantic distance from the set of top-level domains to the irrelevant bad term list.