Machine Learning for Malicious URL Classification: A Temporal Analysis
Open AccessWhen Machine Learning (ML) is applied to labelled datasets, it is standard practice that 70% of the dataset is used for training models, with 30% used for testing. That approach assumes the dataset does not change over time. This praxis makes the case that URLs do change over time, meaning that ML performance should decay over time when applied to malicious URL classification. All studies found within the scope of this praxis, where ML was used to classify malicious URLs, used the traditional 70-30 split. Not knowing the consequences of drift and decay where ML is applied to malicious URL classification was identified as the primary knowledge gap of interest for this praxis.Models that are resistant to performance decay over time exhibit lasting power. To identify models with the strongest lasting power, a dataset was created to address the stated research questions and hypotheses, which relate to the idea that a temporal analysis can determine which ML algorithms struggle the least with drift and decay when used to classify malicious URLs. The new, temporally segmented dataset had 2,292,882 URLs, making the dataset of this praxis one of the largest malicious URL datasets to date. The temporal analysis did, indeed, reveal concept drift. Additionally, the analysis revealed that performance decay might exist, but the decay would be negligible. The presence of performance decay remains an open question that future research could explore. Models with the strongest lasting power identified herein include SVM-l, SVM-rbf, and LSVC, with the application of Normalization and Standardization. These findings provide essential novel insight so that security engineers can make informed decisions by selecting models with lasting power when designing security solutions for malicious URL classification.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.