Multi-model detection of malicious url using its network

Abstract

A URL is input into a virtual browser of a crawler which requests that URL and all of its resource URLs in order to form a network graph. Network features are extracted. An identity stage uses an identity model based upon lexical and host features to determine if the input URL and resource URLs are malicious or benign. A similarity stage uses a similarity model and similarity functions to produce a similarity score between each pair of the input URL and a resource URL. An activity stage uses an activity model to determine if the input URL's network is malicious or benign based upon the network graph and extracted network activity features. Edges of the graph are weights, similarity scores, attributes or network features. A finality stage concludes malicious if the identity stage concluded that the URL was malicious or the activity stage concluded that the URL's network was malicious.