信息安全研究 ›› 2016, Vol. 2 ›› Issue (1): 80-85.

• 学术论文 • 上一篇    下一篇

恶意URL多层过滤检测模型策略研究

赵刚   

  1. 北京信息科技大学信息管理学院信息安全系
  • 收稿日期:2015-11-28 出版日期:2016-01-05 发布日期:2016-01-18
  • 通讯作者: 赵刚
  • 作者简介:刘健 硕士研究生,主要研究方向为机器学习与信息安全. liujianspace999126@126.com 赵刚 副教授,博士,主要研究方向为人工智能与信息安全. zhaogang@bistu.edu.cn 郑运鹏 硕士研究生,主要研究方向为大数据与物流规划. zhengpeng911001@126.com

Research on Strategy of Malicious URL MultiLayer Filtering Detection Model

  • Received:2015-11-28 Online:2016-01-05 Published:2016-01-18

摘要: 恶意URL检测始终是Web安全领域的研究热点.提出了恶意URL多级检测过滤模型,共分成4层过滤器:黑白名单过滤器、朴素贝叶斯过滤器、CART决策树过滤器和支持向量机过滤器.对多层过滤模型的几个关键策略进行了讨论,包括过滤器层的投票策略、过滤器顺序策略以及过滤阈值的调优策略.过滤器投票策略中讨论了单独投票、并行投票和加权并行投票3种投票方法,过滤器顺序策略讨论了4种过滤器的先后顺序,过滤器阈值策略讨论了过滤阈值的确定方法.通过实验验证了多层过滤检测模型中以上策略讨论结果的有效性,根据实验结果实现了Web应用.

关键词: 恶意URL, 投票策略, 机器学习, 分类算法, 多层过滤模型

Abstract: Malicious URL detection is always a hot research topic in the field of Web security. This paper proposes a malicious URL multilevel filtering detection model. This model contains 4 layers of filter: black and white list filter, Naive Bayesian filter, CART decision tree filter and Support Vector Machine filter. In this paper several key strategies of multilayer filtering model are discussed, including support vector machine filter layer voting strategy; filter order strategy and filtering threshold tuning strategy. Filter voting strategies are discussed in separate voting, parallel voting and weighted parallel voting three voting methods. The filter order strategy discusses the order of the four filters. Filter threshold strategy discusses the method of determining the threshold of the filter. The validity of the above methods is verified by experiments. According to the experimental results, this paper implements a Web application.

Key words: malicious URL, voting strategy, machine learning, classification algorithm, multi layer filtering model