A study on machine learning approaches for secure Internet services

Abstract

In these days, various kinds of Internet services provide many conveniences, such as information search, e-commerce, e-health, e-education and social network services. As the Internet services have become an important part of people’s lives, attacks have also increased in recent years. In this thesis, we focus on machine learning approaches for secure Internet services. This study mainly focuses on detecting malicious web pages based on machine learning approaches. First, we propose an efficient filtering method for detecting malicious web pages using cost sensitive analysis. There are ways to detect malicious web pages, two of which are dynamic detection and static detection. Dy-namic detection has a high detection rate but uses a high amount of resources and takes a long time, whereas static analysis only uses a small amount of resources but its detection rate is low. To minimize the weaknesses of these two methods, Canali et al. suggest a filtering method, Prophiler, which uses static analysis first to filter normal web pages and then uses dynamic analysis to test only the remaining suspicious web pages. In this filtering method, if a page is classified as normal at the filtering stage, it is not being tested any more. Consequently, there should not be any malicious pages among the web pages classified as normal. However, Prophiler does not consider this problem. In this study, to solve this problem, our proposed filtering method utilizes a cost-sensitive method. Also, to increase the efficiency of the filter, features are grouped as 3 subsets depending on the difficulty of the extraction. The efficiency of the proposed filter can be increased, as our method only uses the necessary feature subset according to the characteristics of the web pages. An experiment showed that the load of the dynamic analysis decreased significantly when using the proposed method and that the proposed method shows fewer false negatives and greater efficiency than an existing fi...