Cyber Threat Intelligence-Based Malicious URL Detection Model Using Ensemble Learning.

Area of Science:

• Cybersecurity
• Machine Learning
• Web Security

Background:

• Web applications are essential but vulnerable to malicious attacks like phishing and defacement.
• Existing detection methods often rely on content analysis, which is inefficient and prone to obfuscation.
• Malicious Uniform Resource Locator (URL) detection is safer but faces challenges with feature insufficiency and classification accuracy.

Purpose of the Study:

• To enhance the accuracy of malicious URL detection.
• To develop a cyber threat intelligence-based (CTI) malicious URL detection model.
• To implement a two-stage ensemble learning approach for improved detection performance.

Main Methods:

• Extraction of CTI-based features from web searches (Google, Whois) and user reports.
• Development of a two-stage ensemble model combining Random Forest (RF) for pre-classification and Multilayer Perceptron (MLP) for final classification.
• Utilizing probabilistic outputs from RF weak classifiers as input for the MLP classifier.

Main Results:

• The CTI-based features and two-stage ensemble model outperformed existing detection models.
• The proposed model achieved a 7.8% improvement in detection accuracy.
• A 6.7% reduction in false-positive rates was observed compared to traditional URL-based models.

Conclusions:

• CTI-based features significantly enhance malicious URL detection performance.
• The two-stage ensemble learning model (RF + MLP) provides a robust approach to classifying malicious URLs.
• This research offers a more effective and safer method for identifying and mitigating web-based threats.