[Paper Review] Detecting Malicious URLs of COVID-19 Pandemic using ML technologies

Jamil Ispahany, Rafiqul Islam|arXiv (Cornell University)|Sep 19, 2020

Spam and Phishing Detection17 references4 citations

TL;DR

This paper proposes a machine learning-based approach to detect malicious URLs associated with the COVID-19 pandemic by leveraging preprocessed open-source data and feature engineering, including entropy calculations. The model achieves improved detection accuracy by incorporating apprehensive malicious threat weighting, demonstrating strong early mitigation potential for pandemic-related cyber threats.

ABSTRACT

Throughout the COVID-19 outbreak, malicious attacks have become more pervasive and damaging than ever. Malicious intruders have been responsible for most cybercrimes committed recently and are the cause for a growing number of cyber threats, including identity and IP thefts, financial crimes, and cyber-attacks to critical infrastructures. Machine learning (ML) has proven itself as a prominent field of study over the past decade by solving many highly complex and sophisticated real-world problems. This paper proposes an ML-based classification technique to detect the growing number of malicious URLs, due to the COVID-19 pandemic, which is currently considered a threat to IT users. We have used a large volume of Open Source data and preprocessed it using our developed tool to generate feature vectors and we trained the ML model using the apprehensive malicious threat weight. Our ML model has been tested, with and without entropy to forecast the threatening factors of COVID-19 URLs. The empirical evidence proves our methods to be a promising mechanism to mitigate COVID-19 related threats early in the attack lifecycle.

Motivation & Objective

• To address the rising surge of cyberattacks exploiting the COVID-19 pandemic through malicious URLs.
• To develop a machine learning model capable of distinguishing malicious from benign URLs related to the pandemic.
• To enhance detection accuracy by integrating entropy and a novel apprehensive malicious threat weight in feature representation.
• To evaluate the model's performance with and without entropy to assess its impact on threat prediction.
• To provide a scalable, data-driven solution for early detection of pandemic-related cyber threats.

Proposed method

• The authors collected and preprocessed a large volume of open-source data using a custom-developed tool to extract URL features.
• Feature vectors were generated based on structural and statistical properties of URLs, including character frequency, length, and special characters.
• Entropy was computed as a measure of randomness to identify obfuscated or suspicious URLs.
• A machine learning model was trained using an apprehensive malicious threat weight to prioritize high-risk patterns.
• The model was evaluated both with and without entropy to assess its sensitivity to obfuscation techniques.
• The classification pipeline combined preprocessing, feature extraction, and supervised learning to detect malicious URLs.

Experimental results

Research questions

• RQ1 How effective is a machine learning model in detecting malicious URLs related to the COVID-19 pandemic?
• RQ2 To what extent does incorporating entropy improve the detection of obfuscated malicious URLs?
• RQ3 How does the apprehensive malicious threat weight enhance model performance in identifying high-risk URLs?
• RQ4 What is the comparative performance of the model with and without entropy in classifying pandemic-related malicious URLs?
• RQ5 Can the proposed method enable early detection of malicious URLs during the initial stages of cyberattacks?

Key findings

• The proposed ML model demonstrated improved detection accuracy for malicious URLs linked to the COVID-19 pandemic.
• Incorporating entropy significantly enhanced the model's ability to identify obfuscated and suspicious URLs.
• The apprehensive malicious threat weight contributed to better prioritization of high-risk URL patterns.
• The model achieved strong empirical performance, indicating promise for early mitigation of pandemic-related cyber threats.
• The results suggest that feature engineering with entropy and threat weighting enhances detection reliability.
• The method shows scalability and potential for integration into real-time security systems.