Malicious web domain identification using online credibility and performance data by considering the class imbalance issue

• Published in: Industrial management + data systems Vol. 119; no. 3; pp. 676 - 696
• Main Authors: Hu, Zhongyi, Chiong, Raymond, Pranata, Ilung, Bao, Yukun, Lin, Yuqing
• Format: Journal Article
• Language: English
• Published: Wembley Emerald Publishing Limited 08.04.2019; Emerald Group Publishing Limited
• Subjects: Algorithms; Artificial intelligence; Blacklisting; Credibility; Cybercrime; Datasets; Domains; Heuristic methods; Identification; Machine learning; Malware; Oversampling; Particle swarm optimization; Resampling; Search engines; Social networks; URLs; Websites; Online data; Internet users; Credibility and performance; Information security; Malicious web domain; Synthetic minority oversampling technique; Particle swarm optimization; Imbalance class distribution
• ISSN: 0263-5577; 1758-5783
• DOI: 10.1108/IMDS-02-2018-0072

Purpose Malicious web domain identification is of significant importance to the security protection of internet users. With online credibility and performance data, the purpose of this paper to investigate the use of machine learning techniques for malicious web domain identification by considering the class imbalance issue (i.e. there are more benign web domains than malicious ones). Design/methodology/approach The authors propose an integrated resampling approach to handle class imbalance by combining the synthetic minority oversampling technique (SMOTE) and particle swarm optimisation (PSO), a population-based meta-heuristic algorithm. The authors use the SMOTE for oversampling and PSO for undersampling. Findings By applying eight well-known machine learning classifiers, the proposed integrated resampling approach is comprehensively examined using several imbalanced web domain data sets with different imbalance ratios. Compared to five other well-known resampling approaches, experimental results confirm that the proposed approach is highly effective. Practical implications This study not only inspires the practical use of online credibility and performance data for identifying malicious web domains but also provides an effective resampling approach for handling the class imbalance issue in the area of malicious web domain identification. Originality/value Online credibility and performance data are applied to build malicious web domain identification models using machine learning techniques. An integrated resampling approach is proposed to address the class imbalance issue. The performance of the proposed approach is confirmed based on real-world data sets with different imbalance ratios.