KR102438527B1 - Method for predicting malignant url considering url- related content and host data and apparatus implementing the same method - Google Patents

Abstract

A method performed by a computing device according to an embodiment of the present invention generates a plurality of models by performing machine learning using URL data for learning, and outputs performance values of each of the plurality of models, but the plurality of models is generated by different machine learning methodologies, step, inputting the feature data of the prediction target URL into the plurality of generated models and outputting prediction results by each of the models, and each of the models and predicting whether the prediction target URL is a malicious URL by applying the performance value of ? to the prediction results of each of the models.

Description

A method for predicting a malicious URL in consideration of URL-related content and host data, and a device for implementing the same

The present invention relates to a multi-machine learning-based malicious URL prediction method and an apparatus for implementing the same, and more particularly, to a multi-machine learning-based malicious URL prediction method for detecting a malicious URL such as a phishing site using a machine learning algorithm. , and to an apparatus for implementing it.

Websites that perform malicious actions such as phishing to steal personal information, hiding and distributing malicious codes, etc. pose a security threat to organizations that hold sensitive personal information, such as governments or financial institutions.

A domain of a website such as a phishing site is classified as a malicious URL (Uniform Resource Locator), and by detecting it, it is possible to prevent a security problem from occurring.

Conventionally, as a technology for detecting malicious URLs, a signature method for blocking based on information on malicious URLs input in advance has been used.

However, since a malicious URL has a relatively short life cycle and is transformed into various and new forms, it is impossible to detect and predict a malicious URL if it does not have a signature of the malicious URL.

In addition, it is not easy to obtain a signature due to a domain change or re-registration due to a report of a malicious URL, or a real-time change to improve the difficulty of domain tracking. Moreover, when there is no predetermined pattern, such as using a randomly generated domain, there is a problem in that it is difficult to predict with the signature method.

Due to such a problem, a machine learning model is used instead of a signature method in predicting a malicious URL. However, when only a single machine learning model is used, the accuracy of prediction may be lowered, the method of learning the feature data is different depending on which machine learning model is used, and the feature data learned according to the analysis target is different.

Unexamined Patent Publication No. 10-2020-0109677 (Registered on September 23, 2020)

The technical problem to be solved by the present invention is a multi-machine learning-based malicious URL that can predict whether a malicious URL is malicious even when there is no previously input signature information for a malicious URL that has a short life cycle and is transformed into various new forms. It is to provide a URL prediction method, and an apparatus for implementing the method.

Another technical problem to be solved by the present invention is a multi-machine learning-based malicious URL prediction method capable of providing prediction results with improved accuracy by learning different machine learning algorithms according to the characteristics of data to be analyzed for malicious URLs. , and to provide a device for implementing it.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

In a method performed by a computing device according to an embodiment of the present invention for solving the technical problem, a plurality of models are generated by performing machine learning using URL data for learning, and performance values of each of the plurality of models are performed. , wherein the plurality of models are generated by different machine learning methodologies. outputting, and predicting whether the prediction target URL is a malicious URL by applying the performance value of each model to the prediction result of each model.

As an embodiment, a plurality of models are generated by performing machine learning using the URL data for learning, and a performance value of each of the plurality of models is outputted, but the plurality of models are performed by different machine learning methodologies. is generated, the steps of performing feature extraction and pre-processing on the learning URL data, performing the machine learning using the learning URL data on which the feature extraction and pre-processing processes have been completed, and the machine learning It may include generating the plurality of models through the and verifying the performance of each of the models.

As an embodiment, the step of performing feature extraction and preprocessing on the URL data for training may include extracting URL data, URL content data, and URL host data as feature data from the URL data for training. .

In an embodiment, the extracting of URL data, URL content data, and URL host data as feature data from the URL data for training includes extracting each of the internal URL and the external URL included in the URL access page as the URL data. may include.

As an embodiment, the performing of the machine learning using the URL data for learning on which the feature extraction and pre-processing has been completed may include machine learning based on different machine learning methodologies according to the type of feature data extracted from the URL data for learning. It may include the step of performing

As an embodiment, performing machine learning based on different machine learning methodologies according to the type of feature data extracted from the URL data for learning may include CNN or logistic regression (Logistic Regression) when the type of feature data is URL data. Regression) may include performing machine learning based on the algorithm.

As an embodiment, the generating the plurality of models through machine learning and verifying the performance of each of the models may include measuring the accuracy of each of the models as a performance value of each of the generated models. , and determining a weight of each of the models using the measured accuracy.

As an embodiment, the step of inputting the feature data of the prediction target URL into the plurality of generated models and outputting prediction results by each of the models includes: performing feature extraction and pre-processing on the prediction target URL , inputting the feature data of the prediction target URL on which the feature extraction and pre-processing has been completed to each of the generated models, and outputting a prediction result on whether or not a malicious URL is from each model. have.

As an embodiment, predicting whether the prediction target URL is a malicious URL by applying the performance value of each model to the prediction result of each model includes the accuracy of each model measured when the plurality of models are generated and the obtaining each weight calculated using the accuracy, calculating each weighted average value when the prediction result of the model is malignant or normal using the respective weights, and based on each weighted average value The method may include determining whether the prediction target URL is a malicious URL.

In an embodiment, inquiring external data related to at least one risk factor using the prediction target URL, calculating a risk score using the inquiry result of each risk factor, predicting whether the URL is malicious The method may further include calculating a degree of risk by reflecting the risk score in a result, and outputting a prediction result of the prediction target URL based on the degree of risk.

In order to solve the above technical problem, a multi-machine learning-based malicious URL prediction apparatus according to an embodiment of the present invention includes one or more processors, a communication interface for communicating with an external device, and a computer program executed by the processor. ) comprising a memory, and a storage for storing the computer program, wherein the computer program generates a plurality of models by performing machine learning using URL data for learning, and outputs a performance value of each of the plurality of models, The plurality of models are generated by different machine learning methodologies; and instructions for performing an operation of predicting whether the prediction target URL is a malicious URL by applying the performance value of each model to the prediction result of each model.

As an embodiment, a plurality of models are generated by performing machine learning using the URL data for learning, and a performance value of each of the plurality of models is outputted, but the plurality of models are performed by different machine learning methodologies. The generated operation includes: performing feature extraction and pre-processing on the learning URL data, performing the machine learning using the learning URL data on which the feature extraction and pre-processing processes have been completed, and the machine learning It may include generating the plurality of models through , and verifying the performance of each of the models.

As an embodiment, performing feature extraction and preprocessing on the URL data for training may include extracting URL data, URL content data, and URL host data as feature data from the URL data for training. .

As an embodiment, the operation of performing the machine learning using the URL data for learning on which the feature extraction and preprocessing has been completed may include machine learning based on different machine learning methodologies according to the type of feature data extracted from the URL data for learning. may include an operation to perform

As an embodiment, the operation of generating the plurality of models through machine learning and verifying the performance of each model is an operation of measuring the accuracy of each model as a performance value of each of the generated models , and determining a weight of each of the models using the measured accuracy. In this case, as the performance value of each model, F1-score, recall, precision, etc. may be used instead of accuracy of each model.

As an embodiment, the operation of applying the performance value of each model to the prediction result of each model to predict whether the prediction target URL is a malicious URL includes the accuracy of each model measured when the plurality of models are generated and Acquiring each weight calculated using the accuracy, calculating each weighted average value when the prediction result of the model is malicious or normal using the respective weights, and based on each weighted average value The method may include determining whether the prediction target URL is a malicious URL.

In one embodiment, the computer program includes an operation of inquiring external data related to at least one risk factor using the prediction target URL, an operation of calculating a risk score using the inquiry result of each risk factor, and the malicious The method may further include instructions for calculating a risk by reflecting the risk score to a result of predicting whether or not it is a URL, and outputting a prediction result of the prediction target URL based on the risk.

1 is a conceptual diagram according to an embodiment of the present invention.
2 is a block diagram illustrating the configuration of a multi-machine learning-based malicious URL prediction apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a method for predicting a malicious URL based on multiple machine learning according to another embodiment of the present invention.
4 is an example illustrating a learning process using URL data for learning according to some embodiments of the present invention.
5 is an example illustrating a prediction process for a prediction target URL according to some embodiments of the present invention.
6 is an example of outputting a final prediction result by the prediction process and risk assessment according to some embodiments of the present invention.
7 is an example of applying a performance value of each model to a prediction result of each of a plurality of models generated based on multi-machine learning according to some embodiments of the present invention.
8 is an example illustrating a risk assessment process of a prediction target URL according to some embodiments of the present invention.
9 is an example showing main feature data extracted from a URL according to some embodiments of the present invention.
10 is a hardware configuration diagram of an exemplary computing device that may implement methods according to some embodiments of the present invention.

Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. Advantages and features of the present disclosure and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the technical spirit of the present disclosure is not limited to the following embodiments, but may be implemented in various different forms, and only the following embodiments complete the technical spirit of the present disclosure, and in the technical field to which the present disclosure belongs It is provided to fully inform those of ordinary skill in the scope of the present disclosure, and the technical spirit of the present disclosure is only defined by the scope of the claims.

In adding reference numerals to the components of each drawing, it should be noted that the same components are given the same reference numerals as much as possible even though they are indicated on different drawings. In addition, in describing the present disclosure, if it is determined that a detailed description of a related known configuration or function may obscure the gist of the present disclosure, the detailed description thereof will be omitted.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which this disclosure belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular. The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present disclosure. In this specification, the singular also includes the plural, unless specifically stated otherwise in the phrase.

In addition, in describing the components of the present disclosure, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the elements from other elements, and the essence, order, or order of the elements are not limited by the terms. When it is described that a component is “connected”, “coupled” or “connected” to another component, the component may be directly connected or connected to the other component, but another component is between each component. It should be understood that elements may be “connected,” “coupled,” or “connected.”

As used herein, "comprises" and/or "comprising" refers to the presence of one or more other components, steps, operations and/or elements mentioned. or addition is not excluded.

Hereinafter, some embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram according to an embodiment of the present invention. Referring to FIG. 1 , a multi-machine learning-based malicious URL prediction apparatus 1 according to an embodiment of the present invention consists of a learning unit 11 and a prediction unit 12, and is trained using URL data 101 for learning. A prediction result for the prediction target URL 103 may be obtained based on a plurality of machine learning models obtained after performing .

In the illustrated example, when URL data 101 for learning is input to the learning unit 11 , a plurality of machine learning models 102 that are output after performing machine learning in the learning unit 11 are obtained. At this time, the plurality of output machine learning models 102 are transmitted to the prediction unit 12 .

When the prediction target URL 103 is input to the prediction unit 12, each prediction result is generated using the plurality of machine learning models 102 transmitted from the learning unit 11, and each prediction result is used to A prediction result 104 of whether the prediction target URL is a malicious URL is output from the prediction unit 12 .

According to the embodiment of the present invention as described above, it is possible to provide a method for predicting whether a malicious URL is malicious even when there is no signature information on the malicious URL. In addition, it is possible to provide prediction results with improved accuracy by learning different machine learning algorithms according to the characteristics of data to be analyzed for malicious URLs.

2 is a block diagram illustrating the configuration of a multi-machine learning-based malicious URL prediction apparatus according to an embodiment of the present invention. 2 , the multi-machine learning-based malicious URL prediction apparatus 1 according to an embodiment of the present invention includes a learning unit 11 and a prediction unit 12, an external server 20, a data storage unit ( 30), and the user terminal 10 may be connected through a network. The multi-machine learning-based malicious URL prediction apparatus 1 processes a request for generating and analyzing a machine learning model for predicting a malicious URL received from the user terminal 10, and provides the result.

The external server 20 is a web server of a site that provides open source information of malicious URLs, and malicious URL data for learning can be obtained therefrom.

The learning unit 11 is composed of a collection module 111 , a preprocessing module 112 , and a learning module 113 , and uses malicious URL open source information provided from the external server 20 to collect malicious URL data for learning. It collects and uses it to output a plurality of models generated through machine learning.

The collection module 111 collects malicious URL data for learning by using the open source information of the malicious URL provided from the external server 20 , and stores it in the network-connected data storage unit 30 . For example, the collection module 111 may automatically obtain malicious URL data for learning by crawling the web site of the external server 20 .

The pre-processing module 112 reads malicious URL data for learning stored in the data storage unit 30 , extracts feature data from the malicious URL data for learning, and converts the extracted feature data into a form capable of machine learning.

As an embodiment, the preprocessing module 112 may extract characteristic data according to an analysis target from malicious URL data for learning. For example, an analysis target is defined as a character pattern of a URL, a response web content of a URL, and a response host of a URL, and as characteristic data corresponding to each analysis target, for example, URL data, URL content data, and URL host data can be extracted. have. In this case, the URL data is used to analyze character patterns and syntax constituting the URL, and the URL content data can be used to analyze internal content such as HTML source code and scripts in a response page received by accessing the URL. Also, the URL host data may be used to analyze network data such as a port scan result received by accessing the URL.

For example, as shown in FIG. 9 , the feature data 90 extracted from malicious URL data for learning may include various features such as URL-based features, HTML/JS-based features, domain-based features, and abnormal features. .

As an embodiment, the preprocessing module 112 converts the extracted feature data into vector format data to enable machine learning. In this case, a text embedding operation for converting data in a vector format may be performed. As the text embedding model, a word or sentence-based model such as Word2Vec, FastText, Glove, Sent2Vec, and Elmo may be applied.

The learning module 113 performs machine learning by using the URL data for learning on which the extraction and preprocessing of the feature data have been completed in the preprocessing module 112 , and generates a plurality of machine learning models therefrom.

As an embodiment, the learning module 113 may learn based on a plurality of different machine learning algorithms using URL data for learning, and may generate a plurality of models by each algorithm through learning. At this time, as a plurality of different machine learning algorithms used for learning, for example, a support vector machine (SVM), a random forest (RF), boosting, and a decision tree. , logistic regression (LR), convolutional neural network (CNN), recurrent neural network (RNN), etc. may be used.

The prediction unit 12 is composed of an input module 121 , a preprocessing module 122 , and a prediction module 123 , and is a prediction target using prediction target URL data input from the user terminal 10 or provided from an external device. Output the prediction result for the URL.

The input module 121 receives prediction target URL data provided from the user terminal 10 or an external device. In this case, the prediction target URL data may include one URL or a list of URLs.

The preprocessing module 122 extracts feature data from the prediction target URL data input from the input module 121 and converts the extracted feature data into a predictable form based on the machine learning model. At this time, the process of extracting and transforming the features of the prediction target URL data is the same as the process performed in the pre-processing module 112 of the learning unit 11 .

As an embodiment, the preprocessing module 122 may extract feature data according to the analysis target from the prediction target URL data. For example, an analysis target is defined as a character pattern of a URL, a response web content of a URL, and a response host of a URL, and as characteristic data corresponding to each analysis target, for example, URL data, URL content data, and URL host data can be extracted. have.

Here, the URL data may include a pure URL in which duplicate elements such as a protocol and a third-level domain are removed. The URL content data may include characteristics such as HTML length in the response HTML content. The URL host data may include characteristics such as the port status of the host machine.

For example, as shown in FIG. 9 , the feature data 90 extracted from the prediction target URL data may include various features such as a URL-based feature, an HTML/JS-based feature, a domain-based feature, and an abnormal feature. .

As an embodiment, the pre-processing module 122 accesses each URL of the prediction target URL data, extracts each of the internal URL and the external URL included in the received response page, and extracts feature data from the extracted internal URL and external URL You may.

As an embodiment, the preprocessing module 122 may convert and normalize the extracted feature data into vector-type data in a form predictable based on a machine learning model.

The prediction module 123 loads each of the plurality of machine learning models generated by the learning module 113, and uses each loaded machine learning model to predict whether the prediction target URL is a malicious URL or a normal URL. create

In addition, the prediction module 123 outputs a final prediction result by using an ensemble technique that applies a performance value of each model to each prediction result generated using each machine learning model.

As an embodiment, the prediction module 123 loads the performance values of each of the plurality of machine learning models generated by the learning module 113 . Here, the performance value of each machine learning model may include information about a weight given using the accuracy of each model output through machine learning.

As an embodiment, the prediction module 123 outputs a final prediction result regarding whether the prediction target URL is a malicious URL by applying information about the performance value of each loaded model, that is, the weight, to the prediction result of each model. can do.

3 is a flowchart illustrating a method for predicting a malicious URL based on multiple machine learning according to another embodiment of the present invention.

The multi-machine learning-based malicious URL prediction method according to the present embodiment may be executed by the computing device 100 , for example, by the multi-machine learning-based malicious URL prediction device 1 . The computing device 100 executing the method according to the present embodiment may be a computing device having an application program execution environment. Note that the description of the subject performing some operations included in the method according to the present embodiment may be omitted, and in this case, the subject is the computing device 100 .

Referring to FIG. 3 , first, in operation S31 , a plurality of models are generated by performing machine learning using URL data for learning, and performance values of each of the plurality of models are output. Here, the plurality of models may be generated by different machine learning methodologies. For example, as different machine learning methodologies, such as support vector machine (SVM), random forest (RF), boosting, decision tree, logistic regression (LR) regression), a convolutional neural network (CNN), and a recurrent neural network (RNN) may be used.

As an embodiment, the operation S31 includes an operation in which feature extraction and pre-processing are performed on the URL data for learning, an operation in which machine learning is performed using the URL data for learning in which the feature extraction and pre-processing is completed, and a plurality of machine learning methods. It may include an operation in which a model is generated and the performance of each model is verified.

As an embodiment, the operation of performing feature extraction and preprocessing on the URL data for training may include extracting URL data, URL content data, and URL host data as feature data from the URL data for training. In this case, each of the internal URL and the external URL included in the URL access page may be extracted as URL data.

As an embodiment, the operation in which machine learning is performed using the URL data for learning on which the feature extraction and pre-processing has been completed, machine learning based on different machine learning methodologies is performed according to the type of feature data extracted from the URL data for learning. It can include actions. For example, when the type of feature data is URL data, machine learning may be performed based on an algorithm such as CNN or logistic regression. As another example, when the type of feature data is URL content data, machine learning may be performed based on algorithms such as SVM, random forest, boosting, and decision tree.

As an embodiment, an operation in which a plurality of models are generated through machine learning and the performance of each model is verified includes an operation in which the accuracy of each model is measured as a performance value of each of the generated models, and the measured accuracy It may include an operation in which the weight of each model is determined using . In this case, as the performance value of each model, F1-score, recall, precision, etc. may be used instead of accuracy of each model.

Here, the weight of each model may be calculated by calculating an average value of each accuracy and using an average deviation calculated as a difference between each accuracy and the average value.

Next, in operation S32, the feature data of the prediction target URL is input to the generated plurality of models, and prediction results by each of the models are output.

As an embodiment, operation S32 includes an operation in which feature extraction and pre-processing for the prediction target URL are performed, an operation in which feature data of the prediction target URL on which the feature extraction and pre-processing has been completed, is input to each of a plurality of generated models, and It may include an operation of outputting a prediction result of whether a malicious URL is a malicious URL from each model.

Finally, in operation S33, it is predicted whether the prediction target URL is a malicious URL by applying the performance value of each model to the prediction result of each model.

As an embodiment, operation S33 is an operation in which each weight calculated using the accuracy and accuracy of each model measured when generating a plurality of models is obtained, and when the prediction result of the model using each weight is malicious or normal It may include an operation of calculating each weighted average value, and an operation of determining whether the prediction target URL is a malicious URL based on each weighted average value.

As an embodiment, the method determines whether external data related to at least one risk factor is inquired using a prediction target URL, a risk score is calculated using the query result of each risk factor, and whether the URL is a malicious URL. The method may further include calculating the risk by reflecting the risk score in the predicted result, and outputting the prediction result of the prediction target URL based on the risk.

As described above, according to the multi-machine learning-based malicious URL prediction method according to an embodiment of the present invention, it is possible to predict whether a malicious URL is malicious even when there is no previously input signature information for the malicious URL. In addition, it is possible to provide prediction results with improved accuracy by learning different machine learning algorithms according to the characteristics of data to be analyzed for malicious URLs.

4 is an example illustrating a learning process using URL data for learning according to some embodiments of the present invention. Referring to FIG. 4 , the learning unit 11 of the multi-machine learning-based malicious URL prediction learning apparatus 1 according to an embodiment of the present invention includes a collection module 111 , a preprocessing module 112 , and a learning module 113 . The learning process is performed by performing the operation of the sub-modules included in each.

In the illustrated configuration, the collection module 111 includes a URL automatic collection sub-module 1111, and the URL automatic collection sub-module 1111 is a learning URL from public source information 1011 of a malicious URL provided from an external website. Data is automatically collected and stored in the data storage unit 30 . In this case, the URL automatic collection sub-module 1111 may automatically collect URL data for learning, for example, by crawling an external web site that provides a malicious URL.

The preprocessing module 112 includes a feature extraction submodule 1121 and a feature data preprocessing submodule 1122 . The feature extraction sub-module 1121 loads the malicious URL data for learning stored in the data storage unit 30 , extracts the feature data, and transmits it to the feature data pre-processing sub-module 1122 .

As an embodiment, the feature extraction sub-module 1121 may extract feature data according to an analysis target from malicious URL data for learning. In this case, as the feature data, for example, URL data, URL content data, and URL host data may be extracted. Here, the URL data is used to analyze character patterns and syntax constituting the URL, and the URL content data can be used to analyze internal content such as HTML source code and scripts in a response page received by accessing the URL. Also, the URL host data may be used to analyze network data such as a port scan result received by accessing the URL.

The feature data pre-processing sub-module 1122 converts the feature data transmitted from the feature extraction sub-module 1121 into vector-format data to enable machine learning, and transmits it to the learning module 113 .

The learning module 113 includes a machine learning submodule 1131 and a model validation submodule 1132 . The machine learning submodule 1131 performs machine learning using the URL data for learning transmitted from the feature data preprocessing submodule 1122 , and generates a plurality of machine learning models therefrom.

As an embodiment, the machine learning submodule 1131 may learn based on a plurality of different machine learning algorithms using the URL data for learning, and may generate a plurality of models by each algorithm through learning. At this time, each of the plurality of models, for example, support vector machine (SVM), random forest (RF), boosting (boosting), decision tree (decision tree), logistic regression (LR: logistic regression) ), a convolutional neural network (CNN), and a recurrent neural network (RNN) may be generated using a machine learning algorithm.

The model verification submodule 1132 evaluates the performance of each of the plurality of models generated by the machine learning submodule 1131 . In this case, the performance of each model is evaluated using, for example, a holdout method, a k-fold method, and the like, and the accuracy of each model can be calculated therefrom.

As an embodiment, the model verification sub-module 1132 may determine a weight for each model by using the calculated accuracy of each model. For example, the weight of each model may be calculated by calculating an average value of each accuracy and using a mean deviation calculated as a difference between each accuracy and the average value.

When the generation of the plurality of models and the performance evaluation of each model are completed in the learning module 113 as described above, the generated models 102 and the weights of each of the models may be output.

5 is an example illustrating a prediction process for a prediction target URL according to some embodiments of the present invention. Referring to FIG. 5 , the prediction unit 12 of the multi-machine learning-based malicious URL prediction learning apparatus 1 according to an embodiment of the present invention includes an input module 121 , a preprocessing module 122 , and a prediction module 123 . The learning process is performed by performing the operation of the sub-modules included in each.

In the illustrated configuration, the input module 121 includes a relative/absolute URL link extraction sub-module 1211, and the relative/absolute URL link extraction sub-module 1211 includes a prediction provided from the user terminal 10 or an external device. When target URL data is input, a response page may be received through a request of each URL of the prediction target URL data, and internal and external URLs included in the response page may be extracted as relative and absolute URLs. Accordingly, the relative/absolute URL link extraction submodule 1211 transmits the input prediction target URL data and the extracted relative/absolute URL to the preprocessing module 122 .

The preprocessing module 122 includes a feature extraction submodule 1221 and a feature data preprocessing submodule 1222 . The feature extraction submodule 1221 extracts the feature data from the prediction target URL data and the relative/absolute URL transmitted from the relative/absolute URL link extraction submodule 1211 , and then transmits the extracted feature data to the feature data preprocessing submodule 1222 .

As an embodiment, the feature extraction submodule 1221 may extract feature data according to the analysis target from the prediction target URL data and the relative/absolute URL. In this case, as the feature data, for example, URL data, URL content data, and URL host data may be extracted. Here, the URL data may include a pure URL in which duplicate elements such as a protocol and a third-level domain are removed. The URL content data may include characteristics such as HTML length in the response HTML content. The URL host data may include characteristics such as the port status of the host machine.

The feature data pre-processing sub-module 1222 converts the feature data transmitted from the feature extraction sub-module 1221 into vector-format data to enable machine learning, and transmits it to the prediction module 123 .

The prediction module 123 includes a prediction sub-module 1231 and an ensemble sub-module 1232 . The prediction sub-module 1231 loads the plurality of machine learning models 102 generated by the learning module 113, and each model loaded using the feature data of the prediction target URL data transmitted from the pre-processing module 122. Each prediction result is generated and transmitted to the ensemble sub-model 1232 . In this case, each prediction result includes a result of predicting whether the prediction target URL is malicious or normal using each model.

The ensemble sub-model 1232 outputs a final prediction result 104 by using an ensemble technique of applying a performance value of each model to each prediction result generated using each model.

As an embodiment, the ensemble sub-model 1232 loads the performance values of each of the plurality of models generated by the learning module 113 . Here, each performance figure may include information about a weight given using the accuracy of each model output through machine learning.

As an embodiment, the ensemble sub-model 1232 applies the performance value of each model, that is, information about the weight, to the prediction result of each model. can be printed out.

According to the embodiment of the present invention as described above, by reflecting the performance of each model in the prediction result of each of a plurality of models generated by learning different machine learning algorithms according to the characteristics of the data to be analyzed of the malicious URL, It is possible to provide a prediction result with improved accuracy.

6 is an example of outputting a final prediction result by the prediction process and risk assessment according to some embodiments of the present invention. Referring to FIG. 6 , an example of outputting a result of predicting whether a URL is a malicious URL or a normal URL by inputting a prediction target URL according to a method according to an embodiment of the present invention is shown.

First, when a prediction target URL is input in operation S60, a relative/absolute URL link to the prediction target URL is extracted in operation S61. Here, in operation S61, the input prediction target URL 611 and the internal URL 612 and external URL 613 included in the connection page of the prediction target URL 611 are extracted as relative/absolute URL links. It can include actions.

Next, in operation S62, feature data is extracted from the prediction target URL 611, internal URL 612, and external URL 613 extracted in operation S61, and preprocessing is performed in a form capable of performing machine learning. .

Next, in operation S631, the prediction target URL 611 that has been preprocessed in operation S62 is input to a plurality of machine learning models to predict whether or not the URL is malicious.

In operation S632, the internal URL 612 and the external URL 613, which have been pre-processed by operation S62, are input to the logistic regression and CNN model to predict whether or not the URL is malicious.

Next, in operation S64, an integrated prediction result is output using an ensemble technique in which the performance of each model is reflected in each of the results predicted in operations S631 and S632. Here, the ensemble technique applies a weight calculated using the accuracy of each model to the prediction result of each of a plurality of models, and calculates a weighted average value for each prediction result in a case of a normal URL and a case of a malicious URL. can be predicted

In operation S65, the degree of risk with respect to the prediction target URL 611, the internal URL 612, and the external URL 613 is evaluated. Here, the degree of risk may be calculated by inquiring a risk factor for each URL 611 , 612 , and 613 , calculating a risk score, and reflecting this on the prediction result by operation S64 .

Finally, in operation S66, by additionally reflecting the risk calculated in operation S65 to the prediction result in operation S64, a final prediction result as to whether the prediction target URL is malicious or normal is output.

7 is an example of applying a performance value of each model to a prediction result of each of a plurality of models generated based on multi-machine learning according to some embodiments of the present invention. Referring to FIG. 7 , an example of integrating results predicted by using each of a plurality of machine learning models in the ensemble sub-module 1232 using an ensemble technique is shown.

In the illustrated example, whether the URL is a malicious or normal URL 72 is output as each prediction result 71 by a plurality of machine learning models in the prediction sub-module 1231 .

The ensemble sub-module 1232 loads the accuracy 74 of each of the plurality of models 73 generated by the learning module 113 and the weight 753 of each model calculated using the accuracy 74 . At this time, the weight 753 of each model calculates the average value 751 of each accuracy 74 , and the average deviation 752 is calculated as the difference between each accuracy 74 and the average value 751 . can be calculated using

The ensemble sub-module 1232 determines whether a malicious URL or a normal URL 72 is input as each prediction result 71 by a plurality of machine learning models, respectively, when predicted as a malicious URL and when predicted as a normal URL. A weighted average value 76 is calculated for . For example, since the weighted average value 77 when predicted as a malicious URL is 67.68 and the weighted average value 77 when predicted as a normal URL is 58.8867, the malicious URL 78 having a larger value is used as the final prediction result. can be printed out.

As an embodiment, the final prediction result output from the ensemble sub-module 1232 may be transmitted to the risk evaluation module 80 to generate a result in which risk factors for the prediction target URL are additionally reflected.

* FIG. 8 is an example illustrating a risk assessment process of a prediction target URL according to some embodiments of the present invention. Referring to FIG. 8 , the multi-machine learning-based malicious URL prediction apparatus 1 according to an embodiment of the present invention further includes a risk assessment module 80 in addition to the configuration of the learning unit 11 and the prediction unit 12 . can do.

The risk evaluation module 80 may additionally evaluate the risk with respect to the prediction result 78 output from the ensemble sub-module 1232 of FIG. 7 and reflect it in the final prediction result.

As an embodiment, the risk assessment module 80 may inquire the risk factor 81 for the prediction target URL. Here, the risk factor 81 uses the prediction target URL to retrieve external or internal data queried using, for example, the Alex rank inquiry module, the black list inquiry module, the Virus Total inquiry module, the past malicious code distribution history inquiry module, etc. may include

The risk assessment module 80 calculates the risk score 83 using the table 82 for calculating the risk score using the inquiry result of each risk factor 81 , and outputs it from the ensemble sub-module 1232 . The risk 84 may be calculated by reflecting the prediction result 78 . For example, the risk level 84 may be calculated as the sum of the weighted average value of 67.68 of the malicious URL output as the prediction result 78 and 14 calculated as the risk score 83 .

As described above, the risk assessment module 80 may calculate the risk for each of the input prediction target URLs, and output the prediction result of the prediction target URL using the calculation. That is, it is possible to obtain the final prediction result of whether the URL is malicious by using the risk 84 calculated by additionally considering the risk factor 81 for the prediction target URL. As an embodiment, information on the risk level calculated by the risk assessment module 80 may be stored and managed in the data storage unit 30 .

10 is a hardware configuration diagram of an exemplary computing device that may implement methods according to some embodiments of the present invention. As shown in FIG. 10 , the computing device 100 loads one or more processors 101 , a bus 107 , a network interface 102 , and a computer program 105 executed by the processor 101 . It may include a memory 103 and a storage 104 for storing the computer program (105). However, only the components related to the embodiment of the present invention are illustrated in FIG. 10 . Accordingly, one of ordinary skill in the art to which the present invention pertains can see that other general-purpose components other than those shown in FIG. 10 may be further included.

The processor 101 controls the overall operation of each component of the computing device 100 . The processor 101 includes at least one of a central processing unit (CPU), a micro processor unit (MPU), a micro controller unit (MCU), a graphic processing unit (GPU), or any type of processor well known in the art. may be included. In addition, the processor 101 may perform an operation on at least one application or program for executing the method/operation according to various embodiments of the present disclosure. The computing device 100 may include one or more processors.

The memory 103 stores various data, commands and/or information. Memory 103 may load one or more programs 105 from storage 104 to execute methods/operations according to various embodiments of the present invention. For example, if the computer program 105 is loaded into the memory 103 , logic (or modules) may be implemented on the memory 103 . An example of the memory 103 may be a RAM, but is not limited thereto.

The bus 107 provides communication functions between the components of the computing device 100 . The bus 107 may be implemented as various types of buses, such as an address bus, a data bus, and a control bus.

The network interface 102 supports wired/wireless Internet communication of the computing device 100 . The network interface 102 may support various communication methods other than Internet communication. To this end, the network interface 102 may be configured to include a communication module well known in the art.

The storage 104 may store one or more computer programs 105 non-transitory. The storage 104 may include a non-volatile memory such as a flash memory, a hard disk, a removable disk, or any type of computer-readable recording medium well known in the art.

The computer program 105 may include one or more instructions in which methods/operations according to various embodiments of the present invention are implemented. When the computer program 105 is loaded into the memory 103 , the processor 101 may execute the one or more instructions to perform methods/operations according to various embodiments of the present invention.

For example, the computer program 105 performs machine learning using URL data for learning to generate a plurality of models, and outputs a performance value of each of the plurality of models, but the plurality of models use different machine learning methodologies ( methodology) generated by the operation, the operation of inputting the characteristic data of the prediction target URL into the plurality of generated models and outputting the prediction results by each of the models, and the performance figures of each of the models for each of the models may include instructions for performing an operation of predicting whether the prediction target URL is a malicious URL by applying to the prediction result of .

So far, various embodiments of the present invention and effects according to the embodiments have been described with reference to FIGS. 1 to 10 . Effects according to the technical spirit of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

The technical ideas of the present invention described so far may be implemented as computer-readable codes on a computer-readable medium. The computer-readable recording medium may be, for example, a removable recording medium (CD, DVD, Blu-ray disk, USB storage device, removable hard disk) or a fixed recording medium (ROM, RAM, computer-equipped hard disk). can The computer program recorded in the computer-readable recording medium may be transmitted to another computing device through a network such as the Internet and installed in the other computing device, thereby being used in the other computing device.

In the above, even though all the components constituting the embodiment of the present invention are described as being combined or operating in combination, the technical spirit of the present invention is not necessarily limited to this embodiment. That is, within the scope of the object of the present invention, all of the components may operate by selectively combining one or more.

Although acts are shown in a particular order in the drawings, it should not be understood that the acts must be performed in the specific order or sequential order shown, or that all depicted acts must be performed to obtain a desired result. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of the various components in the embodiments described above should not be construed as necessarily requiring such separation, and the program components and systems described may generally be integrated together into a single software product or packaged into multiple software products. It should be understood that there is

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those of ordinary skill in the art to which the present invention pertains can practice the present invention in other specific forms without changing the technical spirit or essential features. can understand that there is Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the technical ideas defined by the present invention.

Claims (7)

A method performed by a computing device, comprising:
inputting a prediction target URL into a plurality of models, and outputting prediction results by each of the models and a performance value of each of the models;
calculating a weight of each of the models by using the performance values of each of the plurality of models;
calculating each weighted average value when the prediction result of the model is malignant or normal using the weights of each of the models; and
Predicting whether the prediction target URL is a malicious URL based on the respective weighted average values;
The plurality of models are generated by performing a plurality of different machine learning using learning data constructed using URL data extracted from the collected URLs, URL content data, and URL host data,
A multi-machine learning-based malicious URL prediction method. The method of claim 1,
The URL data includes an internal URL and an external URL included in the access page of the collected URL,
A multi-machine learning-based malicious URL prediction method. The method of claim 1,
In the case of URL data among the learning data, to perform machine learning based on CNN or logistic regression algorithm,
A multi-machine learning-based malicious URL prediction method. The method of claim 1,
Calculating the weights of each of the models by using the performance values of each of the plurality of models includes:
acquiring the accuracy of each of the models as a performance value of each of the models; and
Comprising the step of calculating the weight of each model using the accuracy of each model,
A multi-machine learning-based malicious URL prediction method. delete The method of claim 1,
inquiring external data related to at least one risk factor using the prediction target URL;
calculating a risk score by using the inquiry result of each risk factor;
calculating a risk level by reflecting the risk score in a result of predicting whether the URL is malicious; and
Further comprising the step of giving a search priority of the prediction target URL based on the risk,
A multi-machine learning-based malicious URL prediction method. one or more processors;
a communication interface for communicating with an external device;
a memory for loading a computer program executed by the processor; and
a storage for storing the computer program;
The computer program is
Inputting the prediction target URL to each of a plurality of models,
an operation of outputting a prediction result by each of the models and a performance value of each of the models;
calculating a weight of each of the models by using the performance values of each of the plurality of models;
calculating each weighted average value when the prediction result of the model is malicious or normal using the weights of each model; and
and instructions for performing an operation of predicting whether the prediction target URL is a malicious URL based on the respective weighted average values;
The plurality of models are generated by performing a plurality of different machine learning using learning data constructed using URL data extracted from the collected URLs, URL content data, and URL host data,
Multi-machine learning-based malicious URL prediction device.

Images