Using supervised machine learning algorithms to detect suspicious URLs in online social networks

As large amounts of finance-related microblogs, posted by both professional and amateur investors, are mingling in online social networks that could bring impact to real financial markets, it's an essential task to analyze financial texts posted by different users. Besides that, as barely nobody could be an all-round expert in various financial products such as stocks, futures and bonds, topic preferences of different users should also be considered in these mining tasks. That is to say, financial text contents should be analyzed in both user and topic level. In recent advances of deep learning technology, learning the representation of contents is a state-of-art method in financial text mining over hand-crafted feature extraction techniques. Along this line, in this paper we propose a hybrid embedding method that both the representation of users and the representation of financial topics are learned from the posted finance-related contents in online social networks. Following the commonly used methods in embedding-related researches, we apply extensive experiments with real-world datasets to show the effectiveness of our hybrid user and topic embedding (UTE) approach, in both intrinsic and extrinsic ways. It's shown that our approach can intrinsically distinguish social network users with their learned embeddings, so they can be grouped into human-explainable clusters. Moreover, we also propose a case study on sentiment analysis by applying our user and topic hybrid embedding with a deep contextual neural network architecture. The results prove that our approach outperforms other baseline methods in financial-related sentiment analysis, and hopefully for other downstream text mining tasks as well.

Currently, the risk of network information insecurity is increasing rapidly in number and level of danger. The methods mostly used by hackers today is to attack end-to-end technology and exploit human vulnerabilities. These techniques include social engineering, phishing, pharming, etc. One of the steps in conducting these attacks is to deceive users with malicious Uniform Resource Locators (URLs). As a results, malicious URL detection is of great interest nowadays. There have been several scientific studies showing a number of methods to detect malicious URLs based on machine learning and deep learning techniques. In this paper, we propose a malicious URL detection method using machine learning techniques based on our proposed URL behaviors and attributes. Moreover, bigdata technology is also exploited to improve the capability of detection malicious URLs based on abnormal behaviors. In short, the proposed detection system consists of a new set of URLs features and behaviors, a machine learning algorithm, and a bigdata technology. The experimental results show that the proposed URL attributes and behavior can help improve the ability to detect malicious URL significantly. This is suggested that the proposed system may be considered as an optimized and friendly used solution for malicious URL detection.

As cybercrimes grow in scale with devastating economic costs, it is important to protect potential victims against diverse attacks. It is the uniform resource locators (URLs) that connect vulnerable users with potential attacks. Although numerous solutions (e.g., rule-based solutions and machine learning-based methods) are proposed for malicious URL detection, they can not provide robust performance due to the diversity of cybercrimes and can not cope with the explosive growth of malicious URLs with the evolution of obfuscation strategies. In this paper, we propose a deep learning-based system, dubbed as CyberLen, to detect malicious URLs robustly and effectively. Specifically, we use factorization machine (FM) to learn the latent interaction among lexical features. For the deep structural features, position embedding is introduced for token vectorization to reduce the ambiguity of URL tokens. Meanwhile, temporal convolution network (TCN) is utilized to learn the long-distance dependency among URL tokens. To fuse heterogeneous features, self-paced wide & deep learning strategy is proposed to train a robust model effectively. The proposed solution is evaluated on a large-scale URL dataset. Our experimental results show that position embedding is constructive to reducing the ambiguity of URL tokens, and the self-paced wide & deep learning strategy shows superior performance in terms of F1 score and convergence speed.

Thanks to online social networks services such as Facebook, Twitter, YouTube, etc.…, users have the opportunity to communicate easily without constraints by providing them with free and open platforms. Because of their crucial role in spreading information between users, these platforms have become an integral part of everyday life. Privacy and security are major concerns for many social media users. When users share information (such as data, photos etc.…) with their friends, they are not always safe; they can make their friends easy targets attacked by malicious users who try with multiple methods to access their personal data. Unfortunately, with the continued expansion of a user’s social network, privacy settings alone are often insufficient to protect the user’s profile. In this paper, we have proposed a new approach to limit the spread and dissemination of spam content and malicious profiles in social networks. In another way, prohibit the creation of malicious profiles by automated robots as well as the falsification of identity when publishing spam content in social networks. Given that when using online social networking services, users trust them to process their information; have seen that it is necessary not to neglect this part; but rather to make a set of changes that will be consistent with our proposal to strengthen the protection of personal data of users of these platforms.

A Point Process Framework for Predicting Popularity of Content in Online Social Networks

In recent years cyberattacks have become destructive and targeted. With technological advancements, diverse threats are launching in a sophisticated way that targets people to defraud them. Many web applications have been struggling to improve the reliability and security of their platforms to protect users from fraud, revenue, or malware. These attacks use malicious uniform resource locators (URLs) to attack web users. These URLs host unwanted content in the form of junk emails, phishing, or unauthorized drive-by downloads. Unsuspecting people click these phishing URLs and become victims of unethical anonymous activities like identity theft (personal or financial details) and installation of viruses. Therefore, it is necessary to detect malicious URLs accurately for resolving security issues. Traditional protection method, such as blacklisting, remains a classical technique for the detection of malicious URLs due to its simplicity but cannot detect unknown malicious URLs; hence, machine learning approaches are being used for achieving better results. This chapter aims to provide a structural understanding of popular feature extraction techniques and machine learning algorithms.KeywordsMalicious URLFeature extractionBlacklistingMachine learning

The authors study the relationship between the spread of content and the bias and quality of such content using a bounded-confidence opinion model that incorporates media and nonmedia accounts with dynamic content updating. Using this model, they show how to maximize media impact in a network by tuning the number of media accounts and the number of followers per account, and they examine how this impact depends on network features.

The rapid proliferation of malicious Uniform Resource Locators (URLs) presents a serious cybersecurity threat, enabling phishing attacks, malware dissemination, and financial fraud. Conventional detection mechanisms, such as blacklisting and rule-based systems, are largely reactive and struggle to keep pace with dynamically generated and zero-day malicious URLs. Blacklisting methods fail to identify newly created threats, while rule-based approaches rely on predefined heuristics that are ineffective against evolving attack patterns. To address these limitations, this research proposes a multi-objective feature selection and XGBoost-based phishing detection framework aimed at improving classification accuracy and detection robustness. A comprehensive dataset containing both benign and malicious URLs is constructed, followed by extensive feature extraction encompassing lexical, host-based, and network-level attributes. A multi-objective optimization strategy is employed to select the most informative feature subset, reducing redundancy while enhancing model performance. The optimized feature set is then utilized to train an Extreme Gradient Boosting (XGBoost) classifier, which effectively captures complex nonlinear patterns associated with phishing URLs. Experimental evaluation demonstrates improved detection accuracy and generalization capability, enabling proactive identification of previously unseen malicious URLs. The proposed approach offers a scalable, adaptive, and efficient solution for modern phishing detection systems.

Cascaded capsule twin attentional dilated convolutional network for malicious URL detection

In the past six years, tremendous growth in the size and popularity of social networking has fundamentally changed the way to use the Internet. Online social media services like Facebook and Twitter witness an exponential increase in user activity when an event takes place in the real world. This activity is a combination of good quality content like information, personal views, opinions, comments, as well as poor quality content like rumors, spam, and other malicious contents. Although the best quality contents makes online social media a rich source of information, consumption of poor quality content can degrade the user experience and have an inappropriate impact in the real world. In this paper, we propose a new approach to detect malicious content on social networks, while using the module of filtering processes by content, to calculate the frequencies of the content entered into parameter and extract the entire contents which are similar to the chosen content to classify them in two classes {malicious content, legitimate content}. The recognition module will be the subject of performing the phase of spread that is to make the learning of malicious content already inserted in a database, the phase of back propagation is the recognition of content and their similar given by filtering by content.

In today’s world, phishing attacks are gradually increasing, resulting in individuals losing valuables, assets, personal information, etc., to unauthorized parties. In phishing, attackers craft malicious websites disguised as well-known, legitimate sites and send them to individuals to steal personal information and other related private details. Therefore, an efficient and accurate method is required to determine whether a website is malicious. Numerous methods have been proposed for detecting malicious uniform resource locators (URLs) using deep learning, machine learning, and other approaches. In this study, we have used malicious and benign URLs datasets and have proposed a detection mechanism for detecting malicious URLs using recurrent neural network models such as long short-term memory (LSTM), bidirectional long short-term memory (Bi-LSTM), and the gated recurrent unit (GRU). Experimental results have shown that the proposed mechanism achieved an accuracy of 97.0% for LSTM, 99.0% for Bi-LSTM, and 97.5% for GRU, respectively.

Phishing is a type of social engineering attack with an intention to steal user data, including login credentials and credit card numbers, leading to financial losses for both organizations and individuals. It occurs when an attacker, pretending as a trusted entity, lure a victim into click on a link or attachment in an email, or in a text message. Phishing is often launched via email messages or text messages over social networks. Previous research has revealed that phishing attacks can be identified just by looking at uniform resource locator (URLs). Identifying the techniques which are used by phishers to mimic a phishing URL is rather a challenging issue. At present, we have limited knowledge and understanding of how cyber‐criminals attempt to mimic URLs with the same look and feel of the legitimate ones, to entice people into clicking links. Therefore, this paper investigates the feature selection of phishing URLs (uniform resource locators), aiming to explore the strategies employed by phishers to mimic URLs that can obviously trick people into clicking links. We employed an information gain (IG) and Chi‐Squared feature selection methods in machine learning (ML) on a phishing dataset. The dataset contains a total of 48 features extracted from 5000 phishing and another 5000 legitimate URL from web pages downloaded from January to May 2015 and from May to June 2017. Our results revealed that there were 10 techniques that phishers used to mimic URLs to manipulate humans into clicking links. Identifying these phishing URL manipulation techniques would certainly help to educate individuals and organizations and keep them safe from phishing attacks. In addition, the findings of this research will also help develop anti‐phishing tools, framework or browser plugins for phishing prevention.

The impact of negative online social network content on expressed sentiment, executive function, and working memory

Social network contains large amounts of user interests and preferences which may therefore help improve techniques for information retrieval, such as user profile construction and query expansion. By the manual annotation, we find that query intention normally consists of several retrieval behaviors and a certain number of social network behaviors. This paper argues that a user's query intention has a strong correlation with the corresponding social network contents, which focuses on two aspects. First, we analyze the proportion of social network websites in users' retrieval records, and evaluate the degree of relationship between information retrieval behavior and social network behavior from a statistic perspective. Second, a similarity between the two components of query intention, retrieval content and social network content, is calculated employing a topic model to measure the correlation of them from a semantic perspective. The evaluation on a ground-truth data of retrieval records indicates that a long-term retrieval procedure is usually accompanied with accessing social network websites. More importantly, the experimental results show that more than 54% of the content from social network has a strong correlation with users' query intention.

Peer to peer and distributed systems are generally susceptible to sybil attacks. Online social networks (OSNs), due to their fat user base and open access nature are also prone to such attacks. Current state-of-art algorithms for sybil attack detection make use of the inherent social graph created among registered users of OSN service. They rely on the inherent relationship among these users. No effort is made to combine other characteristic behavior of sybil users with properties of social graph of OSNs to improve detection accuracy of sybil attacks. Sybil identities are also used as gateways for spreading spam content in OSNs [6]. The proposed approach exploits this behavior of sybil users to improve detection accuracy of existing sybil detection algorithms. In the proposed approach, content generated/published by each user is used along with the topological properties of the social graph of registered users. A machine learning model is used for assigning a fractional called trust value which denotes the amount of legitimate content generated by the user. A modification to sybil detection algorithm is proposed which makes use of the of each user to improve the accuracy of detecting a sybil identity. Real dataset from Facebook is crawled and used for analysis and experiments. Analytical results show the superiority of proposed solution. Results are compared with SybilGuard and SybilShield which shows ~14% decrease in false positive rates with very minimal effect on acceptance rate or false negative rate of the sybil detection algorithms. Also, the proposed modification does not affect the performance of existing sybil detection algorithms and can be implemented in a distributed manner.