# Detection of Malicious Websites Using Machine Learning Techniques

arXiv: https://arxiv.org/abs/2209.09630 · HTML: https://mlsanity.com/paper/2209.09630/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 20 references that are in the map.
- First posted on arXiv 13 Sep 2022.

## Builds on (most cited first, 5 of 5)

- [Hidden Stratification Causes Clinically Meaningful Failures in Machine Learning for Medical Imaging](https://mlsanity.com/paper/1909.12475/) (2019)
- [Identifying Spurious Correlations for Robust Text Classification](https://mlsanity.com/paper/2010.02458/) (2020)
- [Malicious URL Detection using Machine Learning: A Survey](https://mlsanity.com/paper/1701.07179/) (2017)
- [A Survey on Malicious Domains Detection through DNS Data Analysis](https://mlsanity.com/paper/1805.08426/) (2018)
- [Using Lexical Features for Malicious URL Detection -- A Machine Learning Approach](https://mlsanity.com/paper/1910.06277/) (2019)

## Built on by (most cited first, 2 of 2)

- [Web Content Filtering through knowledge distillation of Large Language Models](https://mlsanity.com/paper/2305.05027/) (2023)
- [Classification of Spam URLs Using Machine Learning Approaches](https://mlsanity.com/paper/2310.05953/) (2023)

## Abstract (arXiv)

In detecting malicious websites, a common approach is the use of blacklists which are not exhaustive in themselves and are unable to generalize to new malicious sites. Detecting newly encountered malicious websites automatically will help reduce the vulnerability to this form of attack. In this study, we explored the use of ten machine learning models to classify malicious websites based on lexical features and understand how they generalize across datasets. Specifically, we trained, validated, and tested these models on different sets of datasets and then carried out a cross-datasets analysis. From our analysis, we found that K-Nearest Neighbor is the only model that performs consistently high across datasets. Other models such as Random Forest, Decision Trees, Logistic Regression, and Support Vector Machines also consistently outperform a baseline model of predicting every link as malicious across all metrics and datasets. Also, we found no evidence that any subset of lexical features generalizes across models or datasets. This research should be relevant to cybersecurity professionals and academic researchers as it could form the basis for real-life detection systems or further research work.