Detecting Malicious Websites by using Deep Q-Networks

Web applications are the most popular and critical applications for the Internet, but attackers also utilize web browsers for malicious purposes. Uniform Resource Loca- tor(URL) has been utilized to launch attacks on users, systems, and networks in different ways, such as phishing, defacement, malware, and spam. Identifying malicious URLs is the fundamental task to protect our digital assets. This paper presents a new malicious link detection system based on reinforcement learning to identify malicious URLs. It utilizes a Deep Q-Network (DQN) algorithm to make intelligent determinations by an agent in the designated environment. This paper analyzes malicious URL datasets with various feature sets with the DQN algorithm and provides a strategy to optimize the detection rates. The experimental results demonstrate the feasibility of preventing malicious URLs in different settings.

I. Introduction

The Internet has been dramatically changing throughout the years and all activities are mainly conducted through web spaces including all types of business, transactions, e-commerce, business-related, etc. Due to the dynamic environments, multiple online crimes have occurred daily which causes awareness to the population. According to a report by Comparitech in 2020, the recovery costs and downtime resulting from cyberattacks amounted to $18.88 billion for U.S. government organizations [1]. The most common cyberattack is when a user clicks on a malicious uniform resource locators (URLs) which results in being hacked or exposed sensitive data. The term ’’Malicious" is a broad term used to describe different types of attacks, including spam, phishing, malware, defacement, and more. Accordingly, web-based security problems have become one of the biggest challenges to the nation [28].