{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,15]],"date-time":"2026-10-15T05:50:03Z","timestamp":1792043403473,"version":"4.4.0"},"reference-count":44,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2011,4,1]],"date-time":"2011-04-01T00:00:00Z","timestamp":1301616000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N000140911081"],"award-info":[{"award-number":["N000140911081"]}],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["NSF-0238323NSF-0433668NSF-0829469"],"award-info":[{"award-number":["NSF-0238323NSF-0433668NSF-0829469"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Intell. Syst. Technol."],"published-print":{"date-parts":[[2011,4]]},"abstract":"<jats:p>Malicious Web sites are a cornerstone of Internet criminal activities. The dangers of these sites have created a demand for safeguards that protect end-users from visiting them. This article explores how to detect malicious Web sites from the lexical and host-based features of their URLs. We show that this problem lends itself naturally to modern algorithms for online learning. Online algorithms not only process large numbers of URLs more efficiently than batch algorithms, they also adapt more quickly to new features in the continuously evolving distribution of malicious URLs. We develop a real-time system for gathering URL features and pair it with a real-time feed of labeled URLs from a large Web mail provider. From these features and labels, we are able to train an online classifier that detects malicious Web sites with 99% accuracy over a balanced dataset.<\/jats:p>","DOI":"10.1145\/1961189.1961202","type":"journal-article","created":{"date-parts":[[2012,10,12]],"date-time":"2012-10-12T16:56:02Z","timestamp":1350060962000},"page":"1-24","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":116,"title":["Learning to detect malicious URLs"],"prefix":"10.1145","volume":"2","author":[{"given":"Justin","family":"Ma","sequence":"first","affiliation":[{"name":"University of California, Berkeley"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lawrence K.","family":"Saul","sequence":"additional","affiliation":[{"name":"University of California, San Diego"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefan","family":"Savage","sequence":"additional","affiliation":[{"name":"University of California, San Diego"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Geoffrey M.","family":"Voelker","sequence":"additional","affiliation":[{"name":"University of California, San Diego"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2011,5,6]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1299015.1299021"},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the Conference on Email and Anti-Spam (CEAS).","author":"Bergholz A."},{"key":"e_1_2_1_3_1","volume-title":"Online Learning and Neural Networks","author":"Bottou L."},{"key":"e_1_2_1_4_1","volume-title":"Advances in Neural Information Processing Systems 16","author":"Bottou L."},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS).","author":"Chou N."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/1248547.1248566"},{"key":"e_1_2_1_7_1","unstructured":"Crammer K. Dredze M. and Pereira F. 2009. Exact convex confidence-weighted learning. In Advances in Neural Information Processing Systems (NIPS).  Crammer K. Dredze M. and Pereira F. 2009. Exact convex confidence-weighted learning. In Advances in Neural Information Processing Systems (NIPS)."},{"key":"e_1_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Daigle L. 2004. WHOIS protocol specification. RFC 3912.  Daigle L. 2004. WHOIS protocol specification. RFC 3912.","DOI":"10.17487\/rfc3912"},{"key":"e_1_2_1_9_1","doi-asserted-by":"crossref","unstructured":"Deering S. and Hinden R. 1998. Internet protocol version 6 (IPv6) specification. RFC 2460.  Deering S. and Hinden R. 1998. Internet protocol version 6 (IPv6) specification. RFC 2460.","DOI":"10.17487\/rfc2460"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1137\/060666998"},{"key":"e_1_2_1_11_1","unstructured":"Digital Element. 2010. NetAcuity. http:\/\/www.digital-element.com\/ip_intelligence\/ip_intelligence.html.  Digital Element. 2010. NetAcuity. http:\/\/www.digital-element.com\/ip_intelligence\/ip_intelligence.html."},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390190"},{"key":"e_1_2_1_13_1","doi-asserted-by":"crossref","unstructured":"Droms R. 1997. Dynamic host configuration protocol. RFC 2131.  Droms R. 1997. Dynamic host configuration protocol. RFC 2131.","DOI":"10.17487\/rfc2131"},{"key":"e_1_2_1_14_1","unstructured":"Fan R.-E. Chang K.-W. Hsieh C.-J. Wang X.-R. and Lin C.-J. 2008. LIBLINEAR: A library for large linear classification. http:\/\/www.csie.ntu.edu.tw\/~cjlin\/liblinear\/.   Fan R.-E. Chang K.-W. Hsieh C.-J. Wang X.-R. and Lin C.-J. 2008. LIBLINEAR: A library for large linear classification. http:\/\/www.csie.ntu.edu.tw\/~cjlin\/liblinear\/."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242660"},{"key":"e_1_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Fuller V. and Li T. 2006. Classless inter-domain routing (CIDR): The internet address assignment and aggregation plan. RFC 4632.  Fuller V. and Li T. 2006. Classless inter-domain routing (CIDR): The internet address assignment and aggregation plan. RFC 4632.","DOI":"10.17487\/rfc4632"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314391"},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the Joint Workshop on Information Security (JWIS).","author":"Guan D. J."},{"key":"e_1_2_1_19_1","unstructured":"Jeftovic M. and Saez D. 2010. PHPWhois. http:\/\/sourceforge.net\/projects\/phpwhois\/.  Jeftovic M. and Saez D. 2010. PHPWhois. http:\/\/sourceforge.net\/projects\/phpwhois\/."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1099554.1099649"},{"key":"e_1_2_1_21_1","unstructured":"Keizer G. 2008. Spam plummets after calif. hosting service shuttered. http:\/\/www.computerworld.com\/s\/article\/9119963\/Spam_plummets_after_Calif%_hosting_service_shuttered.  Keizer G. 2008. Spam plummets after calif. hosting service shuttered. http:\/\/www.computerworld.com\/s\/article\/9119963\/Spam_plummets_after_Calif%_hosting_service_shuttered."},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the AAAI Spring Symposium on Computational Approaches to Analysing Weblogs.","author":"Kolari P."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557153"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1553374.1553462"},{"key":"e_1_2_1_25_1","unstructured":"MAAWG. 2010. MAAWG email metrics program: The network operators' perspective. Rep. &amp;num;12 -- Third and Fourth Quarter 2009.  MAAWG. 2010. MAAWG email metrics program: The network operators' perspective. Rep. &amp;num;12 -- Third and Fourth Quarter 2009."},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET).","author":"McGrath D. K."},{"key":"e_1_2_1_27_1","unstructured":"McMillan R. 2010. Zeus botnet dealt a blow as ISP troyak knocked out. http:\/\/www.itworld.com\/government\/100020\/zeus-botnet-dealt-blow-isp-tro%yak-knocked-out.  McMillan R. 2010. Zeus botnet dealt a blow as ISP troyak knocked out. http:\/\/www.itworld.com\/government\/100020\/zeus-botnet-dealt-blow-isp-tro%yak-knocked-out."},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Mockapretis P. 1987a. Domain names -- Concepts and facilities. RFC 1034.  Mockapretis P. 1987a. Domain names -- Concepts and facilities. RFC 1034.","DOI":"10.17487\/rfc1034"},{"key":"e_1_2_1_29_1","doi-asserted-by":"crossref","unstructured":"Mockapretis P. 1987b. Domain names -- Implementation and specification. RFC 1035.  Mockapretis P. 1987b. Domain names -- Implementation and specification. RFC 1035.","DOI":"10.17487\/rfc1035"},{"key":"e_1_2_1_30_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Moshchuk A."},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the Symposium on Network and Distributed System Security (NDSS).","author":"Moshchuk A."},{"key":"e_1_2_1_32_1","unstructured":"Netscape. 2011. DMOZ Open Directory Project. http:\/\/www.dmoz.org.  Netscape. 2011. DMOZ Open Directory Project. http:\/\/www.dmoz.org."},{"key":"e_1_2_1_33_1","volume-title":"Proceedings of the Symposium on Network and Distributed System Security (NDSS).","author":"Niu Y."},{"key":"e_1_2_1_34_1","unstructured":"OpenDNS. 2011. PhishTank. http:\/\/www.phishtank.com.  OpenDNS. 2011. PhishTank. http:\/\/www.phishtank.com."},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390247"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Provos N."},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1037\/h0042519"},{"key":"e_1_2_1_38_1","volume-title":"Proceedings of the International Conference on Malicious and Unwared Software (Malware).","author":"Sinha S."},{"key":"e_1_2_1_39_1","unstructured":"Sonnenburg S. Franc V. Yom-Tov E. and Sebag M. 2008. PASCAL large scale learning challenge. http:\/\/largescale.first.fraunhofer.de\/workshop\/.  Sonnenburg S. Franc V. Yom-Tov E. and Sebag M. 2008. PASCAL large scale learning challenge. http:\/\/largescale.first.fraunhofer.de\/workshop\/."},{"key":"e_1_2_1_40_1","unstructured":"University of Oregon Advanced Network Technology Center. 2010. Route views project. http:\/\/www.routeviews.org.  University of Oregon Advanced Network Technology Center. 2010. Route views project. http:\/\/www.routeviews.org."},{"key":"e_1_2_1_41_1","unstructured":"USC Information Sciences Institute. 1981. Internet protocol: DARPA internte program protocol specification. RFC 791.  USC Information Sciences Institute. 1981. Internet protocol: DARPA internte program protocol specification. RFC 791."},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the Symposium on Network and Distributed System Security (NDSS).","author":"Wang Y.-M."},{"key":"e_1_2_1_43_1","volume-title":"Proceedings of the IEEE International Conference on Data Mining (ICDM).","author":"Zadrozny B."},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242659"}],"container-title":["ACM Transactions on Intelligent Systems and Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1961189.1961202","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1961189.1961202","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T06:59:50Z","timestamp":1750229990000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1961189.1961202"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,4]]},"references-count":44,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2011,4]]}},"alternative-id":["10.1145\/1961189.1961202"],"URL":"https:\/\/doi.org\/10.1145\/1961189.1961202","relation":{},"ISSN":["2157-6904","2157-6912"],"issn-type":[{"value":"2157-6904","type":"print"},{"value":"2157-6912","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,4]]},"assertion":[{"value":"2010-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2010-11-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-05-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}