MALICIOUS DOMAIN HOSTING TYPE CLASSIFICATION SYSTEMS AND METHODS

摘要

The present application provides a software-based classifier built on a machine learning model that distinguishes between two kinds of malicious URL hosting apex domains: public and private. This classification helps security professionals specify which domain levels to block, the whole apex domain in the case of private apexes or specific subdomains in the case of public ones. The classifier is also built on a machine learning model that differentiates attacker-owned hosting domains from compromised hosting domains. This distinction is crucial to help security operators take the appropriate mitigation actions. For example, attacker-owned domains could be blocked permanently whereas compromised ones temporarily.