基于 Stacking 集成学习的恶意 URL识别方法-《集美大学学报（自然科学版）》

文章信息/Info

Title:: Malicious URL Recognition Method Based on Stacking Ensemble Learning

Author(s):: SUN Yang1; QIU XiangFeng2; 1.College of Computer Engineering,Jimei University,Xiamen 361021,China；2.Xiamen Kingtop Information Technology Co.,Ltd.,Xiamen 361021,China

Keywords:: malicious URL; machine recognition; Stcking model; integrated learning; base learner

摘要:: 针对传统URL（uniform resource locator）检测方法在恶意URL检测时存在的精确率不高、实时性差等问题，提出一种基于Stacking 集成学习的算法模型。该模型用ADB（adaptive boosting）、LR(logistic regression)、SVM(support vector machine)、GBDT(gradient boosting decision tree)和GNB(gaussian naive bayes) 5种机器学习算法作为初级分类器，其多层结构使不同机器学习模型之间可以优势互补，提升检测系统的整体性能表现。最后，通过在测试集上进行性能评估，选出性能最优的集成组合。实验结果表明，基于Stacking方法融合基学习器的集成学习模型在召回率、准确率、精确率、F1值等多项指标上优于传统机器学习模型，对恶意URL检测的准确率可达 96.77%。

Abstract:: In allusion to the problems of traditional URL detection methods such as low accuracy and poor real-time performance in detecting malicious URLs，an algorithm model based on Stacking ensemble learning is proposed，which uses five machine learning models:ADB,LR,SVM,GBDT and GNB as primary classifiers.Its pluralistic structure enables different machine learning models to complement each other and improve detection Overall system performance.The performance evaluation is performed on the test set in turn,and the best performance is selected.The experimental results indicate that on many metrics,such as recall,accuracy,precision,F1 value,the overall performance of integrated learning models is better than the traditional machine learning models,the accuracy of malicious URL detection can reach 96.77%.