Supporting Law-enforcement in coping with URL Blacklists
Supporting Law-enforcement in coping with URL Blacklists
Embedded Files
URL blacklisting has been widely used for tackling Phishing, Malware, or Scamming attacks. However, Blacklists are not perfect and may not provide further information to intervene for the law-enforcement agencies. Our proposed framework quantify the likelihood of website maliciousness in a blacklist to identify truly malicious websites versus compromised ones, which also include confidence measures and explanations for model decisions. The confidence measure and explanations can work as a trustworthy basis for cyber defenders' domain-level intervention (e.g., domain take-downs).
URL blacklisting has been widely used for tackling Phishing, Malware, or Scamming attacks. However, Blacklists are not perfect and may not provide further information to intervene for the law-enforcement agencies. Our proposed framework quantify the likelihood of website maliciousness in a blacklist to identify truly malicious websites versus compromised ones, which also include confidence measures and explanations for model decisions. The confidence measure and explanations can work as a trustworthy basis for cyber defenders' domain-level intervention (e.g., domain take-downs).
The figure illustrates the overall idea of the proposed framework with four high-level modules: (a) labeling, (b) feature extraction, (c) classification with interpretML, and (d) decision-making.
The figure illustrates the overall idea of the proposed framework with four high-level modules: (a) labeling, (b) feature extraction, (c) classification with interpretML, and (d) decision-making.
Remarks:
Remarks:
I am the lead on this project as this work is towards my dissertation theme. Dr. Xu is advising me on the project with his expertise in cybersecurity research and validating research questions. The project is still ongoing, but early results show that this trustworthy quantification mechanism can play a vital role in enabling humans in the loop for AI-enabled security systems and reducing false positives from detections.
I am the lead on this project as this work is towards my dissertation theme. Dr. Xu is advising me on the project with his expertise in cybersecurity research and validating research questions. The project is still ongoing, but early results show that this trustworthy quantification mechanism can play a vital role in enabling humans in the loop for AI-enabled security systems and reducing false positives from detections.
Publications:
Publications:
Mir Mehedi A. Pritom and S. Xu, "Supporting Law Enforcement in Coping with URL Blacklists Leveraging Interpretable ML: Framework, Mechanisms, and Case Study," [Paper submission in progress].
Page updated
Google Sites
Report abuse