An Assessment of Lexical, Network, and Content-Based Features for Detecting Malicious URLs Using Machine Learning and Deep Learning Models

Table 2

Final features in the dataset after features extraction.

#	Attribute	Description
1	url_len	Length of the URL of the website
2	geo_loc	The geographical location where the website is being hosted
3	tld	Top-Level domain of the website
4	who_is	Who is domain information is complete or no
5	https	Website is HTTPS protocol using
6	js_len	Length of JavaScript code present on the website
7	js_obf_len	Length of the obfuscated JavaScript code present on the website
8	count_link	Count appearance of JavaScript link() function in content
9	count_eval	Count appearance of JavaScript eval() function in content
10	count_exec	Count appearance of JavaScript exec() function in content
11	count_unescape	Count appearance of JavaScript unescape() function in content
12	count_search	Count appearance of JavaScript search() function in content
13	count_find	Count appearance of JavaScript find() function in content
14	count_escape	Count appearance of JavaScript escape() function in content
15	count_all_functions	Count of all the above 7 suspicious functions in content
16	Presence_iframe	The presence of the iFrame tag is checked in content
17	count_/	Count “/” symbols in URL
18	count_dot	Count “.” symbols in URL
19	Count_&	Count “&” symbols in URL
20	Count_@	Count “@” symbols in URL
21	Count_-	Count “−” symbols in URL
22	count_=	Count “=” symbols in URL
23	Count_?	Count “?” symbols in URL
24	Count_;	Count “;” symbols in URL
25	count_digit	Count total digits in URL
26	count_letter	Count total alphabetical letters in URL
27	presence_ebayisapi	Check presence in URL
28	presence_getImage	Check presence in URL
29	presence_jpg	Check presence in URL
30	presence_log	Check presence in URL
31	count_path_dots	Count dots in URL path
32	path_length	Length of the URL path
33	count_path_slash	Count backslashes in URL path
34	host_length	Length of the hostname in URL
35	host_Precense_of_digit	Check digits in the hostname
36	count_symbols	Count all symbols in the URL
37	presence_obfuscated_code	Check the presence of obfuscated JavaScript code
38	presence_Window.open()	The presence of Window.open() function is checked in content
39	lines_count	The number of lines of the content
40	Label	Label for indicating if the website is malicious or benign