Less Is More: Robust and Novel Features for Malicious Domain Detection

Chen Hajaj, Nitay Hason, Amit Dvir

Research output: Contribution to journalArticlepeer-review

9 Scopus citations


Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.

Original languageEnglish
Article number969
JournalElectronics (Switzerland)
Issue number6
StatePublished - 1 Mar 2022
Externally publishedYes

Bibliographical note

Publisher Copyright:
© 2022 by the authors. Licensee MDPI, Basel, Switzerland.


Funding: This research was funded by Ariel University and Holon Institute of Technology (RA1900000614).

FundersFunder number
Athlone Institute of TechnologyRA1900000614
Ariel University


    • Domain
    • Malware detection
    • Robust features


    Dive into the research topics of 'Less Is More: Robust and Novel Features for Malicious Domain Detection'. Together they form a unique fingerprint.

    Cite this