Investigation of browser and web-based threats

By processing a unique combination of 9 redirection techniques, REdiREKT correctly extracted 96.52% of malicious domains from 1279 EK samples, spanning 28 families and 8 campaigns, and only failed to extract 0.7% of malicious chains. <br><br>REdiREKT extracted 12,783 domains from 5910 redirection chains when applied to the benign dataset. A range of 48 HTTP, URL, redirect, and content-based features are subsequently extracted for each node (domain) in each redirection chain and stored appropriately to ensure the intrinsic, sequential structure is maintained.

The malicious and benign features are assessed to identify common trends, as is the evolution of EK families.<br><br>Finally, the first known application of a Long Short-Term Memory (LSTM) network to detect EK traffic is presented. Samples are processed as sequences, where each timestep represents a redirect and contains a unique combination of 48 features. Hyper-parameters are tuned via 5-fold cross-validation (CV), with the optimal configuration achieving an F1 score of 0.9878 against the unseen test set.

Furthermore, isolated feature categories are contrasted to assess their importance.<br><br>