A Method for Examining and Reducing Malicious URL Connections by Machine Learning

Evidence shows that computer system users, small companies, and multinational corporations require Network Forensics Analysis to prevent attacks that may compromise their data. To this purpose, logs automatically generated by computer systems can be analyzed to identify, control, and properly fight different attacks. However, large amounts of data make it difficult to accurately analyze certain behaviors that may be considered risky to computer systems. This paper focuses on developing and training a Machine Learning (ML) Decision Tree Model to predict potential malicious attacks originated from specific networks. The KDD Cup dataset, which includes a wide variety of network intrusions simulated in a military network environment, was used. Dataset was analyzed and subsequently used to train, test, correct, and adjust the proposed model. The used dataset also showed a high risk at the connection ends. The proposed model was coded in Python to detect malicious connections and successfully achieve 99% accuracy. The subsequent development of a variant model using Principal Component Analysis showed its effectiveness and robustness by reducing its complexity. This paper also offers the possibility of developing tools to detect attacks and potential threats to security systems automatically, thus suggesting computer administrators use Network Forensics Analysis, data mining, and machine learning to provide security to their computer system.