S.P.O.O.F Net: Syntactic Patterns for identification of Ominous Online Factors

With more emphasis on internet as a primary mechanism for information access and communication, it is highly important that the platform stays safe and secure for anyone who uses it. Online scams and cybercrimes are becoming a common threat to the technology and systems that help mitigate these issues are in high demand. Businesses all over the world invest heavily to stay secure in the cyberspace and rely on security experts in defending their business from online threats. The immense scale of the internet and the dynamicity of the threat it holds forces the adoption of automated threat detection systems. Several cybersecurity use cases exist, but the two use cases discussed here are DGA detection and Malicious URL detection. This paper addresses the drawbacks of previous rulebased and machine learning based detection methods. Here, embedding concepts from NLP is incorporated into cybersecurity use cases to propose a new in house model christened S.P.O.O.F Net, which is a combination of a Convolutional Neural Network and Long Short Term Memory Network. The proposed model is benchmarked with machine learning algorithm incorporating bi-gram feature engineering techniques and also a conventional CNN with character level embedding (same as the one used for S.P.O.O.F Net). It was observed that S.P.O.O.F Net gave better performance over the aforementioned methods with accuracy scores of 98.3% for DGA detections and 99% for malicious URL detection. This work also aims to demonstrate the possibilities of incorporating NLP concepts to cybersecurity use cases and provide future researches a new thinking curve to develop systems in this domain.