Detecting Malicious Domains Using Modified SVM Model

The existing machine learning algorithms are costly when it comes to retraining the detection model. However, domains used in different types of malicious activities vary a lot depending on their complex purposes. In order to detect malicious domains in large scale traffic data in real time, a modified SVM algorithm (F-SVM) is proposed in this paper. F-SVM draws lessons from the idea of feedback learning, and it is able to solve the problem of insufficient labeled samples and high cost of updating models. Experimental results show that F-SVM algorithm is capable to keep a high precision rate through whole detection process while simple SVM model has a detection fall as the detection process goes on. F-SVM model's high efficiency in updating detection model makes it suitable for online detection.