Hands-On Machine Learning for Cybersecurity

Web-content-based features

We can also look for features that are usually found in malicious pages, such as the following:

• The count of HTML tags in the web page
• The count of hyperlinks in the web page
• The count of iframes in the web page

We can search for these features using the following code:

def web_content_features(url):    webfeatures={}    total_count=0    try:         source_code = str(opener.open(url))        webfeatures['src_html_cnt']=source_code.count('<html')        webfeatures['src_hlink_cnt']=source_code.count('<a href=')        webfeatures['src_iframe_cnt']=source_code.count('<iframe')

We can also count the number of suspicious JavaScript objects, as shown in the following list:

• The count of evals
• The count of escapes
• The count of links
• The count of underescapes ...