Classifying locator generation kits

A system for training a classifier for classifying malicious locators accessible through a network, the system comprising:

• an interface to access a plurality of training malicious locators that each comprise the location of a known malicious network-accessible resource;
• a network interface;
• and
• a processor in communication with the medium interface and the network interface, the processor configured to:
• extract, from each respective training malicious locator of the plurality of training malicious locators, a respective set of features;
• perform, with respect to a first feature set comprising a combination of the respective set of features from the plurality of training malicious locators, feature set dimensionality reduction to reduce the dimensionality of the first feature set to a second feature set with fewer dimensions than the first feature set;
• execute, using the second feature set, a clustering procedure to identify latent class relationships among the plurality of training malicious locators, wherein, based on the latent class relationships, families of malicious locators, that respectively comprise a set of one or more malicious locators with similar characteristics, are identified;
• assign labels to the plurality of training malicious locators, wherein, to assign the labels, the processor is configured to label each respective training malicious locator as belonging to a particular family of the families of malicious locators, and wherein determination of the particular family for labeling a respective training malicious locator is based at least in part on respective features extracted from the respective training malicious locator that are in the second feature set;
• and
• train a classification module to classify other locators, wherein the processor is configured to use the second feature set, the labels, and a machine learning procedure to train the classification module to classify a locator as belonging to a family of the families of malicious locators.

One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, cause the one or more processors to:

• receive a plurality of training malicious locators that each comprise the location of a known malicious network-accessible resource;
• extract, from each respective training malicious locator of the plurality of training malicious locators, a respective set of features;
• perform, with respect to a first feature set comprising a combination of the respective set of features from the plurality of training malicious locators, feature set dimensionality reduction to reduce the dimensionality of the first feature set to a second feature set with fewer dimensions than the first feature set;
• execute, using the second feature set, a clustering procedure to identify latent class relationships among the plurality of training malicious locators, wherein, based on the latent class relationships, families of malicious locators, that respectively comprise a set of one or more malicious locators with similar characteristics, are identified;
• assign labels to the plurality of training malicious locators, wherein, to assign the labels, the one or more processors are configured to label each respective training malicious locator as belonging to a particular family of the families of malicious locators, and wherein determination of the particular family for labeling a respective training malicious locator is based at least in part on respective features extracted from the respective training malicious locator that are in the second feature set;
• and
• train a classification module to classify other locators, wherein the one or more processors are configured to use the second feature set, the labels, and a machine learning procedure to train the classification module to classify a locator as belonging to a family of the families of malicious locators.