Deep learning for malicious url classification (urlc) with the innocent until proven guilty (iupg) learning framework

A method, comprising:

• storing on a networked device a set comprising one or more innocent until proven guilty (IUPG) models for static analysis of a sample;
• performing a static analysis of one or more URLs associated with the sample, wherein performing the static analysis of the sample includes using at least one stored IUPG model;
• and
• determining that the sample is malicious based at least in part on the static analysis of the one or more URLs associated with the sample, and in response to determining that the sample is malicious, performing an action based on a security policy.

A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for:

• storing on a networked device a set comprising one or more innocent until proven guilty (IUPG) models for static analysis of a sample;
• performing a static analysis of one or more URLs associated with the sample, wherein performing the static analysis of the sample includes using at least one stored IUPG model;
• and
• determining that the sample is malicious based at least in part on the static analysis of the one or more URLs associated with the sample, and in response to determining that the sample is malicious, performing an action based on a security policy.