Apparatus and Method for Predicting Malicious Domains

A computerized method for calculating the probability of a domain being malicious based on an input dataset, the method comprising:

• data extracting, including extracting from the input dataset at least two types of input data comprising:
• network data comprising one or more of WHOIS data, DNS data, Reverse PTR data, Domain Ranking data and popularity data, and Domain Authority data;
• and
• Domain Word data in a corpus;
• data preprocessing, including transforming the network data from sparse to dense network data;
• data preprocessing, including transforming the Domain Word data into vectorial representations using a trained Embedding Network;
• data preprocessing, including constructing feature vectors by concatenating the vectorial representations with the dense network data;
• and
• processing the feature vectors through a trained Domain Risk Classifier to determine a probability of the domain being malicious,
• wherein the Embedding Network is a natural language processing network trained on the Domain Word data in the corpus using a hierarchical classifier implemented as a binary tree and constructed by executing a Huffman coding algorithm;
• and
• wherein the Domain Risk Classifier is a gradient-boosting classification tree trained on a labeled training dataset.