$n$-gram features (same as bi-gram, but $n$ can be $> 2$), and devised a feature selection scheme based on relative entropy to reduce the dimensionality. A similar feature extraction method was used by [@zhang2011malicious], where the feature weights were computed based on the ratio of their presence in one class of URLs against their presence in both classes of URLs.

In order to avoid being caught by blacklists, hackers can generate malicious URLs algorithmically. Using bag-of-words feature for such URLs is likely to give a poor performance, as algorithmically generated URLs may produce never before seen words (hence never before seen features). To detect such algorithmically generated malicious URLs, [@yadav2010detecting] analyzed character level strings to obtain the features. They argued that algorithmically generated domain names and those generated by humans would have a substantially different alpha-numeric distribution. Further, since the number of characters is small, the number of features obtained would also be small. They performed their analysis based on KL-divergence, Jaccard Coefficient, and Edit-distance using unigram and bigram distributions of characters.

*Advanced Lexical Features*: Traditional lexical features were directly obtained from the URL string without significant domain knowledge or computation. Researchers have proposed several advanced lexical features that exploit 