these methods are safer than the Dynamic approaches. The underlying assumption is that the distribution of these features is different for malicious and benign URLs. Using this distribution information, a prediction model can be built, which can make predictions on new URLs. Due to the relatively safer environment to extracting important information, and the ability to generalize to all types of threats (not just common ones which have to be defined by a signature), static analysis techniques have been extensively explored by applying machine learning techniques. In this survey, we focus primarily on the static analysis techniques where machine learning has found tremendous success. Dynamic analysis techniques include monitoring the behavior of the systems which are potential victims, to look for any anomaly. These include [@canfora2014detection] which monitor the system call sequences for abnormal behavior, and [@tao2014suspicious] which mine internet access log data for suspicious activity. Dynamic analysis techniques have inherent risks, and are difficult to implement and generalize.

In the following, we formalize the problem of malicious URL detection as a machine learning task which allows us to generalize most of the existing work in literature. Alternate problem settings will also be discussed in Section \[sec:ml\].

Problem Formulation
-------------------

