We end the survey by discussing the practical issues and open problems in this domain.

![image](framework.jpg){width="140mm"}

Malicious URL Detection
=======================

In this section, we first present the key principles used by researchers and practitioner to solve the problem of Malicious URL detection, followed by formalizing it as a machine learning task.

Principles of Detecting Malicious URLs: An Overview
---------------------------------------------------

A variety of approaches have been attempted to tackle the problem of Malicious URL Detection. According to the fundamental principles, these approaches can be broadly grouped into two major categories: (i) Blacklisting or Heuristics, and (ii) Machine Learning approaches [@canali2011prophiler; @eshete2013binspect]. Below we briefly describe the key principles of each category.

### Blacklisting or Heuristic Approaches

*Blacklisting* approaches are a common and classical technique for detecting malicious URLs, which often maintains a list of URLs that are known to be malicious. Whenever a new URL is visited, a database lookup is performed. If the URL is present in the blacklist, it is considered to be malicious and then a warning will be generated; else it is assumed to be benign. Blacklisting suffers from the inability to maintain an exhaustive list of all possible malicious URLs, as new URLs can be easily 