properties of URL strings, to get more informative features.

[@le2011phishdef] derive new lexical features using heuristics with the objective of being obfuscation resistant. Based on the obfuscation types identified by [@garera2007framework], five categories of features are proposed: URL-related features (keywords, length, etc.), Domain features (length of domain name, whether IP address is used as domain name, etc.), Directory related features (length of directory, number of subdirectory tokens, etc.), File name features (length of filename, number of delimiters, etc.), and Argument Features(length of the argument, number of variables, etc.).

Another feature is based on the *Kolmogorov Complexity* [@pao2012malicious]. Kolmogorov Complexity is a measure of complexity of a string $s$. Conditional Kolmogorov Complexity is the measure of the complexity of a string $s$ given another string for free. This means that the presence of the free string does not add to the complexity of the original input string $s$. Based on this, for a given URL, we compute the URL’s Conditional Kolmogorov Complexity with respect to the set of Benign URLs and the set of Malicious URLs. Combining these measures we get a sense of whether the given URL is more similar to the Malicious URL database or the Benign URL database. 