generated daily, thus making it impossible for them to detect new threats [@sheng2009empirical]. This is particularly of critical concern when the attackers generate new URLs algorithmically, and can thus bypass all blacklists. Despite several problems faced by blacklisting [@sinha2008shades], due to their simplicity and efficiency, they continue to be one of the most commonly used techniques by many anti-virus systems today.

*Heuristic* approaches [@seifert2008identification] are some kind of extensions of Blacklist based methods, wherein the idea is to create a “blacklist of signatures". Common attacks are identified, and based on their behaviors, a signature is assigned to this attack type. Intrusion Detection Systems can scan the web pages for such signatures, and raise a flag if some suspicious behavior is found. These methods have better generalization capabilities than blacklisting, as they have the ability to detect threats in new URLs as well. However, such methods can be designed for only a limited number of common threats, and can not generalize to all types of (novel) attacks. Moreover, using obfuscation techniques, it is not difficult to bypass them. A more specific version of heuristic approaches is through analysis of execution dynamics of the webpage (e.g. [@moshchuk2007spyproxy; @rieck2010cujo; @qassrawi2011detecting; @kim2011suspicious; @kolbitsch2012rozzle] etc.). 