\section{Future development}

The main weakness of the classier in its current form is its processing speed. With the aid of the machine learning algorithm, the speed of the URL classification can be improved. At the moment, the pattern-matching algorithm needs to match a given URL with every single URL in the URL database, which containing both malicious and benign URLs. Malicious and benign URLs can be converted into the form of a vector. These two vectors allow additional machine learning methods such as Support Vector Machine (SVM) or Multi-Layers Perceptron (MLP) to be applied. This reduces the need for matching a given URL to every single URL within the URL database. However, converting the URL to a form of a vector is very challenging in terms of implementation effort because the structure of a URL does not have a repetitive pattern.

\paragraph{}
The second development for the classifier is to use different classification algorithms and then to compare and contrasts their performance. Three machine learning technique algorithms are suggested for implementation, namely; Naïve Bayes, Support Vector Machine (SVM) and Decision Tree. The implementation of these three algorithms requires two datasets; a training and a testing dataset. A list of URLs can be used as training dataset for the classifier and a separate list of URLs is required for the testing dataset. URLs in the testing dataset should be completely different from those URLs in the training dataset. The important aspect involves the selection of URL features for classification. Many features can be considered such as; length of the URL, number of forward slashes '/'or the number of dots '.'' used in the URL structure. Features extracted from the URL’s structure are used as input for the classifier. The classifier will use extracted features to distinguish a malicious URL from the benign URL. 

\paragraph{}
In the current system the HTML malware scanner uses a URL and a keyword as the input and based on the frequency of the keyword in the web page of the given URL decides whether the URL is malicious or clean. An alternative design for the HTML scanner involves continuously updating a database with a feed of new trendy keywords so that the HTML scanner’s only input requirement is a given URL. The challenging part of this model is designing of a trendy keyword database, with each trendy keyword belonging to a group of keywords that have the same topic. The database will be connected to a list of selected trusted website such as BBC News. In turn, the database can be updated with any new trendy keywords being used on the News website, with old keywords being removed from the database after a predefined time period e.g. one month. In this model, the scanner decision is not only based on one trendy-keyword, it is based on a group of keywords connected to the trendy keyword topic within the database. Hence, ensuring a more reliable result is provided by the malware scanner.

\paragraph{}
Another option for the design of the HTML malware scanner involves considering the features of the web page related to each URL. In this method, a list of features of the webpage is extracted. This method is very similar to the one already suggested for the classifier. Again, there is a list of training dataset and testing dataset for the classifier, but instead the extracted features from web page will used as an input for the classifier. The web page features may be the number of hyperlinks in the webpage, number of lines, word count and functions (JavaScript keywords).

After training the classifier, some features may provide more useful results such as the use of JavaScript function in the web page. Hence, the features that produce the most accurate results will be selected for classification. Although the latter model does not consider the relationship between the trendy keyword term and the malicious URLs, a powerful system with an updated database and classifier can be created by combining the above two models. As a result, the database would contain a list of trendy keyword terms updated from trusted websites and the classifier would be capable of identifying unknown malicious URLs relating to the trendy keyword term.

The malware detection system that employs machine-learning techniques has a few advantages. The system can overcome the problem of detecting an unknown malware and also polymorphic malwares. In addition, it is very efficient and resilient in comparison with other malware detection techniques. Moreover, the adapted techniques in this system make it difficult for malware writers to bypass the detection system. 





