{"id":"https://openalex.org/W4414343993","doi":"https://doi.org/10.1145/3768587","title":"Accurate, Generalizable, and Practical Behavioral Models to Identify Impending User Exposure to Malicious Websites","display_name":"Accurate, Generalizable, and Practical Behavioral Models to Identify Impending User Exposure to Malicious Websites","publication_year":2025,"publication_date":"2025-09-18","ids":{"openalex":"https://openalex.org/W4414343993","doi":"https://doi.org/10.1145/3768587"},"language":"en","primary_location":{"id":"doi:10.1145/3768587","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3768587","pdf_url":null,"source":{"id":"https://openalex.org/S131231701","display_name":"ACM Transactions on the Web","issn_l":"1559-1131","issn":["1559-1131","1559-114X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on the Web","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042470097","display_name":"Jin-Dong Dong","orcid":"https://orcid.org/0000-0002-9162-7225"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jin-Dong Dong","raw_affiliation_strings":["Electrical and Computer Engineering, Carnegie Mellon University","Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, United States"],"raw_orcid":"https://orcid.org/0000-0002-9162-7225","affiliations":[{"raw_affiliation_string":"Electrical and Computer Engineering, Carnegie Mellon University","institution_ids":["https://openalex.org/I74973139"]},{"raw_affiliation_string":"Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, United States","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043581705","display_name":"Kyle Crichton","orcid":"https://orcid.org/0000-0003-2746-0130"},"institutions":[{"id":"https://openalex.org/I184565670","display_name":"Georgetown University","ror":"https://ror.org/05vzafd60","country_code":"US","type":"education","lineage":["https://openalex.org/I184565670"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kyle Crichton","raw_affiliation_strings":["Georgetown University","Georgetown University, Washington, United States"],"raw_orcid":"https://orcid.org/0000-0003-2746-0130","affiliations":[{"raw_affiliation_string":"Georgetown University","institution_ids":["https://openalex.org/I184565670"]},{"raw_affiliation_string":"Georgetown University, Washington, United States","institution_ids":["https://openalex.org/I184565670"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101606160","display_name":"Akira Yamada","orcid":"https://orcid.org/0000-0001-7213-5834"},"institutions":[{"id":"https://openalex.org/I65837984","display_name":"Kobe University","ror":"https://ror.org/03tgsfw79","country_code":"JP","type":"education","lineage":["https://openalex.org/I65837984"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Akira Yamada","raw_affiliation_strings":["Kobe University","Kobe University, Kobe, Japan"],"raw_orcid":"https://orcid.org/0000-0001-7213-5834","affiliations":[{"raw_affiliation_string":"Kobe University","institution_ids":["https://openalex.org/I65837984"]},{"raw_affiliation_string":"Kobe University, Kobe, Japan","institution_ids":["https://openalex.org/I65837984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075926362","display_name":"Yukiko Sawaya","orcid":"https://orcid.org/0000-0002-0432-2256"},"institutions":[{"id":"https://openalex.org/I4210164495","display_name":"KDDI Research (Japan)","ror":"https://ror.org/05qsqt662","country_code":"JP","type":"company","lineage":["https://openalex.org/I4210164495"]},{"id":"https://openalex.org/I71799228","display_name":"KDDI (Japan)","ror":"https://ror.org/03r7fm174","country_code":"JP","type":"company","lineage":["https://openalex.org/I71799228"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Yukiko Sawaya","raw_affiliation_strings":["KDDI Research Inc","KDDI Research Inc, Fujimino, Japan"],"raw_orcid":"https://orcid.org/0000-0002-0432-2256","affiliations":[{"raw_affiliation_string":"KDDI Research Inc","institution_ids":["https://openalex.org/I71799228","https://openalex.org/I4210164495"]},{"raw_affiliation_string":"KDDI Research Inc, Fujimino, Japan","institution_ids":["https://openalex.org/I4210164495"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072760035","display_name":"Lorrie Faith Cranor","orcid":"https://orcid.org/0000-0003-2125-0124"},"institutions":[{"id":"https://openalex.org/I114772536","display_name":"Software Engineering Institute","ror":"https://ror.org/01xqjjn94","country_code":"US","type":"facility","lineage":["https://openalex.org/I114772536","https://openalex.org/I74973139"]},{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lorrie Cranor","raw_affiliation_strings":["Software and Societal Systems, Carnegie Mellon University","Software and Societal Systems, Carnegie Mellon University, Pittsburgh, United States"],"raw_orcid":"https://orcid.org/0000-0003-2125-0124","affiliations":[{"raw_affiliation_string":"Software and Societal Systems, Carnegie Mellon University","institution_ids":["https://openalex.org/I114772536","https://openalex.org/I74973139"]},{"raw_affiliation_string":"Software and Societal Systems, Carnegie Mellon University, Pittsburgh, United States","institution_ids":["https://openalex.org/I114772536","https://openalex.org/I74973139"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078075278","display_name":"Nicolas Christin","orcid":"https://orcid.org/0000-0002-2506-8031"},"institutions":[{"id":"https://openalex.org/I114772536","display_name":"Software Engineering Institute","ror":"https://ror.org/01xqjjn94","country_code":"US","type":"facility","lineage":["https://openalex.org/I114772536","https://openalex.org/I74973139"]},{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nicolas Christin","raw_affiliation_strings":["Software and Societal Systems, Carnegie Mellon University","Software and Societal Systems, Carnegie Mellon University, Pittsburgh, United States"],"raw_orcid":"https://orcid.org/0000-0002-2506-8031","affiliations":[{"raw_affiliation_string":"Software and Societal Systems, Carnegie Mellon University","institution_ids":["https://openalex.org/I114772536","https://openalex.org/I74973139"]},{"raw_affiliation_string":"Software and Societal Systems, Carnegie Mellon University, Pittsburgh, United States","institution_ids":["https://openalex.org/I114772536","https://openalex.org/I74973139"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.34727107,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":"1","first_page":"1","last_page":"31"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9930999875068665,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.991100013256073,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7807999849319458},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6007999777793884},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5791000127792358},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.5440999865531921},{"id":"https://openalex.org/keywords/margin","display_name":"Margin (machine learning)","score":0.5288000106811523},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.37369999289512634},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.3395000100135803},{"id":"https://openalex.org/keywords/clickstream","display_name":"Clickstream","score":0.3098999857902527}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8252000212669373},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7807999849319458},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6007999777793884},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5791000127792358},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.5440999865531921},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.5288000106811523},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.37369999289512634},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36820000410079956},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3395000100135803},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3199000060558319},{"id":"https://openalex.org/C138744977","wikidata":"https://www.wikidata.org/wiki/Q5132438","display_name":"Clickstream","level":5,"score":0.3098999857902527},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2962999939918518},{"id":"https://openalex.org/C147764199","wikidata":"https://www.wikidata.org/wiki/Q6865248","display_name":"Minification","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.2865000069141388},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2727000117301941},{"id":"https://openalex.org/C2984870255","wikidata":"https://www.wikidata.org/wiki/Q5196451","display_name":"User engagement","level":2,"score":0.27239999175071716},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27079999446868896},{"id":"https://openalex.org/C61096286","wikidata":"https://www.wikidata.org/wiki/Q7978592","display_name":"Web navigation","level":3,"score":0.26669999957084656},{"id":"https://openalex.org/C201025465","wikidata":"https://www.wikidata.org/wiki/Q11248500","display_name":"User experience design","level":2,"score":0.25850000977516174},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.25679999589920044},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2517000138759613}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3768587","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3768587","pdf_url":null,"source":{"id":"https://openalex.org/S131231701","display_name":"ACM Transactions on the Web","issn_l":"1559-1131","issn":["1559-1131","1559-114X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on the Web","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":53,"referenced_works":["https://openalex.org/W86959386","https://openalex.org/W110479989","https://openalex.org/W1482333726","https://openalex.org/W1536112217","https://openalex.org/W1559571055","https://openalex.org/W1573760589","https://openalex.org/W1849719115","https://openalex.org/W1966716734","https://openalex.org/W1982896842","https://openalex.org/W2026739782","https://openalex.org/W2033130105","https://openalex.org/W2040424958","https://openalex.org/W2077124362","https://openalex.org/W2099216531","https://openalex.org/W2135088779","https://openalex.org/W2183341477","https://openalex.org/W2341381956","https://openalex.org/W2467763829","https://openalex.org/W2489094720","https://openalex.org/W2531223178","https://openalex.org/W2602218799","https://openalex.org/W2738931638","https://openalex.org/W2750779823","https://openalex.org/W2883457276","https://openalex.org/W2891432086","https://openalex.org/W2913941020","https://openalex.org/W2915064390","https://openalex.org/W2917878349","https://openalex.org/W3003545752","https://openalex.org/W3006484790","https://openalex.org/W3038175633","https://openalex.org/W3106934761","https://openalex.org/W3150583396","https://openalex.org/W3204606269","https://openalex.org/W4200341685","https://openalex.org/W4205337489","https://openalex.org/W4220880333","https://openalex.org/W4236965008","https://openalex.org/W4237250806","https://openalex.org/W4238996902","https://openalex.org/W4243313853","https://openalex.org/W4244183189","https://openalex.org/W4254065450","https://openalex.org/W4254211903","https://openalex.org/W4285886199","https://openalex.org/W4298134634","https://openalex.org/W4299522686","https://openalex.org/W4315746341","https://openalex.org/W4365806382","https://openalex.org/W4399135263","https://openalex.org/W4402389591","https://openalex.org/W4402957852","https://openalex.org/W4412176845"],"related_works":[],"abstract_inverted_index":{"To":[0,39],"keep":[1],"users":[2,35],"safe":[3],"online,":[4],"current":[5],"protections":[6],"frequently":[7,66],"employ":[8],"blocklists":[9],"of":[10,103,158,177,186,196],"known":[11],"malware":[12,104],"and":[13,28,93,109,118,142],"phishing":[14],"websites.":[15],"However,":[16],"such":[17,223],"defenses":[18],"suffer":[19],"from":[20],"an":[21],"inherent":[22],"gap":[23],"between":[24],"malicious":[25,61],"content":[26],"creation":[27],"its":[29],"detection,":[30],"leaving":[31],"a":[32,119,127,137],"window":[33],"where":[34],"are":[36],"left":[37],"vulnerable.":[38],"address":[40],"this":[41,182],"limitation,":[42],"earlier":[43],"research":[44],"has":[45],"shown":[46],"that":[47,122],"one":[48],"could":[49],"use":[50,220],"individual":[51],"user":[52,86,124],"web":[53],"browsing":[54,73,116],"behavior":[55,125],"to":[56,60,167,199,214],"identify":[57],"imminent":[58],"exposure":[59],"content.":[62],"While":[63],"existing":[64],"methods":[65],"rely":[67],"on":[68,207],"temporal":[69,83,120],"proximity":[70],"(e.g.,":[71,112],"aggregating":[72],"patterns":[74],"over":[75,146,174],"the":[76,99,193,200],"recent":[77],"past),":[78],"they":[79],"do":[80],"not":[81,131],"leverage":[82],"ordering":[84],"in":[85,90,95],"browsing,":[87],"which":[88],"results":[89],"suboptimal":[91],"performance":[92,135,171],"is,":[94],"practice,":[96],"inadequate":[97],"given":[98],"low":[100],"base":[101],"rates":[102],"incidence.":[105],"We":[106,179,190],"introduce":[107],"network":[108],"browser-level":[110],"features":[111],"page":[113],"rank,":[114],"tab":[115],"time)":[117],"model":[121],"captures":[123],"through":[126],"time-series":[128],"representation.":[129],"This":[130],"only":[132],"improves":[133],"classification":[134],"by":[136],"significant":[138],"margin":[139],"(between":[140],"93%":[141],"145%":[143],"F1-score":[144],"improvements)":[145],"previous":[147],"models,":[148],"but":[149],"also":[150,191],"maintains":[151],"strong":[152,165],"robustness":[153],"across":[154],"completely":[155],"disparate":[156],"sets":[157],"users.":[159],"More":[160],"importantly,":[161],"our":[162],"method":[163,183],"shows":[164],"resilience":[166],"concept":[168],"drift,":[169],"as":[170,202,204],"holds":[172],"steady":[173],"multiple":[175],"years":[176],"testing.":[178],"discuss":[180,219],"how":[181],"is":[184,212],"capable":[185],"anticipating":[187],"future":[188],"exposure.":[189],"assess":[192],"relative":[194],"importance":[195],"each":[197],"feature":[198],"performance,":[201],"well":[203],"their":[205],"impact":[206],"false":[208],"positive":[209],"rates\u2014whose":[210],"minimization":[211],"critical":[213],"foster":[215],"adoption.":[216],"Finally,":[217],"we":[218],"cases":[221],"for":[222],"behavior-based":[224],"models.":[225]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}