Malicious domains are increasingly common and pose a severe cybersecurity threat. Specifically, many types of current cyber attacks use URLs for attack communications (e.g., C&C, phishing, and spear-phishing). Despite the continuous progress in detecting cyber attacks, there are still critical weak spots in the structure of defense mechanisms. Since machine learning has become one of the most prominent malware detection methods, a robust feature selection mechanism is proposed that results in malicious domain detection models that are resistant to evasion attacks. This mechanism exhibits a high performance based on empirical data. This paper makes two main contributions: First, it provides an analysis of robust feature selection based on widely used features in the literature. Note that even though the feature set dimensional space is cut by half, the performance of the classifier is still improved (an increase in the model’s F1-score from 92.92% to 95.81%). Second, it introduces novel features that are robust with regard to the adversary’s manipulation. Based on an extensive evaluation of the different feature sets and commonly used classification models, this paper shows that models based on robust features are resistant to malicious perturbations and concurrently are helpful in classifying non-manipulated data.

The proliferation of the Internet of Things (IoT) has reshaped the way we interact with technology, propelling the Routing Protocol for Low-Power and Lossy Networks (RPL) into a critical role as a communication framework. Amid this transformative landscape, security vulnerabilities within RPL-based IoT networks emerge as a substantial concern. This survey delves into these vulnerabilities, offering insights into their intricacies, potential consequences, and robust mitigation strategies. Commencing with a foundational understanding of IoT networks and their real-world applications, the survey sets the stage for comprehending the significance of Routing Protocol for Low-Power and Lossy Networks (RPL). It unravels the unique characteristics of RPL networks, their Destination-Oriented Directed Acyclic Graph (DODAG) topologies, and their pivotal role in enabling seamless device communication. The survey then delves into the heart of RPL security vulnerabilities. It navigates through diverse attack vectors, such as rank attacks and version number attacks. Each vulnerability is scrutinized, unraveling its technical mechanisms and implications for network stability. Transitioning from vulnerabilities to resilience, the survey offers a panoramic view of mitigation strategies. It dissects the nuances of intrusion detection systems (IDS), exploring trust models, location-based approaches, and hybrid systems. Signature-based, anomaly-based, and specification-based detection mechanisms are evaluated for their potential to mitigate threats within RPL networks. As standards shape the IoT landscape, the survey underscores the pivotal role of RPL within this framework. It emphasizes the necessity of secure standards in mitigating vulnerabilities across interconnected IoT devices.