Unmasking hidden threats: Enhanced detection of embedded malicious domains in pirate streaming videos

A significant number of malicious domains are hidden within public service websites in cyberspace. Pirated video streaming sites cleverly embed links to illicit content such as pornography and gambling within videos to conduct illegal activities. These contents pose significant threats to the physical and mental health of children and adolescents, yet effective detection and extraction methods are lacking. This paper investigates the embedding of malicious domains in pirated video streaming websites and proposes the Enhanced Detection of Embedded Malicious Domains (EDEMD) framework, which combines webpage text, URL features, and visual information. The study first develops an efficient framework to acquire URLs from public service websites using a dynamic keyword expansion algorithm and search engine APIs. Next, random forest and convolutional neural networks are employed to filter and classify embedded URLs on pirated video streaming pages, achieving accuracy rates exceeding 96% and 98%, respectively. Detection of most pages requires only 0.1 s, with nearly a 100% improvement in detection efficiency for playback pages. Finally, automation web testing tools are used to extract and analyze suspected malicious domains. An analysis of 1,347 pirated video streaming sites uncovers their underlying operational methods. This study provides robust technical support for curbing the spread of malicious domains in pirate videos.