# A Study on the Measuring Methods of Website Security Risk Rate
## 2 Related Research
### Machine Learning (ML)-Based Website Security Threat Analysis  
Attackers are evolving by continuously seeking ways to avoid detection techniques because they are aware of the website's security threat detection system Security experts have limitations in defending evolving attackers to evade existing detection systems [10]. Accordingly, to detect security threats, many websites are responding through machine learning (ML). The detection system using ML learns the executable file for the PE (portable executable) structure in the form of EXE and DLL [11]. The PE structure is the file structure of the executable downloaded from the website, which can also be checked for similarities to malware. Additionally, it learns nonex executable (Non-PE) structures such as standard document files and scripts. As shown in (Figure 4), this analysis checks the similarity of files hidden on the website to be inspected for maliciousness. For example, when checking the website IP registered on Google Virustotal, it can be seen that more than 30 phishing domains are registered [12]. Figure 3: Security threat analysis of websites based on similarity hash. Figure 2: Dynamic analysis of security threats on website. In the same way, most of the methods for measuring security threats on a website are building a DB by crawling website source files and collecting executable files distributed on the website, which are presented in (Table 1). Items that measure website risk were analyzed as inspection method, inspection technology, inspection speed, zero-day detection, and Accuracy. The inspection method refers to the website malicious code detection method, and the inspection technology refers to the information collection method. Inspection speed is the detection speed, zero-day detection is the detection of unknown malicious code, and Accuracy refers to the accuracy. The static analysis method registers malicious code patterns and then collects and checks website sources through web crawling. It has the advantage of being fast because it checks patterns. However, it has the disadvantage of being unable to detect nonregistered zero-day malware. In addition, the accuracy is very good with registered pattern searches. Dynamic analysis connects the website to the virtualized PC environment to determine whether it is dangerous through abnormal behavior analysis. The inspection technology uses a virtualized PC, which takes some time for risk behavior analysis. It can detect even zero-day malicious codes through behavioral analysis and has excellent accuracy. Similarity hash analysis technology configures a dataset for each type of malicious code to determine similarity hash values and similarity to files collected from the website. The inspection technology is a similarity hash technology for malicious codes, and the inspection speed is high. Zero-day detection is also possible, but the accuracy is moderate. ML learning analysis constructs malicious code and standard file datasets to predict the risk of files collected on the website after performing ML learning. The inspection technology is ML learning for malicious and standard code, and the inspection speed is high. Zero-day detection is possible, and accuracy is excellent, depending on the amount of learning.