Fun With N-gram Analysis

This report presents an N-gram (1–6 character) analysis of 250,000 malicious and 250,000 benign domains/URLs to identify character sequences that distinguish malicious domains (e.g., frequent use of '-', letters like j/z/w/y/q, bi-grams like 'te' and TLD sequences 'ch','nl','fr','ru', and longer tokens such as 'porn','free','online','watch') and proposes incorporating these patterns into domain/URL risk scoring and regex-based detection, with plans to expand sample size and analyze by specific threats.