A Novel Approach for Malicious URL Detection Based on the Joint Model

Abstract

The number of malicious websites is increasing yearly, and many companies and individuals worldwide have suffered losses. Therefore, the detection of malicious websites is a task that needs continuous development. In this study, a joint neural network algorithm model combining the attention mechanism, bidirectional independent recurrent neural network (Bi-IndRNN), and capsule network (CapsNet) is proposed. The word vector tool word2vec trains the character- and word-level uniform resource locator (URL) static embedding vector features. At the same time, the algorithm will also extract texture fingerprint features that can compare the content differences of different malicious web URL binary files. Then, the extracted features are fused and input into the joint neural network algorithm model. First, the multihead attention mechanism is used to extract contextual semantic features by adjusting weights and Bi-IndRNN. Second, CapsNet with dynamic routing is used to extract deep semantic information. Finally, the sigmoid classifier is used for classification. This study uses different methods from different angles to extract more comprehensive features. From the experimental results, the method proposed in this study improves the classification accuracy of malicious web page detection compared with other researchers.

A Review on Malicious URLs Detection Using Machine Learning Methods

“…Researchers use diverse datasets, including sources like PhishTank, Kaggle, CommonCrawl, GitHub, Phishstorm, Malcode, and DomainTools, to assess network detection and classification model efficacy, ensuring robustness and realworld relevance. In malicious website detection studies, features like HTML, JavaScript code, WHOIS host information, and web URL characteristics are manually extracted and incorporated into machine learning or heuristic systems for effective detection [5]. The training dataset for a classification model comprised 5 million URLs from Openphish, Alexa whitelists, and internal FireEye sources, maintaining a balanced 60-40 split between benign and malicious URLs [8].…”

“…Since they are usually disguised to resemble trustworthy websites, they pose a threat to unwary users. According to a survey by Kaspersky [5], 173 million dangerous URLs were detected by web security software in 2020. Additionally, the report also indicated that 66.07% of the malicious URLs were 20 of the most recent harmful apps.…”

Detecting Malicious URLs Using Machine Learning Techniques: Review and Research Directions

“…They used two datasets: the first dataset (DS1) was compiled from PhishTank[14] and Alexa [16]. The second dataset (DS2) was a bench-mark dataset used by Sahingoz et al [130] from PhishTank[14] and Yandex [137]. They extracted lexical features (character embedding features) using the CNN model and classified multilevel features using RF classifiers.…”

Malicious URL Classification Using Artificial Fish Swarm Optimization and Deep Learning

“…In general, malicious URLs can be identified with the help of Machine Learning (ML) technique through two steps as detailed herewith. At first, a suitable feature indication is obtained from the URL, and secondly, based on the feature identified, ML-related prediction methods are provided training to find out the malicious URLs [7,8]. The first step discussed above i.e., attaining the feature indication in which fruitful information regarding the URL is saved in a vector so that the ML methods can be implied to it.…”