DeepBF: Malicious URL detection using learned Bloom Filter and evolutionary deep learning

With the rapid development of Internet technology, numerous malicious URLs have appeared, which bring a large number of security risks. Efficient detection of malicious URLs has become one of the keys for defense against cyber attacks. Deep learning methods bring new developments to the identification of malicious web pages. This paper proposes a malicious URL detection method based on a bidirectional gated recurrent unit (BiGRU) and attention mechanism. The method is based on the BiGRU model. A regularization operation called a dropout mechanism is added to the input layer to prevent the model from overfitting, and an attention mechanism is added to the middle layer to strengthen the feature learning of URLs. Finally, the deep learning network DA-BiGRU model is formed. The experimental results demonstrate that the proposed method can achieve better classification results in malicious URL detection, which has high significance for practical applications.

The proliferation of malicious URLs poses significant threats to cybersecurity, enabling phishing attacks, malware distribution, and data breaches. Existing detection methods, including blacklists, heuristic rules, and traditional machine learning models, are limited by high false-positive rates, slow adaptability, and inadequate handling of evolving attack patterns. This paper presents a novel hybrid predictive modeling approach that combines deep learning with feature engineering to detect and prevent malicious URLs effectively. Our method leverages a deep neural network architecture enriched with engineered features such as lexical characteristics, URL entropy, and domain-based attributes to capture both structural and contextual patterns of malicious URLs. Experiments conducted on a large-scale dataset demonstrate a detection accuracy of 95%, outperforming conventional machine learning and deep learning-only approaches. Additional metrics, including precision (94%), recall (95%), and F1-score (94.5%), validate the robustness of the proposed system. Comparative analysis highlights the hybrid model’s superior capability to generalize across unseen

In recent years, Web-based attacks have become one of the most common threats. Threat actors tend to use malicious URLs to intentionally deceive users and launch attacks. Several approaches such as blacklisting have been implemented to detect malicious URLs. These unreliable approaches were also accompanied with strenuous task of maintaining an up-to-date blacklist URL database. To detect malicious URLs, machine learning techniques have been explored in recent years. This method analyzes different features of a URL and trains a prediction model on an already existing dataset of both malicious and benign URLs. This paper proposes a MuD (Malicious URL Detection) model which utilizes three supervised machine learning classifiers—support vector machine, logistic regression and Naive Bayes—to effectively and accurately detect malicious URLs. The preliminary results indicate that Naive Bayes algorithm produced best results.

Malicious URLs pose a significant cybersecurity threat, often leading to phishing attacks, malware infections, and data breaches. Early detection of these URLs is crucial for preventing security vulnerabilities and mitigating potential losses. In this paper, we propose a novel approach for malicious URL detection by combining ensemble learning methods with ADASYN-based oversampling to address the class imbalance typically found in malicious URL datasets. We evaluated three popular machine learning classifiers, including XGBoost, Random Forest, and Decision Tree, and incorporated ADASYN (Adaptive Synthetic Sampling) to handle the class-imbalanced nature of our selected dataset. Our detailed experiments demonstrate that the application of ADASYN can significantly increase the performance of the predictive model across all metrics. For instance, XGBoost saw a 2.2% improvement in accuracy, Random Forest achieved a 1.0% improvement in recall, and Decision Tree displayed a 3.0% improvement in F1-score. The Decision Tree model, in particular, showed the most substantial improvements, particularly in recall and F1-score, indicating better detection of malicious URLs. Finally, our findings in this research highlighted the potential of ensemble learning, enhanced by ADASYN, for improving malicious URL detection and demonstrated its applicability in real-world cybersecurity applications.

Malicious URL, a.k.a. malicious website, is a common and serious threat to cyber security. Malicious URLs host unsolicited content (spam, phishing, drive-by downloads, etc.) and lure unsuspecting users to become victims of scams (monetary loss, theft of private information, and malware installation), and cause losses of billions of dollars every year. It is imperative to detect and act on such threats in a timely manner. Traditionally, this detection is done mostly through the usage of blacklists. However, blacklists cannot be exhaustive, and lack the ability to detect newly generated malicious URLs. To improve the generality of malicious URL detectors, machine learning techniques have been explored with increasing attention in recent years. This article aims to provide a comprehensive survey and a structural understanding of Malicious URL Detection techniques using machine learning. We present the formal formulation of Malicious URL Detection as a machine learning task, and categorize and review the contributions of literature studies that addresses different dimensions of this problem (feature representation, algorithm design, etc.). Further, this article provides a timely and comprehensive survey for a range of different audiences, not only for machine learning researchers and engineers in academia, but also for professionals and practitioners in cyber security industry, to help them understand the state of the art and facilitate their own research and practical applications. We also discuss practical issues in system design, open research challenges, and point out important directions for future research.

Learned Bloom Filters (LBFs) have been recently proposed as an alternative to traditional Bloom filters that can reduce the amount of memory needed to achieve a target false positive probability when representing a given set of elements. LBFs rely on Machine Learning models combined with traditional Bloom filters. However, if LBFs are going to be used as an alternative to Bloom filters, their security must be also be considered. In this paper, the security of LBFs is studied for the first time and a vulnerability different from those of traditional Bloom filters is uncovered. In more detail, an attacker can easily create a set of elements that are not in the filter with a much larger false positive probability than the target for which the filter has been designed. The constructed attack set can then be used to for example launch a denial of service attack against the system that uses the LBF. A malicious URL case study is used to illustrate the proposed attacks and show their effectiveness in increasing the false positive probability of LBFs. The dataset under consideration includes nearly 485K URLs where 16.47% of them are malicious URLs. Unfortunately, it seems that mitigating this vulnerability is not straightforward.

Malicious URLs pose a serious threat on the world wide web to users all over the world. The challenges emanating from URLs which are malicious are many and very worrisome to internet users globally. This has informed, and thus propels the development of newer models to solve the lingering challenge in the Cyber Security space. These newer notification and detection models are been developed in other to mitigate the gaps and also curb the challenges caused by unknowingly using or clicking further using a malicious URL. This study aims at developing a novel malicious URL detection and notification model by using CNN and further incorporating CNN with penalty term on kernel, weight and bias in other to increase models detection accuracy, reduce time complexity and also address misclassification issues as well as poor prediction accuracy. The CNN with penalty term is being used against Logistic Regression (LR) and Recurrent Gated Units (RNN- GRU) which increased the resilience of the suggested model as well as enhancing classification prediction. The diagnostic tools employed for the proposed model are accuracy, confusion matrix, precision, recall, F1 score, and AUC-ROC. This study outlined a novel method capable of identifying malicious URLs using features primarily obtained from the phishing and real URL addresses. A temporal tokenizer was generated and used for URL text processing which scanned, recognized characters, symbols and redundant tokens. This made it easier to separate specific features from the URL address and return as a list while also identifying directories, keyword arguments, and extensions. Summary of the experimental results shows that the proposed CNN with penalty term (98.2%) fared better than LR and RNN-GRU approaches which yielded a recommendable prediction accuracy of 89.85% and 91.5% respectively.

Malicious URLs have become an important attack vector used by attackers to perpetrate cybercrimes, how to effectively detect malicious URLs is an important and urgent problem to be solved. Due to current feature based malicious URLs detection models need manual feature engineering, and deep learning based models have their limit on processing long sequences, which reduces the detection performance. We proposed an attentional based BiLSTM model AB-BiLSTM for the Malicious URLs detection in this paper. Firstly, the URLs were preprocessed and converted into word vectors by using pre-trained Word2Vec, then BiLSTM combined with an attention mechanism was trained to extract URL sequences features and classify them. The model was tested on collected dataset, the experimental results show that our proposed model can achieve the accuracy of 98.06%, the precision rate of 96.05, the recall rate of 95.79% and the F1 Score of 95.92%, which achieved better performance than other comparison traditional machine learning based and deep learning based models.

URL detection is an important task in the field of Internet security. To address the problems of low model accuracy and weak generalization ability to exist machine-learning-based malicious URL detection methods, a URL classification method based on a combination of the BERT model and the convolutional neural network (CNN) is proposed. First, a regular expression-based approach is used to achieve pre-processing of URL data; second, a malicious URL classification method combining BERT pre-training model and CNN is designed to effectively handle contextual relevance and local features in malicious URL detection tasks; finally, experiments are conducted on a dataset of more than 30,000 URLs to evaluate its performance and efficiency. The experimental results show that the Bert-CNN model outperforms other deep-learning-based and traditional methods in terms of accuracy, and our model achieves a 99.5% accuracy on the test dataset.

Bloom filters are widely used in many network applications but the high computation cost limits the system performance. In this paper, we introduce a new variation of Bloom filter named One-Hashing Bloom Filter (OHBF) to solve the problem. OHBF requires only one base hash function plus a few simple operations to implement a Bloom filter. While keeping nearly the same theoretical false positive ratio as an ideal Bloom filter, OHBF significantly reduces the hash computation overhead. We show that the false positive performance of a standard Bloom filter implementation strongly relies on the selection of hash functions, even if these hash functions are considered good. In contrast, OHBF presents consistently better performance with a proven mathematical foundation. OHBF is ideal for high throughput and low latency applications. As OHBF is a fundamental technique in Bloom filter theory, it can be applied to many other Bloom filter variations, such as Counting Bloom Filter and Space-Code Bloom Filter.

Network information security risks multiply and become more dangerous. Hackers today generally target end-to-end technology and take advantage of human weaknesses. Furthermore, hackers take advantage of technology weaknesses by applying various methods to attack. Nowadays, one of the greatest dangers to the modern digital world is malicious URLs, and stopping them is one of the biggest challenges in the field of cyber security. Detecting harmful URLs using machine learning and deep learning algorithms have been the subject of various academic papers. However, time and accuracy are the two biggest challenges of these tools. This paper proposes a multilayer perceptron (MLP) model that utilizes two significant aspects to make it more practical, lightweight, and fast: Using only lexical features and a decision tree (DT) algorithm to select the best relevant subset of features. The effectiveness of the experimental outcomes is evaluated in terms of time, accuracy, and error reduction. The results show that a MLP model using 35 features could achieve an accuracy of 94.51% utilizing only URL lexical features. Furthermore, the model is improved in time after applying the DT as feature selection with a slight improvement in accuracy and loss.

In today's era, with the continuous development of the internet, surfing the internet has become an inseparable part of our lives. For those who frequently roam the internet, URLs are information that we are constantly exposed to. And YRL is also divided into malicious and normal. Clicking on malicious URLs can cause certain losses to our internet tools, and in severe cases, it can even lead to money theft. Malicious URL detection is an important task in the field of network security, aimed at identifying and preventing potential network attacks and malicious activities. Traditional malicious URL detection methods, such as Blacklist based detection and Machine learning based on feature extraction, have achieved certain results, but face challenges in real-time, accuracy, and data requirements. Therefore, this article proposes the use of Quantum Long Short-Term Memory Neural Network (QLSTM) to solve this problem. By observing the accuracy, recall, and F1 values obtained from training a large amount of data on the QLSTM network, it is shown that this method is feasible.

Nowadays, machine learning is used in many fields. Not only in fields such as image recognition, machine learning is also used for malicious detection. Especially in recent years, there have been many studies using machine learning for malicious URL detection to replace traditional blacklists. In order to compare the performance of the malicious URLs detection method, researches used the F-score or other detection accuracy to evaluate, but there are some difficulties in evaluating the URL embedding method used in malicious URLs detection because the detection accuracy is also effect by machine learning or deep learning models and data sets. An evaluation method of URL embedding method that is not affected by other factors is particularly important. In this paper, we proposed an intrinsic evaluation method for URL embedding method that is not affected by machine learning models or deep learning models and data sets. Besides, We analyse some URL embedding methods according to intrinsic and extrinsic methods and offer a guidance in selecting suitable embedding methods in URL by analysing the results.

Malicious web URLs hold various forms, including malware delivery, phishing, Spam/scam, or C2 (Command and Control) URLs. The attackers embed these malicious URLs in seemingly legitimate communications, such as emails, SMS messages, or social media posts, to trick victims and compromise extremely sensitive data or disrupt legitimate services. Once the victim clicks on the malicious link, it is commonly directed to malicious websites where malware installation, backdoor creation, or credential and financial data theft occurs. Many recent studies have proposed Artificial intelligence-based methods to detect malicious websites rather than using traditional blacklist and whitelist-based methods. However, these existing works rely on limited feature sets and a limited set of machine learning algorithms to develop models, which often leads to less accurate results. This study addresses this gap by systematically evaluating nine machine learning algorithms, including Logistic Regression (LR), Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Decision Tree (DT), Naïve Bayes (NB), XGBoost (XGB), Multilayer Perceptron Network (MLP), and Voting Classifier (VC), for malicious URL classification along with 52 distinct features for model training and evaluation, and has achieved the highest accuracy of 97.28% with the XGBoost algorithm. Furthermore, this research introduces a prototype web application for malicious URL detection that allows users to select dual input modalities, including textual URL strings and image-based sources. The main model uses the XGBoost classifier for text-based classification and integrates an OCR-based module to extract URLs from screenshots or images and pass the results to the main model to detect malicious URLs. The image-based detection method offers users a safer way to check suspicious URLs without directly copying by clicking on them, thereby minimizing the risk of accidentally opening a malicious link.

The detection of fraudulent URLs that lead to malicious websites using addresses similar to those of legitimate websites is a key form of defense against phishing attacks. Currently, in the case of Internet of Things devices is especially relevant, because they usually have access to the Internet, although in many cases they are vulnerable to these phishing attacks. This paper offers an overview of the most relevant techniques for the accurate detection of fraudulent URLs, from the most widely used machine learning and deep learning algorithms, to the application, as a proof of concept, of classification models based on quantum machine learning. Starting from an essential data preparation phase, special attention is paid to the initial comparison of several traditional machine learning models, evaluating them with different datasets and obtaining interesting results that achieve true positive rates greater than 90%. After that first approach, the study moves on to the application of quantum machine learning, analysing the specificities of this recent field and assessing the possibilities it offers for the detection of malicious URLs. Given the limited available literature specifically on the detection of malicious URLs and other cybersecurity issues through quantum machine learning, the research presented here represents a relevant novelty on the combination of both concepts in the form of quantum machine learning algorithms for cybersecurity. Indeed, after the analysis of several algorithms, encouraging results have been obtained that open the door to further research on the application of quantum computing in the field of cybersecurity.