Malicious URL Detection based on Machine Learning

In recent years cyberattacks have become destructive and targeted. With technological advancements, diverse threats are launching in a sophisticated way that targets people to defraud them. Many web applications have been struggling to improve the reliability and security of their platforms to protect users from fraud, revenue, or malware. These attacks use malicious uniform resource locators (URLs) to attack web users. These URLs host unwanted content in the form of junk emails, phishing, or unauthorized drive-by downloads. Unsuspecting people click these phishing URLs and become victims of unethical anonymous activities like identity theft (personal or financial details) and installation of viruses. Therefore, it is necessary to detect malicious URLs accurately for resolving security issues. Traditional protection method, such as blacklisting, remains a classical technique for the detection of malicious URLs due to its simplicity but cannot detect unknown malicious URLs; hence, machine learning approaches are being used for achieving better results. This chapter aims to provide a structural understanding of popular feature extraction techniques and machine learning algorithms.KeywordsMalicious URLFeature extractionBlacklistingMachine learning

As cybercrimes grow in scale with devastating economic costs, it is important to protect potential victims against diverse attacks. It is the uniform resource locators (URLs) that connect vulnerable users with potential attacks. Although numerous solutions (e.g., rule-based solutions and machine learning-based methods) are proposed for malicious URL detection, they can not provide robust performance due to the diversity of cybercrimes and can not cope with the explosive growth of malicious URLs with the evolution of obfuscation strategies. In this paper, we propose a deep learning-based system, dubbed as CyberLen, to detect malicious URLs robustly and effectively. Specifically, we use factorization machine (FM) to learn the latent interaction among lexical features. For the deep structural features, position embedding is introduced for token vectorization to reduce the ambiguity of URL tokens. Meanwhile, temporal convolution network (TCN) is utilized to learn the long-distance dependency among URL tokens. To fuse heterogeneous features, self-paced wide & deep learning strategy is proposed to train a robust model effectively. The proposed solution is evaluated on a large-scale URL dataset. Our experimental results show that position embedding is constructive to reducing the ambiguity of URL tokens, and the self-paced wide & deep learning strategy shows superior performance in terms of F1 score and convergence speed.

In today’s world, phishing attacks are gradually increasing, resulting in individuals losing valuables, assets, personal information, etc., to unauthorized parties. In phishing, attackers craft malicious websites disguised as well-known, legitimate sites and send them to individuals to steal personal information and other related private details. Therefore, an efficient and accurate method is required to determine whether a website is malicious. Numerous methods have been proposed for detecting malicious uniform resource locators (URLs) using deep learning, machine learning, and other approaches. In this study, we have used malicious and benign URLs datasets and have proposed a detection mechanism for detecting malicious URLs using recurrent neural network models such as long short-term memory (LSTM), bidirectional long short-term memory (Bi-LSTM), and the gated recurrent unit (GRU). Experimental results have shown that the proposed mechanism achieved an accuracy of 97.0% for LSTM, 99.0% for Bi-LSTM, and 97.5% for GRU, respectively.

The rapid proliferation of malicious Uniform Resource Locators (URLs) presents a serious cybersecurity threat, enabling phishing attacks, malware dissemination, and financial fraud. Conventional detection mechanisms, such as blacklisting and rule-based systems, are largely reactive and struggle to keep pace with dynamically generated and zero-day malicious URLs. Blacklisting methods fail to identify newly created threats, while rule-based approaches rely on predefined heuristics that are ineffective against evolving attack patterns. To address these limitations, this research proposes a multi-objective feature selection and XGBoost-based phishing detection framework aimed at improving classification accuracy and detection robustness. A comprehensive dataset containing both benign and malicious URLs is constructed, followed by extensive feature extraction encompassing lexical, host-based, and network-level attributes. A multi-objective optimization strategy is employed to select the most informative feature subset, reducing redundancy while enhancing model performance. The optimized feature set is then utilized to train an Extreme Gradient Boosting (XGBoost) classifier, which effectively captures complex nonlinear patterns associated with phishing URLs. Experimental evaluation demonstrates improved detection accuracy and generalization capability, enabling proactive identification of previously unseen malicious URLs. The proposed approach offers a scalable, adaptive, and efficient solution for modern phishing detection systems.

Cascaded capsule twin attentional dilated convolutional network for malicious URL detection

The increasing volume of malicious content in social networks requires automated methods to detect and eliminate such content. This paper describes a supervised machine learning classification model that has been built to detect the distribution of malicious content in online social networks (ONSs). Multisource features have been used to detect social network posts that contain malicious Uniform Resource Locators (URLs). These URLs could direct users to websites that contain malicious content, drive-by download attacks, phishing, spam, and scams. For the data collection stage, the Twitter streaming application programming interface (API) was used and VirusTotal was used for labelling the dataset. A random forest classification model was used with a combination of features derived from a range of sources. The random forest model without any tuning and feature selection produced a recall value of 0.89. After further investigation and applying parameter tuning and feature selection methods, however, we were able to improve the classifier performance to 0.92 in recall.

Breast cancer is one of the most prevalent and chronic disease that affect women. To overcome this disease, effective medical treatment is required. Early detection of the disease plays an important role for suitable medication and survival of patient. To identify the breast cancer in the patients, standard imaging technique mammography is used. Due to the subtle and varied nature of cancer tissues interpreting mammogram images can be a challenge to doctors. Machine learning (ML) and Deep Learning (DL) techniques offer promising solutions that provide efficient breast cancer detection from mammograms. In this review paper a comprehensive review of ML and DL algorithms and their applications in mammogram image analysis are presented. Various supervised and unsupervised learning techniques, such as convolutional neural networks (CNNs), support vector machines (SVMs), random forests, and other popular ML and DL models are discussed in paper. The integration of these DL methods that are efficiently used in image preprocessing techniques, feature extraction, and classification strategies. The overall survey focusses on various performance metrics, datasets, and benchmarks used in existing studies. Further the strengths and limitations of different approaches used by various researchers are identified. By understating current research trends this paper aims to contribute to the ongoing development of more accurate and reliable breast cancer detection systems using advanced ML techniques.

Phishing scams are internet frauds that target people by sending them harmful links. Many victims ranging from individuals to big companies, have suffered numerous losses due to phishing, highlighting the increasing need to effectively detect and prevent a phishing attack as soon as it is received. This paper applied machine and deep learning models to detect phishing attacks by natural language processing of Uniform Resource Locators. Machine learning algorithms such as Logistic Regression and Multi-Naive Bayes were used Uniform Resource Locators for classification of legitimate and phishing. Additionally, Long Term Short Memory, Gated Recurrent Units, and Bidirectional Recurrent Neural Networks were used as Deep Learning models. Two of the used models are Long Term Short Memory and Gated Recurrent Units models possess significantly high training and validation scores with an overall accuracy of 95%. The Bidirectional Recurrent Neural Net using Gated Recurrent Units and Bidirectional Recurrent Neural Net using LTSM shows 97% accuracy. Therefore, using multiple deep learning models to predict whether URLs are phishing or legitimate is a significant assistance in reviewing websites. Further research for other parameters aside from using Uniform Resource Locators with different deep learning models can be used to improve the accuracy of phishing detection.

So far, the University KH A. Wahab Hasbullah cooperative service system. to customers is done manually even small things such as customer questions to cooperatives regarding the availability and price of an item must be done manually and of course it is very disturbing ease of shopping and tends to waste time for customers. Telegram messenger is a social messenger or chat media that has a lot of unique features that are free so it is very beneficial to use for the general public, one of its unique features is its telegram-bot (Telegram BOT). Telegram BOT Api is a robot created with a program that can perform many instructions given by the creator or user, this bot itself is just a telegram account running on software that has artificial intelligence features. This telegram api bot offers developers to make it easier to retrieve data and process it into useful information. Telegram bot itself is divided into two, namely the mobile version (telegram bot) and the web version. The result of this research is that this mobile application is managed using a webhook as the communication method. This method is used because it is very easy and bots do not have to update data regularly because one of them is placed in the Uniform Resource Locator (URL). And if there is an incoming message, it will be directly displayed at the specified URL and will then be forwarded to the bot for processing. This telegram api bot offers developers to make it easier to retrieve data and process it into useful information. Telegram bot itself is divided into two, namely the mobile version (telegram bot) and the web version. The result of this research is that this mobile application is managed using a webhook as the communication method. This method is used because it is very easy and bots do not have to update data regularly because one of them is placed in the Uniform Resource Locator (URL). And if there is an incoming message, it will be directly displayed at the specified URL and will then be forwarded to the bot for processing. This telegram api bot offers developers to make it easier to retrieve data and process it into useful information. Telegram bot itself is divided into two, namely the mobile version (telegram bot) and the web version. The result of this research is that this mobile application is managed using a webhook as the communication method. This method is used because it is very easy and bots do not have to update data regularly because one of them is placed in the Uniform Resource Locator (URL). And if there is an incoming message, it will be directly displayed at the specified URL and will then be forwarded to the bot for processing. The result of this research is that this mobile application is managed using a webhook as the communication method. This method is used because it is very easy and bots do not have to update data regularly because one of them is placed in the Uniform Resource Locator (URL). And if there is an incoming message, it will be directly displayed at the specified URL and will then be forwarded to the bot for processing. The result of this research is that this mobile application is managed using a webhook as the communication method. This method is used because it is very easy and bots do not have to update data regularly because one of them is placed in the Uniform Resource Locator (URL). And if there is an incoming message, it will be directly displayed at the specified URL and will then be forwarded to the bot for processing.

Phishing is a type of social engineering attack with an intention to steal user data, including login credentials and credit card numbers, leading to financial losses for both organizations and individuals. It occurs when an attacker, pretending as a trusted entity, lure a victim into click on a link or attachment in an email, or in a text message. Phishing is often launched via email messages or text messages over social networks. Previous research has revealed that phishing attacks can be identified just by looking at uniform resource locator (URLs). Identifying the techniques which are used by phishers to mimic a phishing URL is rather a challenging issue. At present, we have limited knowledge and understanding of how cyber‐criminals attempt to mimic URLs with the same look and feel of the legitimate ones, to entice people into clicking links. Therefore, this paper investigates the feature selection of phishing URLs (uniform resource locators), aiming to explore the strategies employed by phishers to mimic URLs that can obviously trick people into clicking links. We employed an information gain (IG) and Chi‐Squared feature selection methods in machine learning (ML) on a phishing dataset. The dataset contains a total of 48 features extracted from 5000 phishing and another 5000 legitimate URL from web pages downloaded from January to May 2015 and from May to June 2017. Our results revealed that there were 10 techniques that phishers used to mimic URLs to manipulate humans into clicking links. Identifying these phishing URL manipulation techniques would certainly help to educate individuals and organizations and keep them safe from phishing attacks. In addition, the findings of this research will also help develop anti‐phishing tools, framework or browser plugins for phishing prevention.

A comprehensive review on detection of plant disease using machine learning and deep learning approaches

Structured Query Language injection (SQLi) attack is a code injection technique where malicious SQL statements are inserted into a given SQL database by simply using a web browser. Injected SQL commands can alter the database and thus compromise the security of a web application. In our previous work, we proposed an effective pattern recognition Neural Network (NN) model for detection and classification of the SQLi attacks. Our proposed model was built from: a Uniform Resource Locator (URL) generator, a URL classifier, and a NN model. The URL generator was implemented in order to generate thousands of malicious and benign URLs. The URL classifier was employed in order to identify each URL, which was generated by the URL generator, as either a benign URL or a malicious URL. The URL classifier also pigeonholed the malicious URLs into seven popular SQLi attack categories. The NN model includes n hidden layers with x input and y output nodes where the benign and malicious URLs were employed for training, validating, and testing phases. Addressing our previous captured results, our proposed pattern recognition NN model for the detection and classification of the SQLi attacks demonstrated a good performance in terms of accuracy, true-positive rate, and false-positive rate. In this paper, we stress test our previous proposal in order to prove the effectiveness of our proposed approach.

The phishing is a technique used by cyber-criminals to impersonate legitimate websites in order to obtain personal information. This paper presents a novel lightweight phishing detection approach completely based on the URL (uniform resource locator). The mentioned system produces a very satisfying recognition rate which is 95.80%. This system, is an SVM (support vector machine) tested on a 2000 records data-set consisting of 1000 legitimate and 1000 phishing URLs records. In the literature, several works tackled the phishing attack. However those systems are not optimal to smartphones and other embed devices because of their complex computing and their high battery usage. The proposed system uses only six URL features to perform the recognition. The mentioned features are the URL size, the number of hyphens, the number of dots, the number of numeric characters plus a discrete variable that correspond to the presence of an IP address in the URL and finally the similarity index. Proven by the results of this study the similarity index, the feature we introduce for the first time as input to the phishing detection systems improves the overall recognition rate by 21.8%.

Coastal aquifers are vital for sustaining ecosystems and providing freshwater for agriculture and domestic use. However, rising groundwater salinity in these regions demands innovative approaches for accurate modeling and prediction. In recent decades, machine learning (ML) and deep learning (DL) techniques have been extensively used across various water resource management fields, often yielding promising outcomes. This review examines the growing usage of ML and DL techniques in modeling groundwater salinity in coastal aquifers. The analysis is based on 104 peer-reviewed journal articles including the review articles indexed in PubMed, ScienceDirect, Google Scholar, Scopus, and SpringerLink using keywords like "saltwater intrusion", "machine learning", “deep learning”, and "groundwater salinity". The review discusses recent advancements, challenges, and future directions for improving ML model accuracy and applicability. Studies reveal an increasing reliance on ML techniques to predict groundwater salinity and manage seawater intrusion across various coastal geological settings. Researchers have employed a range of ML models, from traditional methods like Artificial Neural Networks and Adaptive Neuro Fuzzy Inference Systems to advanced DL-based models like Convolutional Neural Networks and Long Short-Term Memory Networks, often using ensemble methods to enhance accuracy. Key findings include the top-tier output of ensemble and optimized models, including Random Forest and Grasshopper Optimization Algorithm-XGBoost. These studies highlight the importance of model selection, input variable ranking, and computational efficiency, demonstrating ML's global relevance in environmental management. The review highlights the prospects of ML, DL, and ensemble models to redefine groundwater management in coastal aquifers, offering more effective and sustainable solutions to the challenges posed by groundwater salinity and saltwater intrusion. Future advancements will focus on further integrating DL, explainable artificial intelligence, and ensemble approaches, along with other innovative techniques, to explore sparsely studied variables, model new or unique study areas, and apply ML methods for managing groundwater salinity.

As the cyber threats increase in complexity and frequency, the defect reactive and rule-based approaches have given insufficient results for securing the crucial digital infrastructures. The experts provide a detailed review of the Artificial Intelligence (AI)-based forensic devices developed to improve the real-time threat mitigation and anomaly identification across various cybersecurity environments. The research starts by assessing the wide region of cybersecurity, highlighting the requirement for adaptive learning, continuous monitoring and scalable defense models regardless of insider threats, zero-day exploits and polymorphic attacks. Further, it narrows the concentration to the integration of AI in digital forensics, where deep learning techniques are leveraged to categorize the anomalous behavior, recognize intrusion patterns and predict future attack factors. This work presents a digital forensic investigation approach that has evolved into a multifaceted discipline, requiring the integration of diverse analytical methods to effectively investigate cyber incidents. This is a unified analytical framework that holistically analyzes digital assets by integrating three distinct investigation domains, such as email author attribution with email body contextual analysis, Uniform Resource Locator (URL) classification, and network traffic analysis. The framework is designed as a sequential pipeline, dynamically interconnected, with each stage enhancing the subsequent one through feedback loops and behavioral correlation. In the first stage, the email author attribution for forensic purposes is done using a Deep Neural Network (DNN) and model-based clustering, and then the contextual forensic analysis of emails based on the email body is done using the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm. Emails with suspicious links initiate the second stage of the process, where the URL classification is carried out using the Light Gradient Boosting (LGB), which effectively detects the malicious activities through this classified URL. Detected malicious URLs inform and direct the targeted monitoring during the third stage, where the network traffic is examined. In this stage, intrusion detection and network packet classification are executed using a Coordinate Attention-based Gated Recurrent Unit (CA-GRU) model, allowing for robust intrusion detection in modern, privacy-preserving communication systems. The developed framework is adaptable, evolving with emerging threats and scalable for diverse use cases, making it an essential tool for both small-scale and enterprise-level forensic investigations. Finally, experimental validation is done to ensure the effectiveness of the developed model in cyber investigations.