🤖 AI Summary
Malicious URL detection faces challenges in identifying novel and obfuscated URLs, while traditional blacklist-based approaches suffer from poor generalization. To address this, we propose an end-to-end deep learning model that jointly integrates Graph Neural Networks (GNNs), Graph Attention Networks (GATs), and Long Short-Term Memory (LSTM) networks. Specifically, URLs are modeled as character-level graphs; GATs capture salient local topological patterns, while LSTMs encode long-range sequential dependencies—enabling, for the first time, unified representation of both structural and sequential URL characteristics within a single framework. Robustness is further enhanced via one-hot encoding, domain-informed feature engineering, and class-balanced sampling. Evaluated on a large-scale dataset of 650,000 URLs, the model achieves an accuracy of 0.9806 and a weighted F1-score of 0.9804, demonstrating significantly improved generalization to previously unseen and morphed malicious URLs.
📝 Abstract
Malicious URLs pose significant security risks as they facilitate phishing attacks, distribute malware, and empower attackers to deface websites. Blacklist detection methods fail to identify new or obfuscated URLs because they depend on pre-existing patterns. This work presents a hybrid deep learning model named GNN-GAT-LSTM that combines Graph Neural Networks (GNNs) with Graph Attention Networks (GATs) and Long Short-Term Memory (LSTM) networks. The proposed architecture extracts both the structural and sequential patterns of the features from data. The model transforms URLs into graphs through a process where characters become nodes that connect through edges. It applies one-hot encoding to represent node features. The model received training and testing data from a collection of 651,191 URLs, which were classified into benign, phishing, defacement, and malware categories. The preprocessing stage included both feature engineering and data balancing techniques, which addressed the class imbalance issue to enhance model learning. The GNN-GAT-LSTM model achieved outstanding performance through its test accuracy of 0.9806 and its weighted F1-score of 0.9804. It showed excellent precision and recall performance across most classes, particularly for benign and defacement URLs. Overall, the model provides an efficient and scalable system for detecting malicious URLs while demonstrating strong potential for real-world cybersecurity applications.