A Hybrid Deep Learning and Anomaly Detection Framework for Real-Time Malicious URL Classification

2025-11-30

AI Summary

Malicious URLs constitute a primary vector for phishing and malware distribution, necessitating real-time detection methods with low latency and high robustness. This paper proposes a multi-stage classification framework integrating deep learning and anomaly detection. First, lightweight statistical features are extracted via hash-based n-gram vectorization. Second, Isolation Forest is employed for anomaly filtering to enhance robustness against obfuscated URLs. Finally, a lightweight neural network performs binary classification. The system incorporates SMOTE for class imbalance mitigation, a multilingual Tkinter-based GUI, and clipboard-triggered automatic scanning. Evaluated on public benchmark datasets, the model achieves 96.4% accuracy, 95.4% F1-score, and 97.3% ROC-AUC, with an average inference latency of only 20 ms per sample—50–100× faster than CNN- or SVM-based baselines. These advances significantly improve practical deployability and scalability for real-time URL threat detection.

Technology Category

• Machine Learning: Multi-class/Multi-label Learning & Extreme Classification
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Web Mining and Content Analysis: Large pretrained models with web data
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Malicious URLs remain a primary vector for phishing, malware, and cyberthreats. This study proposes a hybrid deep learning framework combining exttt{HashingVectorizer} n-gram analysis, SMOTE balancing, Isolation Forest anomaly filtering, and a lightweight neural network classifier for real-time URL classification. The multi-stage pipeline processes URLs from open-source repositories with statistical features (length, dot count, entropy), achieving $O(NL + EBdh)$ training complexity and a 20,ms prediction latency. Empirical evaluation yields 96.4% accuracy, 95.4% F1-score, and 97.3% ROC-AUC, outperforming CNN (94.8%) and SVM baselines with a $50! imes$--$100! imes$ speedup (Table~ ef{tab:comp-complexity}). A multilingual Tkinter GUI (Arabic/English/French) enables real-time threat assessment with clipboard integration. The framework demonstrates superior scalability and resilience against obfuscated URL patterns.

Problem

• Real-time classification of malicious URLs using hybrid deep learning
• Addressing phishing and malware threats with anomaly detection techniques
• Enhancing detection accuracy and speed for cybersecurity applications

Innovation

• Hybrid deep learning with anomaly detection for URL classification
• Multi-stage pipeline using n-gram analysis and SMOTE balancing
• Lightweight neural network achieving real-time prediction latency