Malicious URL Detection Using AI/ML: A Multi-Class Classification Approach

According to recent Symantec Information Security Threat reports, spamming, phishing, and malware attacks cause severe business, financial, and personal security impacts. Cyber threats frequently rely on injection attacks—such as Cross-Site Scripting (XSS), JavaScript injection, and clickjacking—delivered via malicious URLs.

Traditional detection approaches in the industry include:

1. Blacklisting URLs: Highly accurate for known threats, but completely fails against newly created or unknown URLs.
2. Static & Dynamic Analysis: Offers deeper inspection, but fails to keep pace with the rapidly changing dynamics of modern web attacks.
3. Heuristic-Based Analysis: Rule-driven, requiring continuous manual rule updating.

To overcome these limitations, this article presents a scalable, high-accuracy Multi-Class Classification Machine Learning framework capable of detecting malicious URLs in real time.

Key Contributions & Highlights

• 110 Novel Features: Engineered a comprehensive feature set including Lexical, Domain Name, and URL Source properties.
• Short URL Integration: Included shortened URLs (e.g., bit.ly, tinyurl) in the dataset to capture deceptive redirection tactics often ignored in earlier literature.
• High Accuracy: Achieved 95% classification accuracy using Logistic Regression with comprehensive feature sets.
• Production-Ready Architecture: Designed to be exposed as a lightweight HTTP REST API for seamless integration with downstream web security services.

Architecture Framework

The proposed pipeline consists of five major stages: Data Collection, Data Pre-processing, Feature Engineering, Model Training / Classification, and Evaluation.

[ Raw URLs ] ---> [ Feature Extraction (110 Features) ] ---> [ Data Pre-processing ] 
                                                                     |
[ REST API / Security Engine ] <--- [ 95% Accuracy Model ] <--- [ Classifier Training ]

1. Data Collection

The dataset consists of 651,191 labeled URLs, structured with two core features: URL string and Type (Safe vs. Malicious).

| Class | Total Count | Percentage | | :--- | :--- | :--- | | Safe URLs | 428,103 | 65.7% | | Malicious URLs | 223,088 | 34.3% | | Total Dataset | 651,191 | 100% |

2. Feature Extraction & Engineering

We extracted 110 features across four specialized categories:

2.1 Lexical Features (URL Textual Properties)

Lexical features extract statistical and structural signals directly from the URL string.

• Shannon Entropy: Measures randomness in the URL string. Malicious URLs exhibit significantly higher entropy due to obfuscation tactics.
• Word-Based Features: Binary indicators identifying key domain keywords (e.g., paypal, bank, secure).
• Suspicious Word & Extension Features: Flags binary indicators for sensitive actions (login, signin, account) and executable/archive extensions (.exe, .zip, .rar, .php, .js).

2.2 Domain-Based Features

25 features extracted from domain attributes, including domain name length, digit-to-letter ratio, sub-domain counts, and domain-level Shannon Entropy.

2.3 Shortened URL Features

Detects shortening services used by attackers to mask destination endpoints. Features track the expanded destination length and shortener binary flags.

2.4 Special Character Frequency

Counts occurrences of structural special characters prone to abuse: *, @, //, ?, =, %, and -.

3. Python Feature Extraction Implementation

Here is how Shannon Entropy and key lexical features are computed in Python:

import math
from collections import Counter
from urllib.parse import urlparse

def calculate_shannon_entropy(url_string: str) -> float:
    """Calculates the Shannon Entropy of a URL string to measure randomness."""
    if not url_string:
        return 0.0
    
    length = len(url_string)
    counts = Counter(url_string)
    entropy = -sum((count / length) * math.log2(count / length) for count in counts.values())
    return round(entropy, 4)

def extract_lexical_features(url: str) -> dict:
    """Extracts foundational lexical features from a given URL."""
    parsed = urlparse(url)
    
    suspicious_words = ['login', 'signin', 'bank', 'secure', 'update', 'account', 'exe', 'zip']
    
    features = {
        'url_length': len(url),
        'domain_length': len(parsed.netloc),
        'path_length': len(parsed.path),
        'entropy': calculate_shannon_entropy(url),
        'count_dots': url.count('.'),
        'count_hyphens': url.count('-'),
        'count_at': url.count('@'),
        'count_question': url.count('?'),
        'count_equal': url.count('='),
        'count_slash': url.count('/'),
        'has_ip': 1 if parsed.netloc.replace('.', '').isdigit() else 0
    }
    
    # Extract suspicious word flags
    for word in suspicious_words:
        features[f'has_word_{word}'] = 1 if word in url.lower() else 0
        
    return features

# Example Usage
sample_url = "http://secure-login.paypal.com.account-update.info/login.php"
features = extract_lexical_features(sample_url)
print(f"URL Entropy: {features['entropy']}")
print(f"URL Length: {features['url_length']}")

4. Experimental Modeling & Classifier Comparison

We evaluated seven machine learning algorithms across a 70% Training / 30% Testing dataset split.

Performance Comparison Matrix

| Model Classifier | Feature Extraction / Vectorizer | Overall Accuracy | Precision | Recall | F1-Score | | :--- | :--- | :--- | :--- | :--- | :--- | | Logistic Regression | All 110 Engineered Features | 95.1% | 0.95 | 0.95 | 0.95 | | Extra Trees Classifier | Standard Feature Set | 93.8% | 0.94 | 0.93 | 0.93 | | Random Forest | Standard Feature Set | 93.2% | 0.93 | 0.93 | 0.93 | | Decision Tree | Standard Feature Set | 91.4% | 0.91 | 0.91 | 0.91 | | Logistic Regression | TF-IDF Vectorizer | 88.5% | 0.88 | 0.88 | 0.88 | | Multinomial Naive Bayes | Count Vectorizer | 86.2% | 0.86 | 0.85 | 0.85 | | Multinomial Naive Bayes | TF-IDF Vectorizer | 83.7% | 0.84 | 0.83 | 0.83 |

5. Key Results & Findings

1. Feature Engineering vs. Raw NLP Text Vectorization: Custom domain and lexical feature engineering (110 features) outperformed standard NLP vectorizers (TF-IDF and CountVectorizer) by +6.6% to +11.4% in overall accuracy.
2. Best Classifier: Logistic Regression trained on all 110 engineered features achieved the top performance with 95% accuracy and balanced Precision/Recall across safe and malicious classes.
3. Statistical Significance: Utilizing Cohen's Kappa metric confirmed high inter-rater agreement and robust inference reliability across multi-class predictions.

6. Conclusion & Future Roadmap

This research demonstrates that feature-engineered AI models provide a lightweight, scalable, and highly effective defense against malicious web links. By combining lexical entropy, domain structural signals, and special character distributions, the model reliably captures zero-day threats that traditional blacklists miss.

Next Steps & API Integration

The entire pipeline is modularized so that it can be wrapped in a FastAPI / Flask microservice. A web application can issue an HTTP POST request containing an unknown URL and receive a sub-millisecond classification response (Safe vs Malicious) along with a confidence score.