Detection of the Malicious URL Using the Language Models

The internet has become the central nervous system of modern life, a vast network where organizations deliver services and people share information through web addresses. These addresses, known as URLs, are the keys that unlock specific pages on the web. However, just as a physical key can be forged to open a door it shouldn't, a digital link can be crafted to deceive. Malicious URLs are these forged keys; they are links designed to trick users into visiting sites that steal money, harvest private information, or install harmful software onto their devices. While some threats are obvious, many are subtle, and distinguishing a safe link from a dangerous one is often difficult for the average person. To protect against these digital traps, security experts have long relied on lists of known bad links, but these lists can only stop what they have already seen. When a new, unseen threat appears, the old lists fail. This limitation has driven researchers to look for smarter ways to identify danger, moving beyond simple checklists to systems that can actually understand the meaning behind a web address.

In a recent study, researchers from the University of Qom and Islamic Azad University tackled this challenge by teaching computers to read the meaning of words inside a web address, rather than just counting their characters. For years, automated systems have tried to spot malicious links by looking at their shape and structure—measuring how long the address is, counting the number of symbols, or checking if it contains suspicious strings of letters. These methods work well for many cases, but they miss the nuance of language. A malicious link might use innocent-looking words arranged in a way that suggests a scam, much like a phishing email that uses polite language to ask for a password. The researchers realized that to catch these sophisticated tricks, a system needs to understand the semantic relationship between the words, or how they fit together to form a specific meaning. To do this, they turned to language models, which are advanced computer programs trained on massive amounts of text to understand how words relate to one another in human language.

The team tested four different types of these language models to see which one could best identify the intent behind a URL. The first two, Word2vec and GloVe, are systems that map words into a mathematical space based on how often they appear near each other in text. They are good at understanding that words like "king" and "queen" are related, but they treat every word in isolation, without considering the full context of the sentence. The third model, LASER, was designed to handle many different languages at once, mapping sentences into a shared space, though it focuses on the sentence as a whole rather than the fine details of individual words. The final model, BERT, is a more recent and powerful tool that looks at a word in the context of all the words surrounding it, both before and after it. This allows it to grasp the subtle differences in meaning that depend on the specific arrangement of a sentence. The researchers applied these models to a dataset containing over 114,000 web addresses, which included safe links as well as those designed for spam, phishing, malware, and website defacement.

To make the web addresses readable for these language models, the researchers first had to break them down into smaller pieces, a process called tokenization. For the first three models, they manually stripped away symbols like slashes and question marks, treating the remaining words as the core data. For the BERT model, they used a specialized tool that automatically breaks the address into sub-words and symbols, keeping the punctuation as part of the meaning because BERT is designed to understand how those symbols change the context. Once the addresses were processed, the models generated a unique numerical representation for each one, capturing its semantic essence. These representations were then fed into a neural network, a type of computer program inspired by the human brain, which learned to recognize patterns and assign a label to each URL, such as "safe," "spam," or "phishing."

The results of the experiment showed a clear winner. While all the language models performed better than many previous methods that relied only on statistical features, the BERT model stood out significantly. It achieved an accuracy rate of 99.71 percent, correctly identifying the nature of the web addresses in nearly every case. The other models also performed well, with the GloVe model reaching 98.94 percent and the Word2vec model reaching 98.62 percent, but they fell short of BERT's precision. The researchers noted that even the lowest-performing model in their study, LASER, still outperformed many existing techniques in the field, achieving 97.46 percent accuracy. This suggests that simply shifting the focus from the physical structure of a URL to the meaning of its words provides a substantial boost in security. The study demonstrates that by using a model that understands the context and relationships between words, computers can become much more effective at spotting the subtle linguistic cues that indicate a malicious link.

The researchers concluded that their approach offers a robust solution to a persistent problem in computer security. By modeling the semantic space of the words found in web addresses, they were able to capture the intent behind a link in a way that traditional methods could not. The success of the BERT model, in particular, highlights the value of using deep, context-aware language understanding to detect threats. This does not mean that older methods are useless, but rather that combining them with the ability to read the "meaning" of a URL creates a much stronger defense. As cybercriminals continue to evolve their tactics, making their malicious links look more and more like legitimate ones, the ability to understand the context of the words they use will become an essential tool for keeping the internet safe. The study provides a clear path forward, showing that the future of URL detection lies in teaching machines to read between the lines.