Malicious URL Detection Using Multi-Layer Hybrid Machine Learning

Abstract

The increasing risk of cyber threats has significantly affected web-based services, especially phishing and malicious URLs, posing serious security challenges for both users and organizations. Previous detection approaches, such as blacklist-based, have difficulty detecting new threats or obfuscated malicious URLs. On the other hand, machine learning techniques (ML) have suffered from highly False Positive (FP) rates. In this study, we propose a hybrid multi-layer architecture for malicious URL detection by integrating blacklist verification, feature selection of URLs, an XGBoost-based classification technique, and rule-based post- processing. This proposed model works based on sequential layers to filter malicious URLs utilizing a blacklist dataset and then extract lexical features from URLs. Selecting features processed using the XGBoost classifier to distinguish between benign and malicious URLs. Then the final stage is to refine the classification results based on a rule-based preprocessing technique to enhance malicious URLs detection systems' performance and reduce FP rates. The experimental results show enhanced performance by achieving higher detection accuracy, lower FP, and improved computational efficiency compared to previous single-layer models. Our contribution in this study is to enhance the cybersecurity systems by providing a scalable and adaptive solution for real-world malicious URL detection systems.