A New Dataset and Methodology for Malicious URL Classification

TL;DR

This paper introduces DeepURLBench, a comprehensive multi-class dataset for malicious URL classification, and enhances URLNet with DNS features to improve accuracy and real-time performance in cybersecurity.

Contribution

The paper presents a new multi-class dataset for malicious URLs and improves URLNet with DNS features, advancing real-time classification capabilities.

Findings

DeepURLBench outperforms existing datasets in quality and structure.

Enhanced URLNet with DNS features shows significant accuracy improvements.

Model maintains real-time efficiency with the proposed enhancements.

Abstract

Malicious URL (Uniform Resource Locator) classification is a pivotal aspect of Cybersecurity, offering defense against web-based threats. Despite deep learning's promise in this area, its advancement is hindered by two main challenges: the scarcity of comprehensive, open-source datasets and the limitations of existing models, which either lack real-time capabilities or exhibit suboptimal performance. In order to address these gaps, we introduce a novel, multi-class dataset for malicious URL classification, distinguishing between benign, phishing and malicious URLs, named DeepURLBench. The data has been rigorously cleansed and structured, providing a superior alternative to existing datasets. Notably, the multi-class approach enhances the performance of deep learning models, as compared to a standard binary classification approach. Additionally, we propose improvements to string-based URL classifiers, applying these enhancements to URLNet. Key among these is the integration of DNS-derived features, which enrich the model's capabilities and lead to notable performance gains while preserving real-time runtime efficiency-achieving an effective balance for cybersecurity applications.