Pith. sign in

REVIEW 5 major objections 6 minor 47 references

URL2Graph++: Unified Semantic-Structural-Character Learning for Malicious URL Detection

T0 review · 5 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read URL2Graph++ claims that fusing BERT semantics with dual co-occurrence graphs over subwords and characters makes a malicious-URL detector that beats strong baselines, including LLMs, especially on short or obfuscated links.

desk verdict A clever new architecture for URL detection, but the reported SOTA margins can't be trusted until the authors clarify whether their global NPMI graphs are built from each training split alone. read the letter →

arxiv 2509.10287 v1 pith:ULLUGGRF submitted 2025-09-12 cs.CR

Ye Tian , Yifan Jia , Yanbin Wang , Jianguo Sun , Zhiquan Liu , Xiaowen Ling This is my paper
classification cs.CR
keywords maliciousURLdetectionphishinggraphneuralnetworksBERTcharacterCNNgatedfusionNPMIco-occurrencegraphs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that treating a URL not as a linear string but as a graph at two granularities—subword tokens and characters—lets a detector capture non-local dependencies and morphological obfuscations that sequential models miss. It proposes URL2Graph++, which builds corpus-wide NPMI co-occurrence graphs at both levels, initializes graph nodes with character-level CNN features, enriches the whole thing with BERT embeddings, and merges the three views with a learned gating weight. The authors report consistent gains over CNN, GAN, BERT, and LLaMA-2 baselines across balanced, imbalanced, cross-dataset, adversarial, and short-URL settings. If these results hold, a hybrid graph-plus-semantics architecture is the more robust detector for diverse and evasive malicious URLs.

What carries the argument

The load-bearing object is the pair of global NPMI co-occurrence graphs: a subword-level graph and a character-level graph built from the training corpus, with edges where normalized pointwise mutual information exceeds a threshold. These graphs encode long-range token associations and character-level anomalies; per-URL subgraphs are extracted, node features are initialized by a shared CharCNN, refined by two jointly trained GCNs, and then merged with BERT's pooled representation through a gated convex combination (Eq. 16-17). The gating mechanism is what lets the model weight semantic vs structural vs character evidence per instance.

What would settle it

Take GramBeddings at 6,400 training samples, freeze the NPMI graphs using only the training partition before any test split, and recompute Table III with an explicitly stated macro-F1; if the gap over LLaMA-2 narrows to noise or reverses, the central SOTA claim is false.

Watch

Extended reading notes

Core claim

The paper claims that a URL's meaning is carried by three complementary carriers—contextual subword semantics (BERT), global token co-occurrence (subword graph), and character-level morphology (character graph)—and that jointly training these with a gated fusion produces representations that generalize under distribution shift, label imbalance, obfuscation, and lexical sparsity. Concretely, on the balanced GramBeddings benchmark at 32,000 training samples it reports accuracy 0.9490 and AUC 0.9943, above URLBERT and LLaMA-2; on imbalanced Mendeley at 78,100 samples it reports F1 0.8022 and AUC 0.8903; on short malicious URLs (<40 chars) it reports accuracy 0.8920 and AUC 0.9536; and under adv

Load-bearing premise

The headline numbers presume that the subword and character co-occurrence graphs are built from training URLs only, and that the reported F1/precision/recall use one consistent formula; if test URLs leak into graph construction or metrics are computed inconsistently, the SOTA margins are not comparable.

Editorial extensions

If this is right

  • If correct, URL2Graph++ provides a template for detecting phishing and malware URLs that exploits non-local token relationships (e.g., 'account' far from 'verify') rather than only adjacent patterns.
  • The reported robustness at low FPR means security pipelines could set tight false-alarm budgets while still catching a meaningful share of malicious links.
  • Cross-dataset results suggest the representation transfers across URL distributions without fine-tuning, which matters for deployment on new data sources.
  • The gated fusion architecture implies that the optimal mix of semantic, structural, and character signals is instance-dependent; a single static concatenation is not enough.
  • Even under a 1:43 positive:negative ratio on Mendeley, the method keeps usable precision-recall trade-offs, indicating the graphs help resist label imbalance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The dual-graph construction is effectively a corpus-level prior: if the training distribution shifts after deployment, the global graphs and BERT tokenizer need to be refreshed; the paper does not test continuous drift.
  • The 'short URL' result hints that the character-level graph carries much of the signal; a testable extension would train a variant with only CharCNN + character graph to isolate that contribution.
  • A natural stress test is adaptive adversarial attacks: the paper's adversarial evaluation uses a fixed insertion heuristic (hyphens), so robustness against an attacker who sees the model's gradients is open.
  • The method's compute cost (BERT + two GCNs + CharCNN) means the practical win may only materialize offline; latency-sensitive deployments might distill to a lighter student.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes URL2Graph++, a malicious URL detection architecture that fuses three signal types: BERT subword semantics, character-level CNN features, and dual-granularity (subword and character) NPMI co-occurrence graphs processed by GCNs, combined through a learned gated fusion. The method is evaluated on GramBeddings, Mendeley, and Kaggle datasets under balanced, imbalanced, cross-dataset, adversarial, and short-URL settings. The central claim is that URL2Graph++ exceeds state-of-the-art performance, including URLBERT and LLaMA-2, with reported gains of roughly 1–2% in accuracy/F1 and around 1% in AUC at the main training scales, and larger gains at small training sizes and on short URLs. The architecture is clearly described, but the experimental protocol has several load-bearing gaps: graph construction split discipline is unspecified, F1 values in Table III are not consistent with the reported precision/recall, baseline adaptations (especially LLaMA-2) are not detailed, and some textual claims about TPR@FPR are contradicted by the tables.

Significance. If the empirical claims hold, URL2Graph++ is a sensible and moderately novel contribution: it combines a semantic encoder, character-level morphology, and corpus-derived co-occurrence graphs in a unified, end-to-end trainable model, and the evaluation covers several practically important regimes. The ablation study and the cross-dataset and low-FPR experiments are useful. The paper is not circular in the supervised-learning sense: the NPMI graphs are unsupervised, and the learned parameters are fitted by standard supervised training. However, the headline SOTA claim rests on experimental reporting that is currently not reproducible or internally consistent. The largest risk, identified by the stress-test, does land: if the global NPMI graphs are built on the full corpus rather than recomputed from each training split, test URLs contribute to the structural features used to score them, and the reported 1–2% margins over strong baselines can easily be explained by leakage. Because the central claim is empirical and the required fixes are localized, the paper is potentially salvageable but needs major revision.

major comments (5)
  1. [Section III.A and Table III] The global NPMI graphs are described as constructed over 'the entire training corpus' (Eqs. 1–3), but the manuscript never states whether the graphs are rebuilt for each training subset used in the scaling experiments. Table III uses 1%, 2%, ..., 5% of GramBeddings/Mendeley as training sizes. If the graphs are built once on the full 800k/1.56M corpus before splitting, then every test URL contributes co-occurrence statistics to the edges in its induced subgraph (Eq. 10); this is transductive leakage. The reported gains over URLBERT and LLaMA-2 are only 1–2% in accuracy/F1 and about 1% in AUC, so leakage of even modest size can invert the conclusion. Please state explicitly and verifiably: for every experiment, the NPMI graphs are constructed from the training partition only and frozen before any evaluation, and describe how graph construction interacts with the 1–5% random subsets. If thi
  2. [Table III (Mendeley rows)] The F1 values in Table III are not consistent with the reported precision and recall under any standard binary F1 definition. For example, the 1% Mendeley row for 'Our' reports P=0.9818, R=0.6712, whose harmonic mean is approximately 0.797, not 0.7578; the 5% row reports P=0.9851, R=0.7302, whose harmonic mean is approximately 0.838, not 0.8022. More egregiously, the 2% CGAN row reports P=0.7096, R=0.6695, and F1=0.8140, which is mathematically impossible for a binary F1 (harmonic mean ≈0.689). The F1 formula (macro, micro, weighted, or binary) is never defined. Since the paper's headline comparisons rely on these numbers, all metrics must be recomputed and the metric definitions stated before any SOTA comparison is meaningful.
  3. [Section V, Baselines (esp. LLaMA-2)] The baseline adaptation is underspecified. All baselines are said to 'follow the settings reported in their respective publications,' but LLaMA-2 is a generative decoder-only language model, and the paper does not explain how it is adapted to binary URL classification: is it fine-tuned with a classification head, prompted, or evaluated zero-shot? What tokenizer/truncation is used? What hyperparameters, epochs, and learning rates? Similarly, URLBERT is a multi-task pretrained model; the manuscript should clarify whether the pretraining corpus overlaps with the evaluation datasets and whether the reported URLBERT numbers come from the original implementation or from a re-implementation by the authors. Without these details, the baseline comparison cannot be independently reproduced.
  4. [Section V.A.c and V.D, Tables IV–VIII] Several textual claims about TPR@FPR are directly contradicted by the tables. The text says the proposed method achieves 'consistently superior TPR across all FPR levels and training sizes,' but Table V shows URLBERT has a higher TPR at FPR=0.0001 (0.1671 vs. 0.1466 for 'Our'). In the adversarial evaluation, Table VII shows LLaMA-2 has a higher TPR at FPR=0.01 (0.7235 vs. 0.6822), and Table VIII shows LLaMA-2 (0.5920) and CGAN (0.6617) both exceed 'Our' (0.4823) at FPR=0.001. These contradictions affect the robustness and low-FPR claims, which are a major part of the paper's practical motivation. The claims or the tables must be corrected, and the corrected conclusions stated accurately.
  5. [All experiments (Tables III–IX, Figures 2–3)] All results are reported as single point estimates with no seeds, error bars, or significance tests. Since the headline advantage over LLaMA-2 and URLBERT is often small (e.g., Table IX: F1 0.8615 vs. 0.8513; AUC 0.9536 vs. 0.9402; and Table III margins of ~1%), a single run is insufficient to establish 'exceeds SOTA.' The paper should report the number of independent runs, standard deviations or confidence intervals, and, where appropriate, a paired significance test. This is not merely a presentation issue: it is load-bearing for the central claim.
minor comments (6)
  1. [Section III.C, Eqs. (14)–(17)] Notation is inconsistent: Eq. (15) uses \tilde{h}^{word}_u and \tilde{h}^{char}_u, but Eq. (17) uses \tilde{h}^{sub}_u. Please unify the superscripts.
  2. [Section V.D] The text says 'we use this new adversarial test dataset to evaluate our best performing baseline model' — should be 'baseline models' (plural), and the sentence structure is awkward. Also, the adversarial generation process is described only briefly; more detail is needed for reproducibility.
  3. [Figure 4] The x-axis labels '0-9 100-109 200-209 300+' are confusing: they appear to denote decade bins but omit intermediate labels. Please clarify the binning and the axis label.
  4. [Section I Contributions] The claim to be 'the first method to model URLs as graphs' is too strong given that the related work section acknowledges existing graph-based URL approaches. Please temper this to 'the first to model intra-URL dual-granularity co-occurrence graphs' or similar.
  5. [Section III.B and V] The BERT encoder is said to be 'optionally fine-tuned depending on training configuration,' but the experiments never state which configuration is used. Specify the BERT variant, whether it is frozen or fine-tuned, and the training hyperparameters (batch size, learning rate, epochs) for both the proposed method and the baselines.
  6. [Table VI] The 'Graph Only' variant uses randomly initialized node features and consequently performs at chance. The text interprets this as showing structural information alone is inadequate, but the experiment confounds graph structure with feature initialization. A conclusion about the value of structure would require informative node features or a clearer caveat.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: URL2Graph++'s derivation is an empirical supervised pipeline whose graph priors are unsupervised corpus statistics and whose evaluation is against held-out test sets and external baselines.

full rationale

The paper's claimed derivation chain is: URLs are tokenized at subword and character levels; NPMI co-occurrence graphs are built over the training corpus (Eq. 3); per-URL subgraphs are induced (Eq. 10); node features come from CharCNN (Eq. 11); GCNs and BERT produce embeddings (Eqs. 6, 12-13); and a gated fusion plus softmax classifier is trained by cross-entropy (Eqs. 17-19). No step defines the target ('malicious') in terms of the model output, and no fitted parameter is renamed as a prediction. The NPMI graphs are unsupervised; only the classifier, GCN weights, projections, and gating are supervised, which is standard empirical fitting. The closest self-citation signal is the URLBERT baseline [38], which shares two authors (Yifan Jia, Yanbin Wang) with this paper. But URLBERT is a comparison target, not a premise of the derivation; the paper also benchmarks against external Dephides, CGAN, LLaMA-2, and GramBeddings, so the SOTA claim is not forced by a self-citation chain. The evaluation does have an important hygiene caveat: the paper says graphs are built on the 'training corpus' (Section III.A) but does not explicitly state they are rebuilt for each random training subset in the scaling experiments, and several F1 values in Table III are inconsistent with binary F1 from the reported precision/recall. These are correctness/reproducibility risks (potential transductive leakage and metric ambiguity), not definitional circularity. Accordingly, no circular step is exhibited.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The framework introduces no new explanatory entity; its predictive content comes from supervised learning over hand-chosen graph thresholds and standard neural components. The main hidden costs are in hyperparameters and the assumption that token co-occurrence graphs capture URL structure.

free parameters (5)
  • Subword NPMI threshold theta_t
    Chosen to filter edges in the subword graph (Eq. 3); value not reported in the paper.
  • Character NPMI threshold theta_c
    Chosen to filter edges in the character graph (Eq. 3); value not reported.
  • CharCNN filter widths and channel counts
    Kernel sizes and dimensions determine character-level features (Eqs. 7 to 9); not specified.
  • GCN depth and hidden dimension
    Number of layers and hidden size d_g control graph encoding (Eq. 12); not specified.
  • Fusion and gating projection dimensions and BERT variant
    Projection and gating dimensions, and which BERT model is used, affect the fused representation (Eqs. 14 to 17); not specified.
assumptions (4)
  • domain assumption NPMI co-occurrence of tokens and characters within a full URL is an adequate structural model for malicious URL detection.
    Section III.A constructs edges from whole-URL context windows, which does not encode host-path-query hierarchy despite the motivation in Section I.
  • domain assumption Edges with NPMI above a threshold capture meaningful functional or morphological associations between URL subwords and characters.
    This assumption justifies graph construction and the claim that the dual graphs encode attack patterns.
  • domain assumption BERT subword embeddings transfer to URL semantics without URL-specific pretraining.
    The paper uses a pre-trained BERT encoder (Section III.B) and only optionally fine-tunes it, without URL-domain pretraining.
  • standard math Mean-pooled GCN node embeddings over induced subgraphs are adequate graph-level representations.
    Eqs. 12 and 13 assume standard GCN message passing and mean pooling yield discriminative URL representations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of URL2Graph++: Unified Semantic-Structural-Character Learning for Malicious URL Detection." pith.science (2026). https://pith.science/paper/ULLUGGRF

@misc{pith2026250910287,
  author       = {Pith},
  title        = {Pith review of: URL2Graph++: Unified Semantic-Structural-Character Learning for Malicious URL Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ULLUGGRF}},
  note         = {Machine review of arXiv:2509.10287}
}
read the original abstract

Malicious URL detection remains a major challenge in cybersecurity, primarily due to two factors: (1) the exponential growth of the Internet has led to an immense diversity of URLs, making generalized detection increasingly difficult; and (2) attackers are increasingly employing sophisticated obfuscation techniques to evade detection. We advocate that addressing these challenges fundamentally requires: (1) obtaining semantic understanding to improve generalization across vast and diverse URL sets, and (2) accurately modeling contextual relationships within the structural composition of URLs. In this paper, we propose a novel malicious URL detection method combining multi-granularity graph learning with semantic embedding to jointly capture semantic, character-level, and structural features for robust URL analysis. To model internal dependencies within URLs, we first construct dual-granularity URL graphs at both subword and character levels, where nodes represent URL tokens/characters and edges encode co-occurrence relationships. To obtain fine-grained embeddings, we initialize node representations using a character-level convolutional network. The two graphs are then processed through jointly trained Graph Convolutional Networks to learn consistent graph-level representations, enabling the model to capture complementary structural features that reflect co-occurrence patterns and character-level dependencies. Furthermore, we employ BERT to derive semantic representations of URLs for semantically aware understanding. Finally, we introduce a gated dynamic fusion network to combine the semantically enriched BERT representations with the jointly optimized graph vectors, further enhancing detection performance. We extensively evaluate our method across multiple challenging dimensions. Results show our method exceeds SOTA performance, including against large language models.

Figures

Figures reproduced from arXiv: 2509.10287 by the authors.

Figure 1
Figure 1. Architecture of the proposed URL2Graph++ framework, illustrating dual-granularity graph construction, feature [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Cross-dataset evaluation where models are trained on [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Cross-dataset evaluation where models are trained on [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Distribution of URL lengths for benign (left) and malicious (right) samples across datasets. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 7 linked inside Pith

  1. [1]

    Reliability and robustness analysis of machine learning based phishing url detectors,

    B. Sabir, M. A. Babar, R. Gaire, and A. Abuadbba, “Reliability and robustness analysis of machine learning based phishing url detectors,” IEEE Transactions on Dependable and Secure Computing, 2022

    2022

  2. [2]

    Beyond phish: Toward detect- ing fraudulent e-commerce websites at scale,

    M. Bitaab, H. Cho, A. Oest, Z. Lyu, W. Wang, J. Abraham, R. Wang, T. Bao, Y . Shoshitaishvili, and A. Doup´e, “Beyond phish: Toward detect- ing fraudulent e-commerce websites at scale,” in2023 ieee symposium on security and privacy (sp). IEEE, 2023, pp. 2566–2583

    2023

  3. [3]

    Phishagent: a robust multimodal agent for phishing webpage detection,

    T. Cao, C. Huang, Y . Li, W. Huilin, A. He, N. Oo, and B. Hooi, “Phishagent: a robust multimodal agent for phishing webpage detection,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 27, 2025, pp. 27 869–27 877

    2025

  4. [4]

    Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach,

    R. Liu, Y . Lin, X. Yang, S. H. Ng, D. M. Divakaran, and J. S. Dong, “Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach,” in31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 1633–1650

    2022

  5. [5]

    Phishintel: Toward practical deployment of reference-based phishing detection,

    Y . Li, H. K. Tan, Q. Meng, M. L. Lock, T. Cao, S. Deng, N. Oo, H. W. Lim, and B. Hooi, “Phishintel: Toward practical deployment of reference-based phishing detection,” inCompanion Proceedings of the ACM on Web Conference 2025, 2025, pp. 2863–2866

    2025

  6. [6]

    {KnowPhish}: Large language models meet multimodal knowledge graphs for enhancing{Reference-Based}phishing detec- tion,

    Y . Li, C. Huang, S. Deng, M. L. Lock, T. Cao, N. Oo, H. W. Lim, and B. Hooi, “{KnowPhish}: Large language models meet multimodal knowledge graphs for enhancing{Reference-Based}phishing detec- tion,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 793–810

    2024

  7. [7]

    Less defined knowledge and more true alarms: Reference-based phishing detection without a pre-defined reference list,

    R. Liu, Y . Lin, X. Teoh, G. Liu, Z. Huang, and J. S. Dong, “Less defined knowledge and more true alarms: Reference-based phishing detection without a pre-defined reference list,” in33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 523–540

    2024

  8. [8]

    2024 Internet Crime Complaint Center (IC3) Annual Report,

    FBI Internet Crime Complaint Center (IC3), “2024 Internet Crime Complaint Center (IC3) Annual Report,” Tech. Rep., 2025. [Online]. Available: https://www.ic3.gov/AnnualReport/Reports/2024 IC3Report. pdf

    2024

Show all 47 references
  1. [9]

    Malicious url detection using machine learning: A survey,

    D. Sahoo, C. Liu, and S. C. Hoi, “Malicious url detection using machine learning: A survey,”arXiv preprint arXiv:1701.07179, 2017

    2017 arXiv

  2. [10]

    Robust detection of malicious urls with self-paced wide & deep learning,

    Y . Liang, Q. Wang, K. Xiong, X. Zheng, Z. Yu, and D. Zeng, “Robust detection of malicious urls with self-paced wide & deep learning,”IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 2, pp. 717–730, 2021

    2021

  3. [11]

    Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages,

    Y . Lin, R. Liu, D. M. Divakaran, J. Y . Ng, Q. Z. Chan, Y . Lu, Y . Si, F. Zhang, and J. S. Dong, “Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages,” in30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3793–3810

    2021

  4. [12]

    An effective detection approach for phishing websites using url and html features,

    A. Aljofey, Q. Jiang, A. Rasool, H. Chen, W. Liu, Q. Qu, and Y . Wang, “An effective detection approach for phishing websites using url and html features,”Scientific Reports, vol. 12, no. 1, p. 8842, 2022

    2022

  5. [13]

    Url2vec: Url modeling with character embeddings for fast and accurate phishing website detection,

    H. Yuan, Z. Yang, X. Chen, Y . Li, and W. Liu, “Url2vec: Url modeling with character embeddings for fast and accurate phishing website detection,” in2018 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Ubiquitous Computing & Communications, Big Data & Cl...

    2018

  6. [14]

    Url inspection tasks: Helping users detect phishing links in emails,

    D. Lain, Y . Nakatsuka, K. Kostiainen, G. Tsudik, and S. Capkun, “Url inspection tasks: Helping users detect phishing links in emails,”arXiv preprint arXiv:2502.20234, 2025

    2025 arXiv

  7. [15]

    Textual and visual content- based anti-phishing: a bayesian approach,

    H. Zhang, G. Liu, T. W. Chow, and W. Liu, “Textual and visual content- based anti-phishing: a bayesian approach,”IEEE transactions on neural networks, vol. 22, no. 10, pp. 1532–1546, 2011

    2011

  8. [16]

    Learning to detect malicious urls,

    J. Ma, L. K. Saul, S. Savage, and G. M. V oelker, “Learning to detect malicious urls,”ACM Transactions on Intelligent Systems and Technology (TIST), vol. 2, no. 3, pp. 1–24, 2011

    2011

  9. [17]

    Detecting malicious urls using lexical analysis,

    M. S. I. Mamun, M. A. Rathore, A. H. Lashkari, N. Stakhanova, and A. A. Ghorbani, “Detecting malicious urls using lexical analysis,” in Network and System Security: 10th International Conference, NSS 2016, Taipei, Taiwan, September 28-30, 2016, Proceedings 10. Springer, 2016, ...

    2016

  10. [18]

    Phishing detection: analysis of visual similarity based approaches,

    A. K. Jain, B. B. Guptaet al., “Phishing detection: analysis of visual similarity based approaches,”Security and Communication Networks, vol. 2017, 2017

    2017

  11. [19]

    Fast-flux hunter: a system for filtering online fast-flux botnet,

    A. Almomani, “Fast-flux hunter: a system for filtering online fast-flux botnet,”Neural Computing and Applications, vol. 29, no. 7, pp. 483– 493, 2018

    2018

  12. [20]

    Malicious url detection using logistic regression,

    R. Chiramdasu, G. Srivastava, S. Bhattacharya, P. K. Reddy, and T. R. Gadekallu, “Malicious url detection using logistic regression,” in 2021 IEEE International Conference on Omni-Layer Intelligent Systems (COINS). IEEE, 2021, pp. 1–6

    2021

  13. [21]

    A machine learning driven threat intelligence system for malicious url detection,

    C. Rupa, G. Srivastava, S. Bhattacharya, P. Reddy, and T. R. Gadekallu, “A machine learning driven threat intelligence system for malicious url detection,” inProceedings of the 16th International Conference on Availability, Reliability and Security, 2021, pp. 1–7

    2021

  14. [22]

    A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization,

    F. Ullah, G. Srivastava, and S. Ullah, “A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization,”Journal of Cloud Computing, vol. 11, no. 1, p. 75, 2022

    2022

  15. [23]

    A stacking model using url and html features for phishing webpage detection,

    Y . Li, Z. Yang, X. Chen, H. Yuan, and W. Liu, “A stacking model using url and html features for phishing webpage detection,”Future Generation Computer Systems, vol. 94, pp. 27–39, 2019

    2019

  16. [24]

    Toward more generalized malicious url detection models,

    Y .-D. Tsai, C. Liow, Y . S. Siang, and S.-D. Lin, “Toward more generalized malicious url detection models,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 19, 2024, pp. 21 628– 21 636

    2024

  17. [25]

    Dephides: Deep learning based phishing detection system,

    O. K. Sahingoz, E. BUBE, and E. Kugu, “Dephides: Deep learning based phishing detection system,”Ieee Access, vol. 12, pp. 8052–8070, 2024

    2024

  18. [26]

    Urlnet: Learning a url representation with deep learning for malicious url detection,

    H. Le, Q. Pham, D. Sahoo, and S. C. Hoi, “Urlnet: Learning a url representation with deep learning for malicious url detection,”arXiv preprint arXiv:1802.03162, 2018

    2018 arXiv

  19. [27]

    Texception: a character/word-level deep learning model for phishing url detection,

    F. Tajaddodianfar, J. W. Stokes, and A. Gururajan, “Texception: a character/word-level deep learning model for phishing url detection,” in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2020, pp. 2857–2861

    2020

  20. [28]

    Tcurl: Exploring hybrid transformer and convolutional neural network on phishing url detection,

    C. Wang and Y . Chen, “Tcurl: Exploring hybrid transformer and convolutional neural network on phishing url detection,”Knowledge- Based Systems, vol. 258, p. 109955, 2022

    2022

  21. [29]

    Cnn-fusion: An effec- tive and lightweight phishing detection method based on multi-variant convnet,

    M. Hussain, C. Cheng, R. Xu, and M. Afzal, “Cnn-fusion: An effec- tive and lightweight phishing detection method based on multi-variant convnet,”Information Sciences, vol. 631, pp. 328–345, 2023

    2023

  22. [30]

    Hdp-cnn: Highway deep pyramid convolution neural network combining word- level and character-level representations for phishing website detection,

    F. Zheng, Q. Yan, V . C. Leung, F. R. Yu, and Z. Ming, “Hdp-cnn: Highway deep pyramid convolution neural network combining word- level and character-level representations for phishing website detection,” Computers & Security, vol. 114, p. 102584, 2022

    2022

  23. [31]

    Durld: Malicious url detection using deep learning-based charac- ter level representations,

    S. Srinivasan, R. Vinayakumar, A. Arunachalam, M. Alazab, and K. So- man, “Durld: Malicious url detection using deep learning-based charac- ter level representations,”Malware analysis using artificial intelligence and deep learning, pp. 535–554, 2021

    2021

  24. [32]

    Learning url embedding for malicious website detection,

    X. Yan, Y . Xu, B. Cui, S. Zhang, T. Guo, and C. Li, “Learning url embedding for malicious website detection,”IEEE Transactions on Industrial Informatics, vol. 16, no. 10, pp. 6673–6681, 2020

    2020

  25. [33]

    Phishing url detection via capsule-based neural network,

    Y . Huang, J. Qin, and W. Wen, “Phishing url detection via capsule-based neural network,” in2019 IEEE 13th International Conference on Anti- counterfeiting, Security, and Identification (ASID). IEEE, 2019, pp. 22–26

    2019

  26. [34]

    Bidirectional lstm malicious webpages detection algorithm based on convolutional neural network and independent recurrent neural network,

    H.-h. Wang, L. Yu, S.-w. Tian, Y .-f. Peng, and X.-j. Pei, “Bidirectional lstm malicious webpages detection algorithm based on convolutional neural network and independent recurrent neural network,”Applied Intelligence, vol. 49, pp. 3016–3026, 2019

    2019

  27. [35]

    Grambeddings: a new neural network for url based identification of phishing web pages through n- gram embeddings,

    A. S. Bozkir, F. C. Dalgic, and M. Aydos, “Grambeddings: a new neural network for url based identification of phishing web pages through n- gram embeddings,”Computers & Security, vol. 124, p. 102964, 2023

    2023

  28. [36]

    Research on malicious url detection technology based on bert model,

    W. Chang, F. Du, and Y . Wang, “Research on malicious url detection technology based on bert model,” in2021 IEEE 9th International Conference on Information, Communication and Networks (ICICN). IEEE, 2021, pp. 340–345

    2021

  29. [37]

    A transformer-based model to detect phishing urls,

    P. Xu, “A transformer-based model to detect phishing urls,”arXiv preprint arXiv:2109.02138, 2021

    2021 arXiv

  30. [38]

    Continuous multi-task pre-training for malicious url detection and webpage classification,

    Y . Li, Y . Liu, P. Li, Y . Jia, and Y . Wang, “Continuous multi-task pre-training for malicious url detection and webpage classification,” Computer Networks, p. 111513, 2025. 14

    2025

  31. [39]

    Urltran: Improving phishing url detection using transformers,

    P. Maneriker, J. W. Stokes, E. G. Lazo, D. Carutasu, F. Tajaddodianfar, and A. Gururajan, “Urltran: Improving phishing url detection using transformers,” inMILCOM 2021-2021 IEEE Military Communications Conference (MILCOM). IEEE, 2021, pp. 197–204

    2021

  32. [40]

    A lightweight multi-view learning approach for phishing attack detection using transformer with mixture of experts,

    Y . Wang, W. Ma, H. Xu, Y . Liu, and P. Yin, “A lightweight multi-view learning approach for phishing attack detection using transformer with mixture of experts,”Applied Sciences, vol. 13, no. 13, p. 7429, 2023

    2023

  33. [41]

    A large-scale pretrained deep model for phishing url detection,

    Y . Wang, W. Zhu, H. Xu, Z. Qin, K. Ren, and W. Ma, “A large-scale pretrained deep model for phishing url detection,” inICASSP 2023- 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2023, pp. 1–5

    2023

  34. [42]

    Malicious and benign webpages dataset,

    A. Singh, “Malicious and benign webpages dataset,”Data in brief, vol. 32, p. 106304, 2020

    2020

  35. [43]

    Semi-supervised condi- tional gan for simultaneous generation and detection of phishing urls: A game theoretic perspective,

    S. A. Kamran, S. Sengupta, and A. Tavakkoli, “Semi-supervised condi- tional gan for simultaneous generation and detection of phishing urls: A game theoretic perspective,”arXiv preprint arXiv:2108.01852, 2021

    2021 arXiv

  36. [44]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosaleet al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  37. [45]

    Unsu- pervised cross-lingual representation learning at scale,

    A. Conneau, K. Khandelwal, N. Goyal, V . Chaudhary, G. Wenzek, F. Guzm´an, E. Grave, M. Ott, L. Zettlemoyer, and V . Stoyanov, “Unsu- pervised cross-lingual representation learning at scale,”arXiv preprint arXiv:1911.02116, 2019

    1911 arXiv

  38. [46]

    Two years of short urls internet measure- ment: security threats and countermeasures,

    F. Maggi, A. Frossi, S. Zanero, G. Stringhini, B. Stone-Gross, C. Kruegel, and G. Vigna, “Two years of short urls internet measure- ment: security threats and countermeasures,” inproceedings of the 22nd international conference on World Wide Web, 2013, pp. 861–872

    2013

  39. [47]

    Phishing url detection with neural networks: an empirical study,

    H. Ghalechyan, E. Israyelyan, A. Arakelyan, G. Hovhannisyan, and A. Davtyan, “Phishing url detection with neural networks: an empirical study,”Scientific reports, vol. 14, no. 1, p. 25134, 2024

    2024

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.