An ensemble classification method based on machine learning models for malicious Uniform Resource Locators (URL).

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Web applications are crucial for online businesses, but Internet-of-Things (IoT) devices increase network intrusion risks via malicious Uniform Resource Locators (URLs).
• Malicious URLs facilitate scams, attacks, and fraud, posing significant security challenges.
• Existing malicious URL detection methods often focus on binary classification and limited datasets, leaving room for improvement.

Purpose of the Study:

• To propose a robust stacking-based ensemble classifier for multi-class malicious URL detection.
• To evaluate the classifier's performance on larger datasets, addressing limitations of previous binary classification approaches.
• To leverage lexical features directly from URLs for identifying malicious websites.

Main Methods:

• Developed a stacking-based ensemble classifier integrating Random Forest, XGBoost, LightGBM, and CatBoost.
• Employed lexical features extracted directly from URLs for classification.
• Utilized Randomized Search for hyperparameter tuning to optimize the ensemble classifier's performance.

Main Results:

• Individual models achieved high accuracies: Random Forest (93.6%), XGBoost (95.2%), LightGBM (95.7%), and CatBoost (94.8%).
• The proposed stacking ensemble classifier achieved an average accuracy of 96.8% for multi-class classification.
• Demonstrated significant results in classifying four classes: phishing, malware, defacement, and benign URLs.

Conclusions:

• The stacking-based ensemble classifier effectively enhances malicious URL detection accuracy.
• The proposed method shows robustness and improved performance compared to individual models and previous works.
• This approach offers a promising solution for identifying diverse types of malicious URLs in cybersecurity.