1 Existing System

This section provides a detailed analysis of the existing system for malicious
URL classification, as described in the study by Abad et al. (2023) [1], pub-
lished in Sensors. As of May 13, 2025, 10:53 PM IST, the study remains a cor-
nerstone for understanding traditional machine learning approaches to cyberse-
curity. The system employs Support Vector Machines (SVMs), Random Forests
(RFs), Decision Trees (DTs), and k-Nearest Neighbors (KNNs) to classify URLs
into benign, phishing, defacement, or malware categories, using a dataset of
650,000 URLs from Kaggle. It integrates instance selection methods—Data
Reduction based on Locality-Sensitive Hashing (DRLSH), Border Point Ex-
traction based on Locality-Sensitive Hashing (BPLSH), and random selection—
to enhance computational efficiency, achieving F1 scores up to 92.18% (RFs
with random selection). Below, we elaborate on the system’s architecture, algo-
rithms with mathematical workflows, workflow, preprocessing, feature engineer-
ing, and problem statement, highlighting limitations that motivate the proposed
CNN+LSTM framework for URL, file, and Gmail classification.

1.1 URL Classification with Machine Learning

The existing system uses supervised machine learning to classify URLs based
on 16 lexical and structural features, addressing the challenge of detecting ma-
licious URLs amidst the proliferation of websites collecting user data [1]. The
dataset is split into 85% training (552,500 instances) and 15% testing (97,500
instances), with models trained using Bayesian optimization for hyperparameter
tuning and instance selection to manage large-scale data. The system outper-
forms traditional blacklist methods, which struggle with new malicious URLs,
achieving high performance (e.g., 93.19% precision for RFs with random se-
lection). RFs and SVMs excel over DTs and KNNs, with instance selection
reducing training time while preserving representative samples, as evidenced by
the study’s results (Table 1, Figures 5–8).

1.2 Algorithms Used in Existing System

The base study employs four algorithms, each processing a feature vector x ∈
R16 (e.g., URL_length, has_http) to classify URLs into benign (y = 0), phish-
ing (y = 1), defacement (y = 2), or malware (y = 3). Below, we describe
each algorithm and provide a mathematical workflow for URL classification,
grounded in the study’s implementation.

1.2.1 Decision Trees (DTs)

DTs construct a tree where nodes represent features, branches denote rules, and
leaves assign labels. For URL classification, a DT splits on has_http to separate
HTTP from HTTPS URLs, then on count_slashes for phishing detection. The

1
Gini impurity criterion is:
X
3
Gini = 1 − p2i
i=0

DTs achieve moderate performance (90.18% F1 score with random selection)

but struggle with phishing URLs (Figure 7).

Mathematical Workflow for DTs

1. Input: Feature vector x = [x1 , . . . , x16 ] ∈ R16 , where x1 = URL_length,

x2 = has_http.
2. Node Splitting: Select feature xj and threshold θ to minimize Gini
impurity. For has_http:

X
3 X
3
Ginileft = 1 − p2i,left , Giniright = 1 − p2i,right
i=0 i=0

Split score:
nleft Ginileft + nright Giniright
Score =
nleft + nright

3. Recursion: Repeat until maximum splits (e.g., 100) or minimum node

size.
4. Prediction: Traverse to a leaf, outputting class y (e.g., phishing for
has_http=1, count_slashes=5).

5. Loss: Minimize misclassification error:

X
N
L= I(yi ̸= ŷi )
i=1

1.2.2 Random Forests (RFs)

RFs ensemble DTs trained on random feature and data subsets, achieving 92.18%
F1 score with random selection, excelling at defacement URLs (Figure 5).

Mathematical Workflow for RFs

1. Input: Feature vector x ∈ R16 , training set D = {(xi , yi )}N
i=1 .

2. Bootstrap Sampling: Sample N instances with replacement for each of

T trees (e.g., T = 100) to form Dt .

3. Feature Subset Selection: Select m features (e.g., m = 4) randomly

per node, minimizing Gini impurity.

2
 4. Tree Construction: Build tree t:

ŷt (x) = argmaxk pleaf

k (x)

5. Prediction: Majority voting:

ŷ(x) = mode{ŷ1 (x), . . . , ŷT (x)}

6. Loss: Minimize expected error:

1 X
N
L= I(yi ̸= ŷ(xi ))
N i=1

1.2.3 Support Vector Machines (SVMs)

SVMs use a Gaussian kernel to find a hyperplane, achieving 91.25% F1 score
but requiring 10,793 seconds training time (Table 1).

Mathematical Workflow for SVMs

1. Input: Feature vector x ∈ R16 , labels yi ∈ {0, 1, 2, 3} (one-vs-one).

2. Feature Transformation: Gaussian kernel:
 
∥x − xi ∥2
K(x, xi ) = exp −
2σ 2

3. Optimization: Maximize margin:

1 X N
min ∥w∥2 + C ξi
w,b,ξ 2
i=1

subject to yi (wT ϕ(xi ) + b) ≥ 1 − ξi , ξi ≥ 0.

4. Decision Function:
X
N
f (x) = αi yi K(x, xi ) + b
i=1

Assign class via one-vs-one voting.

5. Loss: Hinge loss:

X
N
λ
L= max(0, 1 − yi f (xi )) + ∥w∥2
i=1
2

3
1.2.4 k-Nearest Neighbors (KNNs)
KNNs assign the majority class of k nearest neighbors, achieving 86.64% F1
score with random selection but dropping to 72.77% with BPLSH (Table 1).

Mathematical Workflow for KNNs

1. Input: Feature vector x ∈ R16 , training set D = {(xi , yi )}N
i=1 .

2. Distance Computation: Euclidean distance:

v
u 16
uX
d(x, xi ) = t (xj − xi,j )2
j=1

3. Neighbor Selection: Select k nearest neighbors (e.g., k = 10).

4. Prediction: Majority class:
X
ŷ(x) = argmaxk I(yi = k)
i∈Nk (x)

5. Loss: Misclassification error:

1 X
N
L= I(yi ̸= ŷ(xi ))
N i=1

1.3 Workflow of Existing URL Classification

The workflow (Figure 3.1, Page TBD) comprises three phases [1]:
• Data Collection and Preparation: Collect 650,000 URLs, remove
nulls, extract 16 features, split into 552,500 training and 97,500 testing
instances.

• Model Development: Apply instance selection (DRLSH, BPLSH, ran-

dom selection), train models with Bayesian optimization and 5-fold cross-
validation.
• Performance Evaluation: Compute precision, recall, F1 score:
TP TP Precision · Recall
Precision = , Recall = , F1 = 2·
TP + FP TP + FN Precision + Recall

4
1.4 Existing System Architecture
The system architecture (Figure 3.2, Page TBD), implemented in MATLAB
2022, is a modular pipeline designed to process large-scale URL data efficiently
while balancing performance and computational cost. It integrates data inges-
tion, preprocessing, instance selection, model training, evaluation, and output
generation, as detailed below:

• Data Ingestion Module: Imports 650,000 URLs from Kaggle via CSV
files, storing raw URLs and labels (benign, phishing, defacement, malware)
in memory. The module uses MATLAB’s readtable function to handle
structured data, ensuring compatibility with downstream processing.
• Preprocessing Module: Removes null values and extracts 16 features
using string parsing and regular expressions (e.g., \d{1,3}\.\d{1,3} for
IP addresses). Features are standardized for SVMs and KNNs using
zscore, ensuring zero mean and unit variance. The module splits data
into 552,500 training and 97,500 testing instances, preserving class distri-
butions (e.g., benign dominance, Figure 3).
• Instance Selection Module: Applies DRLSH, BPLSH, or random se-
lection to reduce the training set. DRLSH removes similar samples within
classes using locality-sensitive hashing, minimizing redundancy (e.g., 112,712
benign samples). BPLSH preserves border points near decision bound-
aries, enhancing phishing detection (60,708 phishing samples). Random
selection uses randperm for simplicity, balancing speed and representa-
tiveness. The module outputs reduced datasets, impacting performance
(e.g., KNNs’ 72.77% F1 with BPLSH, Table 1).
• Model Training Module: Trains DTs, RFs, SVMs, and KNNs using
MATLAB’s fitctree, fitcensemble, fitcecoc, and fitcknn functions.
Bayesian optimization tunes hyperparameters (e.g., RFs’ number of trees,
SVMs’ kernel scale) via 5-fold cross-validation, maximizing accuracy. The
module leverages MATLAB’s parallel computing toolbox to distribute
training across CPU cores, though SVMs remain slow (up to 18,390 sec-
onds).
• Evaluation Module: Tests models on the 97,500-instance test set, com-
puting precision, recall, F1 score, and true positive rates (TPRs) per cate-
gory (Figure 4). The module uses MATLAB’s confusionmat to generate
confusion matrices, highlighting phishing detection challenges (Figures 5–
8). Feature importance is computed via Minimum Redundancy-Maximum
Relevance (MRMR), identifying has_http as critical (Figure 9).
• Output Module: Generates results as tables (e.g., Table 1) and visual-
izations (e.g., TPR plots, feature importance bar charts) using MATLAB’s
plot and bar functions. Results are exported to CSV files for analysis,
supporting cybersecurity practitioners in interpreting model performance.

5
 The architecture’s data flow begins with raw URL ingestion, followed by pre-
processing and feature extraction, which feed into instance selection to create
compact training sets. These sets are used to train models, whose predictions
are evaluated and visualized. The MATLAB environment ensures robust com-
putation but limits scalability due to its proprietary nature and lack of native
support for web-based deployment. The reliance on lexical features and tradi-
tional algorithms restricts the system’s ability to model sequential patterns, a
gap addressed by the proposed system’s CNN+LSTM architecture.

1.5 Preprocessing and Feature Engineering

1.5.1 Preprocessing
• Null Value Removal: Ensures data integrity.
• Data Splitting: 85:15 ratio, preserving class distributions.
• Normalization: Standardizes features for SVMs and KNNs.

1.5.2 Feature Engineering

The 16 features include lexical (URL_length, count_dots), protocol (has_http,
has_https), content (has_php, has_html), and network (has_ipv4) features,
computed via string parsing and regex. MRMR identifies has_http as the most
informative (Figure 9).

1.6 Problem Statement

The existing system for malicious URL classification, while effective in achieving
high F1 scores (up to 92.18% for RFs), exhibits critical limitations that hinder
its applicability to the diverse and dynamic nature of cyberthreats, particularly
when compared to the requirements of the proposed CNN+LSTM framework
for URL, file, and Gmail classification. The reliance on 16 lexical and structural
features, such as URL_length and has_http, fails to capture sequential and
contextual patterns in URLs (e.g., character order in ”[Link]/login”),
file byte sequences (e.g., executable headers), and email text (e.g., narrative
flow in spam), limiting detection of sophisticated phishing URLs, obfuscated
malware, and spam emails, as evidenced by low true positive rates for phishing
(Figures 5–8). Computational inefficiencies, with SVMs requiring up to 18,390
seconds and RFs 71–82 seconds, preclude real-time deployment, a critical need
for the proposed system’s Flask-based interface. Class imbalance (e.g., 3054
malware vs. 112,712 benign samples in DRLSH) and feature overlap between
phishing and benign URLs reduce performance, particularly for KNNs (67.44%
precision with BPLSH), and are inadequately addressed by instance selection
alone, unlike the proposed system’s use of SMOTE and focal loss. The lack of
sequential modeling in traditional algorithms (DTs, RFs, SVMs, KNNs) ignores
temporal dependencies critical for URL character sequences, file byte patterns,

6
and email word sequences, which the proposed CNN+LSTM model captures
through character-level tokenization, Conv1D layers, and Bidirectional LSTMs.
Finally, the MATLAB-based architecture restricts scalability and web-based
deployment, unlike the proposed Python-based pipeline using TensorFlow and
Flask, which supports real-time multi-domain threat detection. These short-
comings necessitate a deep learning approach that leverages sequential model-
ing, advanced class balancing, and efficient deployment to enhance cybersecurity
across URLs, files, and emails.

References
[1] Abad, S., Gholamy, H., Aslani, M. (2023). Classification of Ma-
licious URLs Using Machine Learning. Sensors, 23(18), 7760.
[Link]