Search papers, labs, and topics across Lattice.
This paper introduces SiNMULI, a novel signed network-based approach for identifying malicious URLs, addressing the limitations of traditional static analysis methods in the face of evolving online threats. By framing the problem as a binary classification task rooted in social network analysis, the authors construct a signed network where URLs are nodes and backlinks serve as signed edges, utilizing a balance-theoretic inference mechanism for classification. Experimental results demonstrate that SiNMULI achieves an impressive 99.89% accuracy, significantly outperforming conventional machine learning and deep learning models while providing interpretability and resilience against adversarial tactics.
SiNMULI achieves 99.89% accuracy in malicious URL detection, outperforming traditional models while being lightweight and interpretable.
In today's era of rapid advancements in artificial intelligence, computer security and online safeguarding measures have undergone significant improvements. However, malicious websites continue to facilitate the spread of phishing schemes, fraudulent activities and unsolicited communications. Conventional methodologies in machine learning, deep learning and counterfeit website detection predominantly depend on static data analysis, which frequently proves ineffective against the evolving nature of malicious online entities. In response to these challenges, in this work, we propose a signed network-based approach for malicious URL identification, SiNMULI. We introduce an innovative framework that conceptualises the identification of harmful URLs as a signed network-based binary classification problem strongly rooted in the fundamental principles of social network analysis and social balance theory. In this approach, a signed network is constructed based on the backlinks, i.e., external hyperlinks of URLs, wherein each node symbolises a URL and the hyperlinks function as signed edges. Utilising a balance-theoretic inference mechanism, our methodology propagates edge signs and classifies unlabeled domains by employing a 51% majority rule across incoming links. Experimental results on this real-world dataset demonstrate that SiNMULI achieves 99.89% accuracy, 99.62% precision, and 99.80% F1-score, outperforming traditional ML and deep learning baseline models. Beyond high accuracy, SiNMULI offers interpretability, resilience against adversarial obfuscation, and independence from training data, making it a lightweight and scalable solution for real-world cyber defence.
