# URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection

arXiv: https://arxiv.org/abs/1802.03162 · HTML: https://mlsanity.com/paper/1802.03162/

## Key facts

- Cited by 34 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Feb 2018.

## Built on by (most cited first, 30 of 34)

- [KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection](https://mlsanity.com/paper/2403.02253/) (2024)
- [Markov Chain Monte Carlo-Based Machine Unlearning: Unlearning What Needs to be Forgotten](https://mlsanity.com/paper/2202.13585/) (2022)
- [Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search](https://mlsanity.com/paper/2502.04951/) (2025)
- [Defending Against Social Engineering Attacks in the Age of LLMs](https://mlsanity.com/paper/2406.12263/) (2024)
- [Learning Compressed Embeddings for On-Device Inference](https://mlsanity.com/paper/2203.10135/) (2022)
- [An Improved Transformer-based Model for Detecting Phishing, Spam, and Ham: A Large Language Model Approach](https://mlsanity.com/paper/2311.04913/) (2023)
- [Toward More Generalized Malicious URL Detection Models](https://mlsanity.com/paper/2202.10027/) (2022)
- [Phishing URL Detection: A Network-based Approach Robust to Evasion](https://mlsanity.com/paper/2209.01454/) (2022)
- [Web Content Filtering through knowledge distillation of Large Language Models](https://mlsanity.com/paper/2305.05027/) (2023)
- [Transformers for End-to-End InfoSec Tasks: A Feasibility Study](https://mlsanity.com/paper/2212.02666/) (2022)
- [LLMs are One-Shot URL Classifiers and Explainers](https://mlsanity.com/paper/2409.14306/) (2024)
- [Towards Web Phishing Detection Limitations and Mitigation](https://mlsanity.com/paper/2204.00985/) (2022)
- [DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification](https://mlsanity.com/paper/2409.09143/) (2024)
- [Characterizing Malicious URL Campaigns](https://mlsanity.com/paper/2108.12726/) (2021)
- [Quantitative AI Risk Assessments: Opportunities and Challenges](https://mlsanity.com/paper/2209.06317/) (2022)
- [CELEST: Federated Learning for Globally Coordinated Threat Detection](https://mlsanity.com/paper/2205.11459/) (2022)
- [Continuous Multi-Task Pre-training for Malicious URL Detection and Webpage Classification](https://mlsanity.com/paper/2402.11495/) (2024)
- [PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT](https://mlsanity.com/paper/2408.05667/) (2024)
- [Embeddings for Tabular Data: A Survey](https://mlsanity.com/paper/2302.11777/) (2023)
- [Profiler: Profile-Based Model to Detect Phishing Emails](https://mlsanity.com/paper/2208.08745/) (2022)
- [PhishClone: Measuring the Efficacy of Cloning Evasion Attacks](https://mlsanity.com/paper/2209.01582/) (2022)
- [A Transferable and Automatic Tuning of Deep Reinforcement Learning for Cost Effective Phishing Detection](https://mlsanity.com/paper/2209.09033/) (2022)
- [AntiPhishStack: LSTM-based Stacked Generalization Model for Optimized Phishing URL Detection](https://mlsanity.com/paper/2401.08947/) (2024)
- [Web Phishing Net (WPN): A scalable machine learning approach for real-time phishing campaign detection](https://mlsanity.com/paper/2502.13171/) (2025)
- [From Past to Present: A Survey of Malicious URL Detection Techniques, Datasets and Code Repositories](https://mlsanity.com/paper/2504.16449/) (2025)
- [WebGuard++:Interpretable Malicious URL Detection via Bidirectional Fusion of HTML Subgraphs and Multi-Scale Convolutional BERT](https://mlsanity.com/paper/2506.19356/) (2025)
- [Dual-Path Phishing Detection: Integrating Transformer-Based NLP with Structural URL Analysis](https://mlsanity.com/paper/2509.20972/) (2025)
- [Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection](https://mlsanity.com/paper/2603.01874/) (2026)
- [PhishMatch: A Layered Approach for Effective Detection of Phishing URLs](https://mlsanity.com/paper/2112.02226/) (2021)
- [Position Paper: Think Globally, React Locally -- Bringing Real-time Reference-based Website Phishing Detection on macOS](https://mlsanity.com/paper/2405.18236/) (2024)

## Abstract (arXiv)

Malicious URLs host unsolicited content and are used to perpetrate cybercrimes. It is imperative to detect them in a timely manner. Traditionally, this is done through the usage of blacklists, which cannot be exhaustive, and cannot detect newly generated malicious URLs. To address this, recent years have witnessed several efforts to perform Malicious URL Detection using Machine Learning. The most popular and scalable approaches use lexical properties of the URL string by extracting Bag-of-words like features, followed by applying machine learning models such as SVMs. There are also other features designed by experts to improve the prediction performance of the model. These approaches suffer from several limitations: (i) Inability to effectively capture semantic meaning and sequential patterns in URL strings; (ii) Requiring substantial manual feature engineering; and (iii) Inability to handle unseen features and generalize to test data. To address these challenges, we propose URLNet, an end-to-end deep learning framework to learn a nonlinear URL embedding for Malicious URL Detection directly from the URL. Specifically, we apply Convolutional Neural Networks to both characters and words of the URL String to learn the URL embedding in a jointly optimized framework. This approach allows the model to capture several types of semantic information, which was not possible by the existing models. We also propose advanced word-embeddings to solve the problem of too many rare words observed in this task. We conduct extensive experiments on a large-scale dataset and show a significant performance gain over existing methods. We also conduct ablation studies to evaluate the performance of various components of URLNet.