# A Hybrid Deep Learning and Anomaly Detection Framework for Real-Time Malicious URL Classification

arXiv: https://arxiv.org/abs/2512.03462 · HTML: https://mlsanity.com/paper/2512.03462/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 1 of its 19 references that are in the map.
- First posted on arXiv 30 Nov 2025.

## Builds on (most cited first, 1 of 1)

- [DeepBF: Malicious URL detection using Learned Bloom Filter and Evolutionary Deep Learning](https://mlsanity.com/paper/2103.12544/) (2021)

## Abstract (arXiv)

Malicious URLs remain a primary vector for phishing, malware, and cyberthreats. This study proposes a hybrid deep learning framework combining textttHashingVectorizer n-gram analysis, SMOTE balancing, Isolation Forest anomaly filtering, and a lightweight neural network classifier for real-time URL classification. The multi-stage pipeline processes URLs from open-source repositories with statistical features (length, dot count, entropy), achieving O(NL + EBdh) training complexity and a 20,ms prediction latency. Empirical evaluation yields 96.4% accuracy, 95.4% F1-score, and 97.3% ROC-AUC, outperforming CNN (94.8%) and SVM baselines with a 50!×--100!× speedup (Table~reftab:comp-complexity). A multilingual Tkinter GUI (Arabic/English/French) enables real-time threat assessment with clipboard integration. The framework demonstrates superior scalability and resilience against obfuscated URL patterns.