# Effective Detection of Malicious Uniform Resource Locator (URLs) Using Deep-Learning Techniques
## 5 Conclusions  
In this study, we applied a Char2B model for malicious URL detection. A dataset of 87,216 URLs comprising both malicious and legitimate links collected and preprocessed to remove noise. The quality of the dataset validated using the Box-Cox transformation  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Ref.** & **Models** & **Datasets** & **Accuracy \%** & **Precision\%** & **Recall \%** & **F1-Score\%** \\ \hline
[9] & LogBERT-BiLSTM & CSIC 2010 & 99.50 & 100 & 100 & 100 \\ \hline
[10] & CharBiGRU-Attention & Custom & 99.55 & 99.64 & 99.43 & 99.54 \\ \hline
[15] & BERT & GitHub & 96.71 & 96.25 & 96.50 & - \\ \cline{2-7}  & \multirow{2}{*}{BERT} & ISX 2016 & 99.98 & - & - & - \\ \cline{3-7}  & BERT & Custom & 98.35 & 98.22 & 98.44 & 98.33 \\ \cline{2-7}  & \multirow{2}{*}{Char2B} & Custom & 98.50 & 98.27 & 98.69 & 98.48 \\ \cline{3-7}  & & Kaggle & 99.69 & 99.84 & 99.54 & 99.69 \\ \cline{3-7}  & & Gram-bedding & 94.84 & 94.85 & 94.77 & 94.81 \\ \hline \hline \end{tabular}
\end{table}
Table 11: Model comparison with related works.  
technique. We performed BERT and character-level tokenization, generating vocabularies of 15,911 and 64, respectively, to create rich embedding. The CharBiGRU and BERT embedding were fused using a Conv1D layer (kernel size = 3; stride and padding = 1), effectively capturing local features at the character level. Both the baseline BERT model and the fused Char2B model trained and evaluated separately. The Char2B model integrates both character-level and word/sub-word information, enabling it to extract hierarchical and contextual features through cross-attention mechanisms. After hyperparameter tuning and model training, the Char2B model achieved 98.50% accuracy and a false positive rate (FPR) of 0.017, outperforming the baseline model in Experiments 1 and 2. This fusion approach effectively detects attacks such as typo squatting, morphological, and substitution attacks by capturing comprehensive URL features. Furthermore, current URL analysis often overlooks the fragment section, which may include page-specific content or redirect information. While our model processes up to 200 tokens, BERT supports up to 512 tokens, suggesting the potential benefit of incorporating longer sequences. Lastly, while we normalized diacritics and capitalization in English-based URLs, this study did not explore multilingual URLs. Future research should address this gap by extending the model to support URLs in multiple languages and by incorporating the fragment section to enhance URL detection accuracy and generalization. Moreover, adversarial samples, in which character substitution, typo squatting, or homoglyph attacks alter a URL link, are also as recommended as a focus for future work.  
The work presented here carried out in collaboration among all authors. Conceptualization, Y.Y.M. and A.B.W.; formal analysis, Y.Y.M. and Y.B.C.; methodology, A.M.M. and Y.Y.M.; supervision, A.B.W.; visualization, Y.Y.M. and A.B.W.; writing--original draft, A.B.W.; writing--review and editing, Y.B.C. and A.M.M., Fund Acquisition, Y.Y.M. Finally, All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The dataset can be available upon request.  
The authors acknowledge the internet resources provided by the Bahir Dar Institute of Technology and Injbara University.  
The author reported no potential conflict of interest.