# Multimodel Phishing URL Detection Using LSTM, Bidirectional LSTM, and GRU Models
## 3 Proposed Models
### Proposed Model I: Long Short-Term Memory (LSTM)  
Recurrent neural networks are a form of neural network that is good for processing sequence data prediction. As RNNs process more steps, they are more susceptible vanishing gradients than other neural networks [26]. LSTMs and GRU-based RNNs are methods for overcoming the challenges of simple RNNs [27]. LSTM, proposed in 1997 by [PERSON] and [PERSON], is an evolution of RNNs capable of learning long-term dependencies and remembering input information for a long period through gates [28]. It is composed of a cell state, an input gate, a forget gate, and an output gate [29]. The detailed architecture of LSTM is shown in Figure 2[30].  
In Figure 2, \(C_{t}=\) cell state, \(C_{t-1}=\) old cell state, \(f_{t}=\) forget gate, \(i_{t}=\) input gate, \(O_{t}=\) output gate, \(h_{t}=\) hidden state, tanh = hyperbolic tangent activation function, \(\widetilde{C}_{t}=\) cell update, and \(\sigma=\) sigmoid activation function.  
In the LSTM model, the cell state \(C_{t}\) is the main chain for the forward data flow. Two steps must be updated: one is from the forget gate \(f_{t}\), which decides which information to keep or forget from \(C_{t}\). Data from \(h_{t-1}\) and information from \(x_{t}\) are moved through the \(\sigma\) values that yield a 0 or 1. Here, 1 represents keep, and 0 represents forget. The final  
Figure 1: Conceptual architecture of the three proposed models for detecting phishing URLs.  
Figure 2: Detailed architecture of the long short-term memory (LSTM) model.  
result from the forget gate is multiplied by the old cell state \(C_{t-1}\) Equations (1) and (2). The second is from the input gate \(i_{t}\) and the candidate memory cell \(\widetilde{C}_{t}\), which decides whether to add new information. In an input gate, a sigmoid layer determines whether a piece of new information should be added. In the candidate memory cell, the input from \(h_{t-1}\) and the current input pass through a hyperbolic tangent function. The result from the input gate was multiplied by the values of the candidate memory cell. Finally, the two values from the first and second steps were added to update the cell state [31].  
\[f_{t}=\sigma(w_{t}\left[h_{t-1,X_{t}}\right]+b_{f}\ ) \tag{1}\]  
\[M_{t} =f_{t}*C_{t-1} \tag{2}\]  
\[i_{t}\ =\ \sigma(W_{i}\cdot\left[h_{t-1},x_{t}\right]+b_{i}) \tag{3}\]  
\[\widetilde{C}_{t}=\ \tanh\left(W_{c}\cdot\left[h_{t-1},x_{t}\right]+b_{c}\right) \tag{4}\]  
\[C_{t} =M_{t}+i_{t}*\widetilde{C}_{t} \tag{5}\]  
\[o_{t} =\ \sigma(W_{o}\left[h_{t-1}\,\ x_{t}\right]+b_{o}) \tag{6}\]  
Finally, the output gate determines the output value. First, the previous output and current input pass through a sigmoid function and are then multiplied by the newly updated cell after passing through a tanh function. See Algorithm 1.  
\[h_{t}=o_{t}*\ \tanh\left(C_{t}\right) \tag{7}\]  
```
Input : URL \(\left\{x_{1},x_{2},x_{3}\dots\ x_{L}\right\}\), \(L\) = length of URL Output : Phishing or legitimate (Y) Step 1 : Begin Step 2 : For \(t=1\) to \(L\) do Step 3 : calculate the value of \(f_{t}\) using Equation (1) Step 4 : if\(f_{t}=0\), then  forget the information Step 5 : else, the forget value is 1  keep the information Step 6 : End if Step 7 : Calculate an input gate value \(i_{t}\) Equation (3) Step 8 : Calculate the candidate key (\(\widetilde{C}_{t}\)) of another weight matrix in candidate memory cell Equation (4) Step 9 : Calculate the cell state \(C_{t}\) Equation (5) Step 10 : Compute the value of the output cell state \(O_{t}\) and multiply \(i_{t}\) by tanh of C and store it in \(h_{t}\) Equations (6) and (7) Step 11 : return (\(h_{t}\), \(C_{t}\)) Step 12 : End for Step 13 : Y = SoftMax (\(h_{1}\),\(J_{2}\)... \(h_{L}\)) Step 14 : End
```  
**Algorithm 1**Regular LSTM for phishing URL detection