# Classification of Malicious URLs by CNN Model Based on Genetic Algorithm
## 3 Results
### Convolutional Neural Network  
The data set completed by feature extraction is divided into 80% training set and 20% test set, and the target value is one-hot encoded, and the F2 is reshaped as the input of the network. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Reservechar** & **Otherchar** & **Digitcount** & **LongSubLetter** & **LongSubDigit** & \(\cdots\) & **Flag** \\ \hline
5 & 4 & 12 & 11 & 9 & 0 \\
7 & 3 & 2 & 14 & 2 & 0 \\
6 & 3 & 9 & 8 & 6 & 0 \\
6 & 2 & 0 & 7 & 0 & 0 \\
12 & 4 & 6 & 5 & 2 & 0 \\
5 & 1 & 7 & 4 & 7 & 0 \\
5 & 3 & 6 & 5 & 6 & 0 \\
5 & 3 & 4 & 9 & 4 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The data set after feature extraction. The parameters to be optimized in Keras-based 1 DCNN are convolution kernel size and network depth. In this experiment, a single-layer convolution layer and a pooling layer were used. The convolution kernels of each layer are equal in size, and different convolution kernel sizes are set for experiments. The number of convolution kernels is determined by experience. Figure 4 shows the model accuracy for different convolution kernel sizes when the number of channels is 32. As can be seen from Figure 5, under the premise of an unchanged number of channels, with the increase in convolution kernel size, the accuracy of network identification first increases and then decreases. When the convolution kernel size is 5, the network has the best recognition ability, so the convolution kernel size is 5. Figure 4: Model accuracy based on different convolution kernel sizes. Figure 5: Model structure information of Model C.  
In addition to the size of the convolution kernel, the depth of the network and the number of channels of the convolution kernel also affect the effectiveness of the model. Therefore, three models are established for experiments through different depths and different channel numbers, as shown in Table 3. The output of the convolution layer is obtained by the excitation function ReLU to obtain the input of the pooling layer. The process of convolution and pooling is filled in the way of 'VALID'. Set Dropout to 0.5, Adam Optimizer, learning rate to 0.0001, and epoch to 100 to train the model. In Table 4, Model A and Model B establish a pair of convolution layer and pooling layer and two pairs of convolution layer and pooling layer, respectively. Set the same size of the convolution kernel and pooling kernel, and the step size and channel size are 32. Model C has the same number of network layers as Model B, and the channel size is set to 64 for comparison. The data set is used to verify the three models, and the model is evaluated by the prediction accuracy rate (Equation (14)) and the loss rate (Equation (15)). The accuracy rate reflects the ability of the model to judge the overall sample correctly. The categorical_crossentropy loss rate is used to train the model through the loss value of each iteration. \[accuracy=\frac{TP+TN}{P+N} \tag{14}\]  
\[loss=-\sum_{i=1}^{outputsize}y_{i}\cdot\log\hat{y}_{i} \tag{15}\]  
Table 5 shows the accuracy and loss rate of the three models for malicious URL recognition. It can be seen from Table 3 that when the convolution kernel size is the same, the effect is better when the network depth is 7. When the size of the convolution kernel and the depth of the network are fixed, the effect of the larger number of channels is better, so model C has a better classification effect. The model structure information of model C is shown in Figure 5.  
Among them, the input in the input layer is a 20-dimensional feature vector; the output of Conv1d is 16, obtained by formula (9), and the output of Maxpooling1d is 8, obtained by formula (12). After that, a pair of convolutional layers and pooling layers are calculated the same. Figure 6 shows the loss rate obtained by using the network training iteration 100 times. It can be seen that the loss rate of the training set and the loss rate of the test set are both in a downward trend.