# Malicious URL Detection Model Based on Bidirectional Gated Recurrent Unit and Attention Mechanism
## 4 Experimental Results and Analysis
### Experimental Comparison  
In the training process, the change in malicious URL recognition accuracy and loss value with the number of training iterations is shown in Figure 11, where orange represents the training curve and blue represents the test curve. It can be seen from Figure 11a that the accuracy rate increases rapidly at the beginning of training. After the fifth iteration, an inflection point begins to appear, and after the 15 th iteration, the training curve begins to flatten. It can be seen in Figure 11b that the training loss curve and the validation loss curve begin to converge after the 15 th iteration. \begin{table}
\begin{tabular}{c c} \hline \hline
**Hyper Parameter** & \\ \hline Maximum length of truncated URLs & 30 \\ Initial learning rate & 0.0001 \\ Total training times & 30 \\ Batch size & 64 \\ BiGRU layer dropout rate & 0.2 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Hyper-parameter settings. Figure 11: Accuracy curve and loss curve of the experimental model. Figure 10: Length statistics of URLs. Figure 12 is the ROC curve of the experimental model. By observing the ROC curve, the area under curve (AUC) is close to 1, indicating that the DA-BiGRU model has a good classification effect. MLP is the starting point for studying more complex deep learning methods. GRU is a variant of LSTM, which is simplified compared with the internal structure of LSTM, and the accuracy is also improved. Therefore, this paper selects four models of MLP, Att-BiLSTM, Att-BiGRU, and Dro-Att-BiLSTM for comparative testing to verify the classification effect of this model. Among them, the Att-BiLSTM model adds an attention mechanism to BiLSTM, the number of BiLSTM layers is set to 1 layer, and the number of nerve nodes is set to 128; the Att-BiGRU model adds an attention mechanism to BiGRU, the number of layers of BiGRU is set to 1 layer, and the number of neural nodes is set to 100; the Dro-Att-BiLSTM model adds a dropout mechanism to the Att-BiLSTM model, and the dropout rate is set to 0.2. The data of the comparison model are consistent with those of the model in this paper. The tanh function is used as the activation function and the softmax function is used for final classification. In this paper, the DA-BiGRU model is compared with the other four models. The results of experimental comparison are shown in Figure 13.  
Figure 13a is the loss function curve of the training set. It can be seen from the graph that the DA-BiGRU model curve is smoother, and the loss rate is the smallest when compared with the comparison models. Figure 13b is the loss function curve of the validation set, and the Dro-Att-BiLSTM model has the largest oscillation amplitude. Figure 13c is the precision curve of the validation set. It can be seen in the graph that the Att-BiGRU model and the DA-BiGRU model have higher accuracies. Although the curve of Att-BiGRU is higher than that of DA-BiGRU in the intermediate verification process, DA-BiGRU is greater than Att-BiGRU in the later verification, which shows that the fitting effect of the model is better after adding the dropout mechanism. Figure 13d is the accuracy curve of the validation set. It can be seen in the graph that the DA-BiGRU model in this paper achieves a good classification effect during the verification process, and the accuracy reaches 0.9792. Overall, the model curves based on BiLSTM are lower than those based on BiGRU, indicating that the GRU model is more suitable for classification tasks with a strong sequence. Figure 13e is the recall curve of the validation set. It can be seen from the graph that DA-BiGRU has a good malicious URL detection ability. Figure 12: ROC curve of the experimental model. The experimental results of different models on the test set are shown in Table 5.  
From Table 5, we can see that the DA-BiGRU model in this paper is better than other models in each result parameter on the test set, and the accuracy is 0.9792. The MLP  
Figure 13: Comparison of experimental results of different methods.