# Malicious URL Detection Model Based on Bidirectional Gated Recurrent Unit and Attention Mechanism
## 4 Experimental Results and Analysis
### Data Preprocessing  
The data preprocessing is divided into four parts: data cleaning, word segmentation, vocabulary creation, and length interception. The data preprocessing flowchart is shown in Figure 9.  
\begin{table}
\begin{tabular}{c c c c c} \hline  & **Training Set** & **Validation Set** & **Test Set** & **Aggregate** \\ \hline Malicious URLs & 45,956 & 5879 & 13,701 & 65,536 \\ Benign URLs & 45,795 & 5917 & 13,824 & 65,536 \\ Aggregate & 91,751 & 11,796 & 27,525 & 131,072 \\ \hline \end{tabular}
\end{table}
Table 2: Number of samples in each data subset.  
Figure 8: Experimental process.  
**Data cleaning:** because the URL protocol is generally http:// or https://, this part of the content has little effect on the identification of malicious URLs. Therefore, this paper conducts data cleaning on URLs containing http:// and https:// in the experimental data set to remove redundant information to reduce the waste of features.  
**Word segmentation processing:** the clean data are segmented by regular expressions. Because the special symbols in the URL contain important feature information, the special symbols that often appear in the URL are counted. The statistics show that the following 14 special symbols appear more frequently: '-', ', ', '=', '/', '%', '&', ', '>', '(', ')', +', and '@'. Finally, this paper sets the word segmentation rules according to the following 14 symbols:'- = /? & # + < > ( )@'.  
**Creating a vocabulary:** although one-hot encoding is easy to construct, it cannot accurately express the arrangement of words, and when the number of words is large, one-hot encoding is prone to dimension disaster. Therefore, this paper selects the skip-gram model algorithm of Word2 Vec to train the vocabulary and obtain 50-dimensional word vectors.The vocabulary example can be seen in Table 3.  
**Length truncation:** Figure 10 shows the length statistics for the experimental data set URLs. Figure 10a shows that the length of malicious URLs is concentrated below 25 words in the experimental data set, and Figure 10b shows that the length of benign URLs is concentrated below 20 words. Therefore, in order to ensure the effective use of data, the cutoff length of URLs is set to 30 words, the URLs with less than 30 words are filled with 0s, and URLs with more than 30 words are cut to 30 words. Finally, the format of the input data is [64; 30; 50].  
\begin{table}
\begin{tabular}{c c} \hline \hline
**The Vocabulary Example: songfacts.com/detail.php?id=13410** \\ \hline
**Vocabulary** & **Word Vector (50 Dimensional)** \\ \hline songfacts & 0.019443182 0.013166171 \(-\)0.01845449 \(\ldots\)0.0075058653 \(-\)0.014516649 \\ com & \(-\)0.014362931 \(-\)0.012048096 0.0060079815 \(\ldots\)0.0001564598 0.012821173 \\ detail & 0.017598134 \(-\)0.0045375777 \(\ldots\)0.008738079 \(\ldots\)0.009549899 \(-\)0.012004385 \\ php & \(-\)0.012267966 0.016383838 \(-\)0.012978291 \(\ldots\)0.0018558073 \(-\)0.009730892 \\ id & \(-\)0.012249594 0.0065935757 \(-\)0.016826343 \(\ldots\)0.016014166 0.0075407173 \\
13/410 & 0.01679577 \(-\)0.01171321 \(-\)0.00045675278 \(\ldots\)0.011311102 \(-\)0.013720703 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Vocabulary example.  
Figure 9: Flowchart of data preprocessing.