# Malicious URL Detection Model Based on Bidirectional Gated Recurrent Unit and Attention Mechanism
###### Abstract  
With the rapid development of Internet technology, numerous malicious URLs have appeared, which bring a large number of security risks. Efficient detection of malicious URLs has become one of the keys for defense against cyber attacks. Deep learning methods bring new developments to the identification of malicious web pages. This paper proposes a malicious URL detection method based on a bidirectional gated recurrent unit (BiGRU) and attention mechanism. The method is based on the BiGRU model. A regularization operation called a dropout mechanism is added to the input layer to prevent the model from overfitting, and an attention mechanism is added to the middle layer to strengthen the feature learning of URLs. Finally, the deep learning network DA-BiGRU model is formed. The experimental results demonstrate that the proposed method can achieve better classification results in malicious URL detection, which has high significance for practical applications. attention mechanism; bidirectional gated recurrent unit; dropout mechanism; malicious URL detection +
Footnote †: journal:  
solve the contradiction between simulation and controllability, and the honeypot technology is mainly used for large-scale common security threats, whose defense ability against some special threats is far from sufficient. With the research wave based on machine learning, the application of machine learning to malicious URL detection has attracted a lot of attention from researchers. For example, [PERSON] et al. [9] used a multilayer perceptron (MLP) to detect malicious URLs, and found that for the same data set, the detection results of different feature sets may be different. [PERSON] et al. [10] presented an efficient unsupervised feature construction method based on the linear support vector machine model, and the research results proved its effectiveness. [PERSON] et al. [11] proposed a machine learning model combining a self-encoder with a class of support vector machines. The dimension of input data was reduced by the self-encoder, and the network events were classified by a class of support vector machines. [PERSON] et al. [12] used a naive Bayesian algorithm to detect malicious URLs based on the syntax, vocabulary, hosts, and other content of the URL embedded in the email. [PERSON] et al. [13] integrated the http request features in the process of visiting the website into the detection feature set. By extracting the content of each field in the request header and request body, classification methods such as decision tree and SVM were used to complete the research. Because traditional machine learning methods require complex feature selection, such methods usually have the problem of poor scalability, that is, a feature or a class of features that is currently extracted may have good results in a certain type of malicious web page recognition problem, but the performance is degraded in other types of malicious web page recognition problems. Deep learning is an important upgrade to machine learning. In recent years, with the unique advantages of deep learning in natural language processing (NLP), speech recognition, image recognition, and other fields, it has also brought new developments to the detection of malicious web pages. For example, [PERSON] et al. [14] presented an automatic URL feature extraction method based on a convolutional neural network and verified the extraction results by combining random forests, support vector machines (SVM), and other classification methods, which proved the effectiveness of the deep learning method for URL feature extraction. However, convolutional neural networks can only learn the local features of URLs and cannot learn their context information. [PERSON] et al. [15] detected malicious URLs based on artificial neural network (ANN), convolutional neural network (CNN) and recurrent neural network (RNN) models. In their results, the RNN model had the best performance, with an accuracy of 94%.