Final Complete Malicious Url Model

🚀 Malicious URL Detection Model

A fine-tuned BERT-LoRA model for detecting malicious URLs, including phishing, malware, and defacement threats.

🚀 Quick Start

This is a fine - tuned BERT - based classifier aimed at real - time detection of malicious URLs. It uses Low - Rank Adaptation (LoRA) for efficient fine - tuning, reducing computational costs while maintaining high accuracy.

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

# Load the model and tokenizer
model_name = "your-huggingface-model-name"
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForSequenceClassification.from_pretrained(model_name)

# Example URL
url = "http://example.com/login"

# Tokenize and predict
inputs = tokenizer(url, return_tensors="pt", truncation=True, padding=True, max_length=128)
with torch.no_grad():
    outputs = model(**inputs)
    prediction = torch.argmax(outputs.logits).item()

# Mapping prediction to labels
label_map = {0: "Benign", 1: "Defacement", 2: "Phishing", 3: "Malware"}
print(f"Prediction: {label_map[prediction]}")

✨ Features

• Classifies URLs into four categories: Benign, Defacement, Phishing, and Malware.
• Achieves 98% validation accuracy and an F1 - score of 0.965, ensuring robust detection capabilities.

📦 Installation

The README does not provide specific installation steps, so this section is skipped.

💻 Usage Examples

Basic Usage

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

# Load the model and tokenizer
model_name = "your-huggingface-model-name"
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForSequenceClassification.from_pretrained(model_name)

# Example URL
url = "http://example.com/login"

# Tokenize and predict
inputs = tokenizer(url, return_tensors="pt", truncation=True, padding=True, max_length=128)
with torch.no_grad():
    outputs = model(**inputs)
    prediction = torch.argmax(outputs.logits).item()

# Mapping prediction to labels
label_map = {0: "Benign", 1: "Defacement", 2: "Phishing", 3: "Malware"}
print(f"Prediction: {label_map[prediction]}")

Advanced Usage

The README does not provide advanced usage examples, so this part is not added.

📚 Documentation

Intended Uses

Use Cases

• Real - time URL classification for cybersecurity tools.
• Phishing and malware detection for online safety.
• Integration into browser extensions for instant threat alerts.
• Security monitoring for SOC (Security Operations Centers).

Model Details

Training Details

• Batch Size: 16
• Epochs: 5
• Learning Rate: 2e - 5
• Optimizer: AdamW with weight decay
• Loss Function: Weighted Cross - Entropy
• Evaluation Strategy: Epoch - based
• Fine - Tuning Strategy: LoRA applied to BERT layers

Evaluation Results

Category - wise Performance

Deployment Options

Streamlit Web App

• Deployed on Streamlit Cloud, AWS, or Google Cloud.
• Provides real - time URL analysis with a user - friendly interface.

Browser Extension (Planned)

• Real - time scanning of visited web pages.
• Dynamic threat alerts with confidence scores.

API Integration

• REST API for bulk URL analysis.
• Supports Security Operations Centers (SOC).

Limitations & Bias

⚠️ Important Note

• The model may misclassify complex phishing URLs that mimic legitimate sites.
• It needs regular updates to counter evolving threats.
• There is potential bias if future threats are not represented in training data.

Training Data & Citation

Data Source

Dataset sourced from Kaggle Malicious URLs Dataset:
📌 Dataset Link

BibTeX Citation

@article{maliciousurl2025,
  author    = {Gleyzie Tongo, Dr. Farnaz Farid, Dr. Ala Al-Areqi, Dr. Farhad Ahamed},
  title     = {Fine-Tuned BERT for Malicious URL Detection},
  year      = {2025},
  institution = {Western Sydney University}
}

Contact

For inquiries, collaborations, or feedback, feel free to reach out via LinkedIn:
🔗 Gleyzie Tongo

📄 License

This project is licensed under the Apache - 2.0 license.