A Comparative Study of Malicious URL Detection: Regular Expression Analysis, Machine Learning, and VirusTotal API

In this paper, malicious URL detection was done in three ways. In the first method, self-written code was used that breaks up the URL into several fragments and then using functions and checkers, it analyzes whether the URL is malicious. The second approach involved utilizing a fixed csv dataset containing website URLs from over 11,000 websites. Each entry in the dataset included 30 parameters describing the website and a class label indicating whether it was classified as a phishing website (1) or not (−1). Nine machine learning models were compared on this dataset to see which models gave the highest accuracy and F1-score. The last method was done using VirusTotal API Key. The user has to input the URL of a website and the code classifies it as malicious or not. A report is also generated if the URL is detected as malicious. The report is a compilation of the analysis of that website by several security vendors. The results showed that the self-written code achieved a 90% accuracy in detecting malicious URLs. All the nine machine learning models except for Naive Bayes Classifier obtained extremely high values for accuracy, F1-score, and recall. Thus, our study contributed to cybersecurity by demonstrating the effectiveness of multiple malicious URL detection methods, including a self-written code, machine learning models, and VirusTotal API, providing insights into their accuracy and potential applications.