International Journal of Advances in Applied Sciences (IJAAS) Vol.
No.
September 2025, pp.
ISSN: 2252-8814.
DOI: 10.
11591/ijaas.
A hybrid features based malevolent domain detection in cyberspace using machine learning Saleem Raja Abdul Samad1.
Pradeepa Ganesan1.
Amna Salim Rashid Al-Kaabi1.
Justin Rajasekaran1.
Murugan Singaravelan2.
Peerbasha Shebbeer Basha3 Department of Information Technology.
College of Computing and Information Sciences.
University of Technology and Applied Sciences.
Shinas.
Sultanate of Oman Department of Computer Science and Engineering.
Vel Tech Rangarajan Dr.
Sagunthala R&D Institute of Science and Technology.
Chennai.
India Department of Computer Science.
Jamal Mohamed College.
Affiliated to Bharathidasan University.
Tiruchirappalli.
Tamil Nadu.
India
Article Info
ABSTRACT
Article history:
The rise of social media has changed modern communication, placing information at our fingertips.
While these developments have made our lives easier, they have also increased cybercrime.
Cyberspace has become a refuge for modern cybercriminals to conduct destructive actions.
Most cyberattacks are carried out through malicious links shared on social media platforms, emails, or messaging services.
These attacks can have serious consequences for individuals and organizations, including financial losses, sensitive data breaches, and damage to reputation.
Early identification and blocking of such links are crucial to protecting internet users and securing Current research uses machine learning (ML) algorithms to detect malicious hyperlinks based on observed patterns in uniform resource locators (URL.
or web content.
However, cyberattack tactics are constantly To address this challenge, this paper introduces a robust method that performs a fine-grained analysis of URLs for classification.
Lexical and n-gram features are examined separately, with URL n-grams represented using Word2Vec embeddings.
The results from hybrid feature sets are combined using a logistic regression (LR) model to increase overall classification accuracy.
This robust method allows the system to use both the structural components of the URL and the fine-grained patterns obtained by the n-grams.
Received Aug 29, 2024 Revised Jun 8, 2025 Accepted Jun 20, 2025 Keywords:
Machine learning Malicious URL Natural language processing N-gram Phishing Word2Vec This is an open access article under the CC BY-SA license.
Corresponding Author:
Saleem Raja Abdul Samad Department of Information Technology.
College of Computing and Information Sciences University of Technology and Applied Sciences Al Aqar.
Shinas.
Sultanate of Oman Email: saleem.
abdulsamad@utas.
INTRODUCTION
Most cyberattacks originate from malicious links disseminated via email, social media posts, and instant messaging applications.
These links direct users to harmful websites specifically designed to compromise their security.
By clicking on these links, victims can suffer a range of consequences, including the attacker collecting personal data from the victim, compromising accounts, downloading and installing malware .
iruses, ransomware, spyware, or trojan.
, and wreaking havoc on the situation.
Compromised accounts can harm the reputation of individuals and the company's brands and may lead to financial losses.
Moreover, compromised systems may be used as "zombies" to launch further attacks on other networks.
Detecting such malicious links in cyberspace is challenging for internet users .
To automate the detection Journal homepage: http://ijaas.
Int J Adv Appl Sci
ISSN: 2252-8814
process, researchers consider different elements of the uniform resource locator (URL) or website, including URL lexical features, n-gram features, website content, reputation, and visual similarity .
Lexical features analyze the structural components of the URL, such as the domain name, path, number of subdomains, and number of dots, to identify suspicious patterns.
N-gram analysis goes deeper by examining the characterlevel details of the URL, uncovering hidden patterns, subtle character changes, and obfuscation techniques.
URL analysis is generally less resource-intensive and computationally efficient than other methods, allowing for the quick classification of malicious URLs with minimal risk to the system.
Web content analysis, which inspects textual content, images, videos, and structural elements like hypertext markup language (HTML) tags and scripts, offers more accurate detection but poses risks, as malicious content can potentially infect the system analyzing it.
Reputation checks rely on external services to assess a website's trustworthiness based on factors like domain server details and its ranking at both national and global levels.
However, the short lifespan of malicious websites makes this process time-consuming.
Finally, visual similarity analysis compares screenshots of suspicious websites with legitimate ones using image processing techniques.
However, this method is highly resource-intensive and demands significant computational power.
Current security systems often rely on a blacklisting or signature-based approach.
In this method.
URLs are checked against a blacklist database to determine whether they should be allowed or denied.
If the URL is present in the blacklist, access is blocked.
otherwise, it is permitted.
This is an easy and fast method for detecting malicious URLs.
However, it has significant drawbacks.
The blacklist database needs constant updates to identify newly created malicious URLs, making it ineffective against new threats.
Additionally, attackers can bypass these systems by minor modifications to malicious URLs, making them undetectable unless the exact URL or signature is listed .
An alternative method is rules-based detection, which applies generalized rules to identify malicious URLs.
While this helps broaden detection, it requires extensive domain expertise to create accurate rules.
Additionally, modern attacks often require more complex rules, making them difficult to implement and maintain .
As a result, many researchers prefer machine learning (ML) approaches.
They can detect previously unknown attacks that do not match existing signatures.
continuously training on large datasets, these models can improve their accuracy and dynamically adjust to changing patterns of malicious behavior .
, .
The proposed system combines URL structural elements .
exical feature.
with URL character-level elements .
-gram feature.
to enhance the detection of malicious URLs.
Lexical features include the URL structure, domain length, subdomains, special characters, and query parameters, which help identify patterns associated with phishing or malware sites.
To capture more granular characteristics, the system also utilizes n-gram features, which break down the URL into sequences of These n-gram features are represented using Word2Vec embeddings, an ML technique that transforms character sequences into dense vectors.
This approach captures the semantic relationships between different character sequences, enabling the system to detect subtle patterns in malicious URLs that might be missed by conventional methods .
The system achieves improved classification performance by integrating lexical and n-gram features compared to existing ML-based methods.
The contributions in this paper are: .
utilized a balanced dataset from a common repository to ensure reliable evaluation.
extracted more sensitive lexical features from the URL dataset to enhance detection accuracy.
employed n-gram features with Word2Vec embeddings to identify finer, hidden patterns within URLs.
and i.
integrated lexical and n-gram features .
ybrid featur.
, leading to superior classification performance compared to existing ML-based methods.
The remainder of the paper is organized as follows: section 1 outlines the significance of the problem and presents an overview of the proposed Section 2 reviews existing research in the problem domain.
Section 3 details the proposed method, while section 4 presents the experimental results.
Finally, section 5 concludes the paper.
RELATED WORKS
This section presents an overview of recent research in the problem domain, focusing on URL feature analysis.
Joshi et al.
developed a malicious URL detection method that significantly enhances malicious URL detection.
To distinguish between dangerous and benign URLs, the authors gathered over 5 million URLs from various sources and identified 23 distinct lexical features.
These lexical features were merged with 1,000 trigram-based features to generate 1,023-dimensional vectors.
Among the classifiers, the random forest (RF) model scored the highest accuracy .
%), indicating that it is the most effective classification method.
Raja et al.
used the University of New Brunswick (UNB) 2016 dataset for feature extraction, identifying 27 features .
new, 18 standar.
After correlation analysis, 20 features were selected for testing classifiers like RF, k-nearest neighbor (KNN), support vector classifier (SVC), logistic regression (LR), and nayve Bayes (NB).
RF achieved 99% accuracy.
Ha et al.
developed a system to detect fraudulent websites that use ML methods such as RF, decision tree (DT).
AdaBoost, and KNN.
Researchers used a dataset of 213,345 URLs divided into five categories .
enign, defacement.
A hybrid features based malevolent domain detection in cyberspace A (Saleem Raja Abdul Sama.
A ISSN: 2252-8814 phishing, malware, and spa.
and 20 extracted features.
The RF algorithm achieved the highest accuracy 68% in detecting dangerous websites.
Afzal et al.
proposed a system using artificial neural network (ANN) and bidirectional encoder representations from transformers (BERT) to extract contextual embeddings from URLs, protecting users from malicious websites by categorizing URLs into spam, phishing, malware, defacement, and benign.
They used Kaggle and UNB datasets with 172,000 URLs for training and classification.
The model utilized BERT's tokenization and a 12-layer transformer encoder, achieving a high accuracy of 98% and outperforming traditional embedding methods like Word2Vec.
FastText, and GloVe.
Their approach excelled in precision, recall, and F-measure, all at 98%.
Kumi et al.
proposed a classification-based on association (CBA) technique for detecting risky URLs by assessing URL features and webpage content.
CBA constructs an accurate classifier using association rules from a training dataset, achieving 95.
accuracy with minimal false positive and negative rates.
It demonstrated strong reliability when tested against 1200 tagged URLs.
Al-Haija and Al-Fayoumi .
proposed an ML-based approach for detecting malicious URLs using the ISCX-URL2016 dataset of 57,000 samples, including binary and multi-class labels and 79 features.
Their method first differentiates between benign and harmful URLs and then splits malicious URLs into five categories: defacement, malware, phishing, spam, and benign.
The researcher used four ensemble learning approaches, with bagging trees achieving the highest accuracy in binary .
3%) and multi-class .
92%) classifications.
Raja et al.
proposed a method for detecting bogus links by analyzing linguistic features of URLs.
Three natural language processing (NLP)-based vectorizers are tested with six distinct ML methods.
Results demonstrate that the proposed method with count vectorizer RF algorithm delivers higher accuracy .
49%).
Lee et al.
demonstrated that particle swarm optimization (PSO) improves URL feature selection for malicious URL detection.
The researchers used a support vector machine (SVM) and NB to obtain 99% accuracy.
Raja et al.
developed a method for vectorizing URLs for feature generation using NLP techniques such as word frequency and inverse document frequency.
To classify risky hyperlinks, researchers used a weighted soft voting classifier with two steps of weight adjustment to increase accuracy.
The approach was evaluated on two datasets.
D1 and D2, outperforming base classifiers.
The accuracy obtained was 91.
4% for D1 and 98.
8% for D2, proving that it is better than other methods.
Table 1 summarizes the existing methods.
The related work highlights the importance of using a hybrid feature approach that combines both lexical features and n-gram features of URLs, enhanced by Word2Vec This robust method has proven to be effective in classifying malicious URLs.
Table 1.
Summary of related works Author.
Joshi et al.
Dataset Openphish.
Alexa whitelists, internal FireEye sources Raja et al.
UNB 2016 dataset Ha et al.
OpenPhish Phishtank.
Zone-H.
WEBSPAMUK2007.
Dataset from Kaggle OpenPhish.
VxVault.
URLhaus Afzal et al.
Kumi et al.
Al-Haija and Al-Fayoumi .
ISCX-URL2016 Raja et al.
Dataset from Kaggle Lee et al.
Curated dataset Raja et al.
ISCX-URL2016.
UNB
Phishtank Feature set 23 lexical features of URLs 1,000 trigrambased features of URLs 27 lexical features of URLs 20 lexical features of URLs Word Embedding of URLs Lexical and host-based features of URLs, web content features 79 URL features 8 lexical features of URLs and n-gram features of URLs 9 features include lexical and host-based Vectorized URLs Int J Adv Appl Sci.
Vol.
No.
September 2025: 916-927 Remarks Trigrams alone may not fully capture the detailed characteristics of the URL string.
Moreover, contextual representation is also necessary.
The lexical features of URLs alone may not suffice for a robust system.
N-gram features can be used to reveal hidden patterns within the URLs The lexical features of URLs alone may not suffice for a robust system.
N-gram features can be used to reveal hidden patterns within the URLs Time-intensive and computationally expensive URLsAo limited lexical features are insufficient for developing a robust system.
Moreover, web content analysis may affect the processing system.
URLsAo limited features are insufficient for developing a robust system.
N-gram features can be used to reveal hidden patterns within the URLs URLsAo limited lexical features are insufficient for developing a robust system.
Moreover, n-gram requires contextual representation.
URLsAo limited lexical and host-based features are insufficient for developing a robust system.
The domain name alone is insufficient for effectively classifying a URL.
Furthermore, a contextual representation of the URL is required rather than exclusively depending on vectorized Int J Adv Appl Sci
ISSN: 2252-8814
METHOD
Recent research has increasingly focused on the lexical analysis of URLs due to their risk-free nature and faster detection capabilities.
However, this approach has some limitations.
For instance, encoded or hidden characters can evade lexical analysis, and legitimate URLs with unusual patterns, such as excessively long URLs with multiple parameters, might be incorrectly flagged as malicious.
URLs that closely mimic popular legitimate sites might be misclassified as safe.
To address these issues, the proposed system incorporates n-gram analysis, a method in NLP that examines continuous sequences of characters or This technique helps to identify unusual or suspicious patterns within URLs more effectively.
Combining lexical analysis and n-gram analysis makes the system more robust and performs better than existing methods.
Figure 1 shows the architecture of the proposed system.
Figure 1.
Architecture of the proposed method Dataset The proposed method utilizes the full potential of the URL dataset.
Tables 2 and 3 present a summary of the dataset, which includes benign and malicious URLs, including defacement, phishing, and malware URLs.
The dataset used for the experiment was collected from Kaggle and PhishTank.
Table 2.
Dataset details Dataset Kaggle .
Phishtank .
URLs Benign and malicious .
hishing, malware, and defacement URL.
Malicious .
URLs Table 3.
Dataset summary Type
Benign
Malicious Count
15,530
15,882
Feature extraction Feature extraction from URLs involves analyzing the structure of each URL to identify important characteristics that can reveal its underlying format and intent.
This process helps in distinguishing between benign and malicious URLs based on specific patterns and tokens present within the URL string.
Table 4 provides a detailed list of the lexical features extracted from the URL dataset, which were subsequently stored in a file for further analysis and model training.
Subdomain Cybercriminals often add multiple subdomains to create complex URL structures .
, .
that mimic legitimate websites, deceiving users and security systems.
For example, the http://login.
com may appear legitimate at first glance, deceiving users into believing they are visiting a legitimate website.
However, it's a malicious website.
Punycode Punycode is a way to represent Unicode characters in an American standard code for information interchange (ASCII)-compatible format, allowing non-ASCII characters to be used in domain names .
This encoding is essential for supporting internationalized domain names (IDN.
, which allow users around the world to use native scripts in web addresses.
For instance, the Punycode version of Auappsdomain.
comAy A hybrid features based malevolent domain detection in cyberspace A (Saleem Raja Abdul Sama.
A ISSN: 2252-8814 could be Auxn--ppsdomain-9wb.
comAy, where a Cyrillic AuaAy replaces the standard Latin AuaAy, illustrating how deceptive lookalike domains can be created.
URL redirection URL redirection is a technique that redirects users and search engines from one URL to another, directing traffic to a specified web page .
However, it can also be used for malicious purposes like phishing or malware distribution.
Cybercriminals often use URL redirection to hide malicious links, directing users to bogus websites .
that appear legitimate.
Some keywords are most commonly used for URL redirection, such as redirect, target, and next.
Suspicious keywords When analyzing potentially harmful URLs, identifying suspicious keywords is essential, as these terms often signal malware or phishing threats .
Such keywords typically include terms like Aulogin,Ay Auverify,Ay Auupdate,Ay or brand names commonly exploited in social engineering attacks.
In this experiment, a total of 63 keywords were identified and used as indicators of malicious intent to enhance detection accuracy.
URL entropy In information theory, entropy measures uncertainty or randomness in a system.
In the context of URLs, entropy can be used to measure their complexity and possible maliciousness by examining their length, character diversity, and overall structure .
High URL entropy indicates that the URL is more complex and potentially obfuscated.
Table 4.
URL features Feature url_len has_ssl pres_subdom age_dom url_entropy pres_punycode pres_short_url is_path_manipulation has_redirect has_susp_keyword no_dom_segment avg_seg_len path_entropy path_len path_splchr_count dom_numeric sym_dots sym_slash sym_hyphen sym_hash sym_semicol sym_and sym_underscr count_alpha count_num url_type Description Length of the URL Check the SSL certificate for the URL Check the presence of a subdomain in the URL Age of the domain Entropy of the URL Presence of Punycode in the URL Presence of the short URL Check the path manipulation Checks the presence of the URL-redirection keywords in the URL Checks the presence of suspicious keywords in the URL Number of sub-domains segments Average length of the subdomain segments Entropy of the URL path Length of the path Count the special characters in the path Is the domain numeric Count dot symbols in the URL Count slash symbols in the URL Count hyphen symbols in the URL Count hash symbols in the URL Count semicolon symbols in the URL Count and symbols in the URL Count underscore symbols in the URL Count the alphabets in the URL Count numbers in the URL URL type .
-Benign, 1-Maliciou.
Feature selection The next step of feature extraction is feature selection.
In the data preprocessing stage of ML, feature selection is an essential step that reduces dimensionality and chooses the most important features to improve model performance.
This procedure helps remove irrelevant or redundant features, leading to overfitting and increased computing costs .
Using statistical testing, the SelectKBest technique is used for the experiment to select the features with the strongest correlation to the target variable.
The analysis of variance (ANOVA) test determines whether there are significant differences in the means of different groups based on the features, allowing SelectKBest to rank features in order of significance.
Base learners After feature selection.
ML models were trained.
Eight classification models were used for the experiment: SVC.
LR.
Gaussian Nayve Bayes (GNB).
KNN.
DT.
RF, gradient boosting (GB), and extreme Int J Adv Appl Sci.
Vol.
No.
September 2025: 916-927
Int J Adv Appl Sci
ISSN: 2252-8814
gradient boosting (XGB) .
K-fold validation was used to measure the ML model's performance more Generally, a K-fold divides a dataset into K equally-sized folds or subsets.
The value of K for our experiment is 10.
One-fold is utilized as the validation set, and the remaining K-1 folds are used for training each iteration.
This method ensures that every data point is used for training and validation, reducing bias and delivering a more accurate evaluation of the model's performance .
The modelAos predictions are passed to a meta-learner during validation to make the final decision.
Preprocess In phase 2, the same dataset is used for n-gram generation.
However, data preprocessing is required before generating n-grams .
This includes converting all URLs to lowercase and removing irrelevant characters, such as special symbols.
Furthermore, frequent terms such as "https," "http," "ftp," and "w" are stripped away to provide cleaner and more informative n-gram analysis.
N-gram generation To generate "n-grams" from URLs, text data is stripped into "n-grams," which are collections of adjacent characters of a predetermined length.
To create n-grams for the experiment, sequences of 3 to 7 characters are extracted from URLs .
For example, given a URL like "mywebdom.
com," 3-gram generation would produce sequences such as "myw," "ywe," and "web,".
This process helps to capture both shorter and longer patterns within the URL.
Word2Vec embedding In NLP.
Word2Vec is the most common method for creating word embeddings, representing words as dense, continuous vectors in a high-dimensional space.
Word2Vec contains two models.
Skip-gram and continuous bag of words (CBOW) .
This experiment uses the CBOW model, which predicts a target word from its surrounding context.
Representing URL n-grams using Word2Vec, which captures the semantic relationships between URL components to generate dense, meaningful vector representations.
This technique allows for a more precise URL analysis with ML models.
Dimension reduction using principal component analysis Dimensionality reduction is important in textual data preprocessing, especially after n-gram representation with Word2Vec.
The n-gram format captures the context and co-occurrence of words by evaluating word sequences, resulting in high-dimensional feature spaces.
This high dimensionality can present difficulties, such as higher computing costs and the possibility of overfitting.
Principal component analysis (PCA) is a widely used dimensionality reduction approach that converts high-dimensional data into a lower-dimensional space while retaining as much variance as possible .
Using PCA after n-gram representation with Word2Vec embeddings can effectively reduce the dataset's complexity, allowing for more efficient processing and model performance.
Matrix X represents the Word2Vec embeddings of a vocabulary, where each row corresponds to a word vector with d dimensions.
If there are n words in the vocabulary, the matrix X will have dimensions nyd, as shown in .
ycU = yc2 Ie [ ycycu ] .
Where Ie ycycn is the Word2Vec embedding in the i word.
Subtract the mean of each dimension .
from the corresponding dimension of each word vector as shown in .
This centers the data around the origin.
ycUI = ycU Oe ycUI Where I X is the mean vector of the embeddings in X, computed as shown in .
ycUI = ycu Ocycuycn=1 yc The covariance matrix C captures how different dimensions .
of the Word2Vec embeddings co-vary.
It is calculated as described in .
A hybrid features based malevolent domain detection in cyberspace A (Saleem Raja Abdul Sama.
A ISSN: 2252-8814
ya = ycuOe1 ycUI ycN ycUI
IT X
I is the dot product of the centered matrix X I and its transpose, and Where X is a normalization ycuOe1 Calculate the eigenvectors V and eigenvalues of the covariance matrix C.
The eigenvectors represent the directions of the maximum variance, and the eigenvalues give the magnitude of the variance in those directions, as indicated in .
yaycO = V Sort the eigenvectors by their corresponding eigenvalues in descending order.
Select the top k eigenvectors to form a projection matrix P as shown in .
ycE = .
c1 yc2 U ycyco ] .
Where yc1 , yc2 ,U ycyco are the top k eigenvectors.
I onto the new subspace defined by the principal Project the original Word2Vec embeddings X components as indicated in .
ycs = ycUI P Where Z is the new lower-dimensional representation of the Word2Vec embeddings, and Z will have dimensions nyk, where k is the number of selected principal components.
Meta-learner A meta-learner is an ML classifier that enhances predictive performance by integrating the results from multiple base learners.
In this experiment, the meta-learner is an LR classifier that combines two base learners, one with a lexical URL representation and the other with an n-gram URL representation.
The lexical URL representation captures the structure and components of a URL, whereas the n-gram representation analyzes sequential patterns within the URL.
The meta-learner capitalizes on the capabilities of both base learners by integrating their predictions, allowing it to reach a more informed decision.
This model can efficiently weigh each base learner's contribution using LR as the meta-learner, improving the classification accuracy .
In .
, represents the process of meta-learning.
ycyceycnycuycayco = yua ( yc1 .
ycycoyceycuycnycaycayco yc2 .
ycycuOeyciycycayco yca ) .
Where ycyceycnycuycayco is the final prediction for the meta-learner (LR).
ycycoyceycuycnycaycayco is the prediction from the lexical URL representation base learner.
ycycuOeyciycycayco is the prediction from the n-gram URL representation base learner.
yc1 ycaycuycc yc2 are the weights the LR assigns to each base learnerAos output.
yca is the bias term in the LR.
and yua is the sigmoid function, defined as in .
= 1 yce yc The LR meta-learner combines the outputs ycycoyceycuycnycaycayco and ycycuOeyciycycayco , applies learned weights yc1 ycaycuycc yc2 , and passes the result through the sigmoid function to produce the final decision ycyceycnycuycayco , typically a probability or binary classification.
RESULTS AND DISCUSSION
The experiment was performed on a Windows i7 with Python and Jupyter Notebook.
The popular scikit-learn package was utilized for ML algorithms.
This experiment compared eight different ML Each model was systematically trained and tested on a labeled URL dataset, allowing for a comprehensive comparison of their performance in accurately classifying malicious versus benign URLs.
The results of the lexical representation of the URL are shown in Table 5.
A total of 25 independent and 1 dependent feature was extracted from the URL, as detailed in Table 3.
Using the SelectKBest method for feature selection, multiple ML algorithms were examined with a feature range of 15 to 25.
The results in Table 5 indicate that the number of features set at 20 and 25 yields nearly identical In particular, with 20 features, the RF and XGB algorithms achieve accuracies of 99.
22 and 36%, respectively.
Lexical features alone could fail to recognize tiny yet vital patterns in malicious URLs.
Int J Adv Appl Sci.
Vol.
No.
September 2025: 916-927
Int J Adv Appl Sci
ISSN: 2252-8814
such as specific character sequences or word combinations that appear frequently in such attacks.
Word2Vec can map these sequences into continuous vector spaces, where semantically similar patterns are positioned closely together by representing the URL as n-grams.
This improves the model's ability to detect anomalies and understand the relationships between URL fragments.
Table 6 shows the experimental results for URL representation using n-gram in combination with Word2Vec.
In this experiment.
PCA was used to minimize the dimensionality of the vector space by selecting 35 to 45 components, maximizing the representation while keeping important information.
Table 5.
Results of the lexical representation of URL
Number of features ML algorithm
SVC
GNB
KNN
XGB
SVC
GNB
KNN
XGB
SVC
GNB
KNN
XGB
Accuracy (%) Precision (%) Recall (%) F1-score (%) Table 6 shows that the results obtained with 40 and 45 PCA components are almost identical.
Therefore.
PCA with 40 components was chosen for the experiment.
Combining lexical and n-gram feature representations of URLs yields a more robust method for classifying URLs into malicious or benign.
This hybrid method takes advantage of the URL's structural and sequential patterns, improving the model's capacity to detect threats more effectively.
Table 7 presents the experimental results of the hybrid method .
exical and n-gram representation of URL).
Figure 2 depicts the ROC-AUC Curve for the XGB classifier.
Table 6.
Results of n-gram URL representation with Word2Vec and PCA .
Number of components ML algorithm
SVC
GNB
XGB
SVC
GNB
KNN
XGB
SVC
GNB
KNN
XGB
Accuracy (%) Precision (%) Recall (%) F1-score (%) A hybrid features based malevolent domain detection in cyberspace A (Saleem Raja Abdul Sama.
A ISSN: 2252-8814 Table 7.
Experimental results of the hybrid method .
exical and n-gram URL representatio.
ML algorithm
SVC
GNB
KNN
XGB
Accuracy (%) Precision (%) Recall (%) F1-Score (%) Figure 2.
ROC-AUC curve for XGB classifier The result shows that the RF and XGB give an accuracy of 99.
30 and 99.
43%, respectively.
Table 8 and Figure 3 illustrate a performance comparison of the proposed hybrid method with existing The results show that the proposed hybrid method surpasses other existing methods in accuracy.
Table 8.
Performance comparison between existing methods and the proposed method Author.
Joshi et al .
Raja et al.
Ha et al.
Afzal et al.
Kumi et al.
Al-Haija and Al-Fayoumi .
Raja et.
Lee et al.
Raja et al.
Proposed method Accuracy (%) Accuracy (%) Author.
Figure 3.
Graphical comparison of performance between existing methods and the proposed method Int J Adv Appl Sci.
Vol.
No.
September 2025: 916-927
Int J Adv Appl Sci
ISSN: 2252-8814
CONCLUSION
This study highlights the need for efficient detection systems to escalate cyberattack threats to various industries.
The examination of related works has illuminated the limitations of existing methods, highlighting the necessity for our proposed approach.
The proposed method leverages a balanced dataset to avoid bias.
The proposed system enhanced detection accuracy by extracting sensitive lexical features and employing n-gram features with Word2Vec embeddings.
Integrating these hybrid features resulted in superior classification performance, significantly outperforming existing methods.
The experiment results reveal that the RF and XGB classifiers achieved impressive accuracy rates of 99.
30 and 99.
FUNDING INFORMATION
This research project was funded by the University of Technology and Applied Sciences.
Shinas, through the Internal Research Funding Program-2024, grant number (UTAS-Shinas-cy01-2024-.
AUTHOR CONTRIBUTIONS STATEMENT
This journal uses the Contributor Roles Taxonomy (CRediT) to recognize individual author contributions, reduce authorship disputes, and facilitate collaboration.
Name of Author Saleem Raja Abdul Samad Pradeepa Ganesan Amna Salim Rashid Al-Kaabi Justin Rajasekaran Murugan Singaravelan Peerbasha Shebbeer Basha C : Conceptualization M : Methodology So : Software Va : Validation Fo : Formal analysis ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue ue : Investigation : Resources : Data Curation : Writing - Original Draft : Writing - Review & Editing ue ue ue ue ue ue ue Vi : Visualization Su : Supervision P : Project administration Fu : Funding acquisition CONFLICT OF INTEREST STATEMENT Authors state no conflict of interest.
DATA AVAILABILITY
Data availability is not applicable to this paper as no new data were created or analyzed in this study.
REFERENCES