Enhancing Email Security through Multi-Level Feature Fusion for Malicious URL Detection

Abstract

Phishing attacks that utilize URLs embedded in emails have become increasingly sophisticated, posing significant risks of sensitive data leakage and bypassing traditional security mechanisms. Conventional approaches, which rely on blacklists or manually crafted features, often struggle to keep pace with the rapidly changing characteristics of malicious URLs. In response to this challenge, this study explores the use of URLNet, a deep learning model that learns feature representations at both character and word levels, for detecting malicious URLs in email systems. A large-scale dataset comprising 927,037 URLs—657,736 benign and 269,301 malicious—was constructed to ensure a diverse and realistic sample. Alongside reproducing the original URLNet N-gram model, this research also evaluates Word–Char Fusion and hybrid architectures that integrate convolutional and recurrent neural networks. The experimental results demonstrate that the Word–Char Fusion model significantly surpasses the N-gram baseline, achieving an accuracy of 97.65%, an F1-score of 0.9596, and a ROC-AUC of 0.9954, while reducing inference time to 0.0763 milliseconds per sample. Although hybrid CNN-RNN models provide comparable detection performance, they entail higher computational costs. These findings suggest
that the Word–Char Fusion CNN architecture strikes an effective balance between detection accuracy and efficiency, making it well-suited for real-time deployment in practical email security settings.