Enhancing Email Security through Multi-Level Feature Fusion for Malicious URL Detection

Abstract

Phishing attacks that utilize URLs embedded in emails have become increasingly sophisticated, posing significantrisks of sensitive data leakage and bypassing traditional security mechanisms. Conventional approaches, which rely onblacklists or manually crafted features, often struggle to keep pace with the rapidly changing characteristics of maliciousURLs. In response to this challenge, this study explores the use of URLNet, a deep learning model that learns featurerepresentations at both character and word levels, for detecting malicious URLs in email systems. A large-scale datasetcomprising 927,037 URLs657,736 benign and 269,301 maliciouswas constructed to ensure a diverse and realistic sample.Alongside reproducing the original URLNet N-gram model, this research also evaluates WordChar Fusion and hybridarchitectures that integrate convolutional and recurrent neural networks. The experimental results demonstrate that theWordChar Fusion model significantly surpasses the N-gram baseline, achieving an accuracy of 97.65%, an F1-score of0.9596, and a ROC-AUC of 0.9954, while reducing inference time to 0.0763 milliseconds per sample. Although hybrid CNN-RNN models provide comparable detection performance, they entail higher computational costs. These findings suggest
that the WordChar Fusion CNN architecture strikes an effective balance between detection accuracy and efficiency, makingit well-suited for real-time deployment in practical email security settings.