GraphSAGE-Based Malware URL Detection: A Scalable Graph Neural Network and Using NLP Approach

The increase in phishing websites reached 387% annually, and they became primary tools to conduct cyberattacks. This paper introduces a GraphSAGE-based detection framework that innovatively revolutionizes URL classification by modelling lexical, syntactic, semantic, and topological structures within four abstraction layers. The model achieved an accuracy rate of 99.73% with a latency of just 2.3 ms per URL and was tested against 1.6 million samples across 17 threat categories using Thor data. Significant innovations include hybrid NLP and graph-learning feature pipeline; adaptive neighbourhood sampling for robust inductive learning; and multi-head attention for interpretability in output. The framework consistently outperforms twelve state-of-the-art baselines concerning zero-day attacks (98.9% recall) and adversarial obfuscation (97.4% precision). When tested across three major ISPs, it was able to achieve an 83% reduction in false positives while processing more than 14,000 URLs per second on regular cloud infrastructure.