A Hybrid Approach for Malicious URL Detection Using ML Classifiers and Graph Neural Networks

Cyber threats such as phishing attacks often exploit malicious URLs to deceive users and compromise sensitive information. Traditional feature-based machine learning methods, while effective, may struggle to capture the intricate relationships among URL components. In this research, a hybrid framework is proposed combining Graph Neural Networks (GNN) and Random Forest Classifier (RFC) to detect malicious URLs with high accuracy. The methodology applies extensive text preprocessing to tokenize URLs into subdomains, domains, and path elements. For graph-based learning, each URL is converted into a token graph where nodes represent URL components and edges capture relational structures. Simultaneously, handcrafted features such as URL length, HTTPS presence, and special character counts are extracted for RFC training. The GNN model learns structural dependencies through graph convolution operations, while the RFC model leverages decision tree ensembles for robust feature-based classification. Experiments on a large-scale Kaggle phishing URL dataset demonstrate that both models achieve excellent detection performance, with RFC slightly outperforming GNN in precision and speed. The hybrid framework provides a scalable and effective solution for real-time phishing detection, combining the strengths of structural graph analysis and traditional machine learning.