A Study on Malicious URL Classification Technology Using BERT-Based Hybrid Models

The proliferation of phishing and malicious URLs poses a serious threat to cybersecurity by exploiting social engineering techniques that deceive users. As these threats evolve rapidly and often evade traditional security mechanisms, more intelligent and adaptive detection methods are urgently needed. Traditional blacklist-based detection methods struggle to respond in real-time to newly generated URLs, while machine learning approaches often rely on manually engineered features and have limitations in capturing contextual patterns. In this study, we propose a hybrid malicious URL detection method that combines a BERT-based Transformer model with deep learning modules, leveraging a custom tokenizer specifically designed to reflect the structural characteristics of URLs. The proposed approach utilizes the contextual representation capability of the DeBERTa model and incorporates LSTM and CNN architectures to effectively learn both sequential and local features. By going beyond simple string-based analysis, our method enables comprehensive detection by capturing the hidden patterns and contextual information embedded in malicious URLs.