An explainable deep learning framework for multi-class malicious URL classification using priority-coefficient analysis

The increasing complexity of cyber-attacks requires URL classifiers that are both accurate and transparent. This paper presents X-URL, a pipeline-level framework for four-class URL classification (Benign, Defacement, Malware, and Phishing). A Quantitative Feature Analysis (QFA) branch computes URL length, digit density, special-character frequency, Shannon entropy, Information Gain, and a normalized Priority Coefficient using training data only. These QFA variables are used for independent statistical validation and class-specific interpretation; they are not concatenated with character embeddings and do not modify the neural loss. The predictive path receives only padded character sequences and uses a character-level Bidirectional Long Short-Term Memory (BiLSTM), class-frequency weighted cross-entropy, and Bayesian model selection based on validation macro-F1. SHAP DeepExplainer is applied post hoc to the fixed trained model and does not feed back into training or hyperparameter optimization. On the cleaned training partition, stratified 5-fold cross-validation yields 98.53 ± 0.03% accuracy for the optimized weighted BiLSTM, compared with 97.74 ± 0.20% for the raw BiLSTM, 98.16 ± 0.02% for BiLSTM–Random Forest, 97.93 ± 0.05% for BiLSTM–XGBoost, and 96.03 ± 0.08% for Char-CNN. A separate hold-out snapshot ( n = 130,236) yields 97.73% accuracy and 97.72% weighted F1. Because production throughput, temporal generalization, domain-disjoint performance, adversarial robustness, and expert validation were not evaluated, the results support further operational assessment rather than a claim of deployment readiness.