Priority-Coefficient Feature Fusion and Explainable Character-BiLSTM for Multi-Class Malicious URL Detection

Abstract

Malicious URLs remain a persistent attack vector for phishing, malware delivery and web defacement, but operational filters often reduce the problem to binary benign/malicious detection. This paper presents X-URL, a mathematically grounded explainable framework for multi-class malicious URL classification. The framework combines quantitative feature analysis (QFA), Shannon-entropy and information-gain-based priority coefficients, character-level bidirectional long short-term memory (BiLSTM), Bayesian hyperparameter optimization and SHAP-based explanation. The learning objective is formulated as weighted multi-class cross-entropy with class-imbalance coefficients, while priority feature fusion maps normalized lexical and structural indicators into an information-theoretic weighted vector. X-URL classifies URLs into benign, defacement, malware and phishing classes and produces analyst-readable reason codes. Experiments were conducted on 651,191 URLs using a stratified 80/20 split; the independent test set contained 130,236 samples. X-URL achieved 97.73% accuracy, 97.71% weighted precision, 97.73% weighted recall and 97.72% weighted F1-score. Additional analysis shows a macro F1-score of 96.68%, a balanced accuracy of 96.33%, and an approximate 95% confidence interval of 97.65-97.81% for test accuracy. Ablation results indicate that BiLSTM improves accuracy by 3.26 percentage points over vanilla LSTM, and QFA adds another 3.23 points with only 0.4 ms extra latency per URL. Algorithmic analysis shows that inference complexity is linear in URL length and quadratic in the BiLSTM hidden size, O(T H(H+d)+m), making X-URL suitable for high-throughput web filtering when combined with caching and slow-path enrichment..