SiNMULI: Novel Signed Network Approach for Malicious URL Identification

SiNMULI: Novel Signed Network Approach for Malicious URL Identification AVIJIT GAYEN∗ , SAYAN MONDAL, and ANGSHUMAN JANA, Indian Institute of Information

arXiv:2608.19190v1 [cs.CR] 19 Aug 2026

Technology, Guwahati, India In today’s era of rapid advancements in artificial intelligence, computer security, and online safeguarding measures have undergone significant improvements. However, malicious websites continue to facilitate the spread of phishing schemes, fraudulent activities, and unsolicited communications. Conventional methodologies in machine learning, deep learning, and detection technologies for counterfeit websites predominantly depend on static data analysis, which frequently proves ineffective against the onslaught of malicious online entities. In response to these challenges, in this work, we propose a signed network-based approach for malicious URL identification(SiNMUlI). We introduce an innovative framework that conceptualises the identification of harmful URLs as a signed network-based binary classification problem that is strongly rooted in the fundamental principles of social network analysis and social balance theory. In this approach, a signed network is constructed based on the back-links, i.e., external hyperlinks of URLs, wherein each node symbolizes a URL and the hyperlinks function as signed edges. Utilising a balance-theoretic inference mechanism, our methodology propagates edge signs and classifies unlabeled domains by employing a 51% majority rule across incoming links. Experimental results on this real-world dataset demonstrate that SiNMULI achieves 99.89% accuracy, 99.62% precision, and 99.80% F1-score, which outperforms traditional ML and deep learning baseline models. Beyond high accuracy, SiNMULI offers interpretability, resilience against adversarial obfuscation, and independence from training data, making it a lightweight and scalable solution for real-world cyber defence. CCS Concepts: • Security and privacy → Human and societal aspects of security and privacy; • Human and societal aspects of security and privacy → Social aspects of security and privacy. Additional Key Words and Phrases: Cyber Security, Social Engineering, Signed Network, Status Theory, Social Balance Theory, Trust Inference, Network-based Security.

1

Introduction

The Internet has revolutionised how we connect, but it has also expanded the attack surface. Three features make it difficult to secure: (a) its distributed, heterogeneous design leaves no single authority to enforce uniform defences across domains [29]; (b) a non-unified security regime across Autonomous Systems means gaps at their boundaries can be exploited [1]; and (c) anonymous access lowers accountability for malicious actors [28]. Together, these conditions enable a wide range of attacks—malware, ransomware, phishing, adware, and malvertising—aimed at data theft, service disruption, and fraud. In practice, malicious URLs are a common entry point: they deliver payloads, redirect to fraudulent sites, or coax users into disclosing credentials. The scale of the problem is substantial. In Q2 2023 alone, reported phishing and other malicious incidents exceeded 1.2 million, with finance the most targeted sector (23.5%) [2]. In India, cybercrime cases rose by 11.8% in 2020, reaching 50,035 incidents, largely driven by fraud, extortion, and exploitation [22]. Data from 2020–2025 shows steady growth in both the number and the variety of attacks [31]. As Fig. 1a shows, confirmed breaches hit a record 12,195 in 2025, even though the overall incident count fluctuated. The mix of attack types has also shifted. Fig. 1b highlights System Intrusion (18.8%), Use of Stolen Credentials (18.0%), and Ransomware (17.3%) as the leading categories, with Social Engineering (12.8%) and Denial of Service (11.3%) still playing a major role. The continued prominence of credential theft and other human-focused attacks shows that users remain exposed even when technical defenses are in place. We also observe that different types of cyber attacks are concentrated ∗ Also with Techno India University, West Bengal, Kolkata, India

Authors’ Contact Information: Avijit Gayen, avijit.gayen@iitg.ac.in; Sayan Mondal, sayan.mondal@iiitg.ac.in; Angshuman Jana, angshuman@ iiitg.ac.in, Indian Institute of Information Technology, Guwahati, Guwahati, Assam, India.

2

•

Gayen et al.

Table 1. List of Symbols and Notations Used in SiNMULI Framework

Symbols 𝑈0 𝑢 𝑉 𝑉′ 𝑛 𝑛′ 𝐸 𝑒𝑢𝑣 𝑠 : 𝐸 → {+1, −1} 𝑠𝑢𝑣 𝐿int (𝑢) 𝐿ext (𝑢) 𝐸 𝑣+ 𝐸 𝑣− 𝑦𝑣 𝑇 𝑑 avg 𝑚 𝐿 𝑡 J 𝑁 − (𝑣) 𝑛 + (𝑣) 𝑛 − (𝑣) 𝑒? TriadsByEdge Majority TiePolicy

Description Seed set of input URLs from which crawling and hyperlink extraction begin. A specific URL under consideration during crawling or analysis. Set of nodes in the signed network graph, where each node represents a URL. Set of structurally valid URLs retained after filtering and preprocessing. Number of initial URLs in the dataset (𝑛 = |𝑈 0 |). Number of structurally valid URLs retained after cleaning (𝑛 ′ = |𝑉 ′ |). Set of directed edges in the signed network graph, where each edge represents a hyperlink between two URLs. Directed edge from URL 𝑢 to URL 𝑣. Sign function mapping each directed edge to either trust (+1) or distrust (−1). Sign of the directed edge from URL 𝑢 to website/URL 𝑣; +1 denotes trust, −1 denotes distrust. Set of internal hyperlinks extracted from 𝑢 that point to the same domain or subdomain. Set of external hyperlinks extracted from 𝑢 that point to different domains. Set of incoming positive (trust) edges to URL 𝑣. Set of incoming negative (distrust) edges to URL 𝑣. Final label assigned to URL 𝑣: +1 (legitimate) or −1 (malicious). Set of all triads (three-node subgraphs) in the signed network. Average node degree in the signed network. Average number of hyperlinks per page during crawling. Size (in characters or bytes) of the HTML page being parsed. Total number of triads present in the signed network. Filtered dataset Incoming neighbourhood of 𝑣: set of nodes 𝑢 with a directed edge (𝑢, 𝑣) ∈ 𝐸. Number of incoming positive edges to 𝑣, i.e., |{𝑢 ∈ 𝑁 − (𝑣) : 𝑠 (𝑢, 𝑣) = +1}|. Number of incoming negative edges to 𝑣, i.e., |{𝑢 ∈ 𝑁 − (𝑣) : 𝑠 (𝑢, 𝑣) = −1}|. Unlabeled Edge. Mapping from an edge to the list of triads that include it. Threshold for labeling via incoming signs (default 0.51). Policy choice when the majority condition is not met (abstain, malicious, benign).

in different geographical locations (as shown in Fig. 2). Ransomware is more common in North America and Western Europe, while credential abuse and denial-of-service attacks appear more frequently in Asia–Pacific and Latin America. Overall, the threat landscape is both growing and becoming more diverse, which calls for a mix of strong technical controls, user-focused measures, and region-specific policy responses. There exists a plethora of works related to malicious URL detection using existing White-blacklist method [14, 26], lexical or content-driven heuristics techniques [13], machine learning [24, 27], deep learning [18] methods.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

3

Extortion System Intrusion 160000

Incidents Breaches

140000

Exploit Vulnerability 6.8%

18.8%

120000

7.5%

Miscellaneous Errors

7.5%

Count

100000 80000

11.3%

18.0%

Use of Stolen Credentials

60000 40000

17.3%

Denial of Service

12.8%

20000 0

2020

2021

2022

Year

2023

2024

Social Engineering

2025

Ransomware

(a) Statistics of cyberattacks (incidents vs. confirmed breaches) between 2020–2025.

(b) Figure shows the top 8 cyberattack types in 2025 in a pie chart; major vectors are shown in proportional distribution.

Fig. 1. Figure shows the cyber attack statistics over a period of time(2020-2025) using a bar graph, and types of cyber attacks with their share are represented in a pie chart.

40

Ransomware Phishing Credential Theft Web App Attacks DoS

Relative Share / Index

35 30 25 20 15 10 5 0

USA

UK

man Ger

y

ada

Can

a

Indi

a

Chin

Country

ia

tral

Aus

Bra

zil

ce Fran

n

Japa

Fig. 2. Figure shows the distribution of the top five attack types across the ten most affected countries in 2025. Along the s-axis, we represent the countries, and along the y-axis, we represent the no. of incidents that occurred.

The hyperlink relationship among the URLs not only reveals the connectivities among the URLs that drive the network traffic flow among the URLs, but also reflects the intentions of creation of those hyperlinks. We find very few works [7, 8, 33] that address this issue of malicious URL detection using the hyperlink relationship among the URLs from the perspective of a complex network. Thus, this strong need drives us to develop such a framework, which can address the issue from a complex network perspective. In contrast to traditional ML or heuristic methods, our approach leverages a signed hyperlink-based network structure, where URLs are modelled as nodes and hyperlinks as directed signed edges. This network-centric view provides a relational perspective and enables structural analysis using social theories to classify URLs effectively. Traditionally, from the social theories perspective, a signed network is a graph where edges between the social

4

•

Gayen et al.

entities represent the nature of the relationships marked by either positive (+) or negative (-). In our context, we hypothesize that hyperlink relationships between URLs always have either a positive or a negative aspect, which reveals the intuition behind the back-link generation by the URL. We consider that where back-links originate from malicious URLs are encoded as (-) edges and the back-links emerge from the legitimate URLs represented as (+) [9]. Throughout this work, “URL”, “domain” and “website” are used interchangeably, as each node in the constructed signed network corresponds to a unique domain or subdomain. Multiple URLs belonging to the same host are aggregated under a single website node for structural analysis. In our earlier work [8], we have proposed a network representation of this hyperlink relationship among the URLs, which emerges as a complex network. In this network, we have identified three categories of node: a) Legitimate b) Malicious c) Unlabeled URLs. In this work, we propose a Malicious URL identification algorithm based on the well-known Balance theory [5]. The main objective of the proposed algorithm is to reveal the sign of the hyperlinks of many unlabeled URLs. Based on the labeling of the sign of the hyperlink, we further classify unlabeled URLs into malicious or legitimate. Building upon earlier works that focus on content-based or lexical URL features, we develop a signed network-based approach that exploits the underlying hyperlink structure among websites. This approach enriches contextual understanding and enables robust classification even for previously unseen or unlabeled domains. However, the underlying structure (semantics of the websites) can not be manipulated to a large extent by the attackers. To lead our investigation, we develop a series of research questions that describe the scope and objectives of this study. • RQ1: Can malicious URL identification be effectively modeled as a signed network classification problem, over the existing methods? • RQ2: How much the signed hyperlink network model is computationally improved model compared to existing models? • RQ3: To what extent can proposed directed balance theory improve inference of unknown URLs and enhance classification accuracy in signed hyperlink networks? These research issues serve as the cornerstone of our approach and drive the application of network-theoretic reasoning to malicious URL identification. In cybersecurity, the terms detection and identification are often mentioned in conjunction, yet they denote fundamentally different objectives. Detection refers to the act of recognising whether a given entity (e.g., a URL) exhibits malicious behaviour. It is a decision-making process, typically binary, that determines the presence or absence of a threat. Identification, by contrast, extends beyond the recognition of a threat to reveal its specific nature, origin, or role in a larger attack strategy. Identification often seeks to attribute the source of an attack, profile adversarial behaviour, or trace the campaign structure behind malicious activities. In our work, we specifically perform malicious URL identification. We analyse the behaviour of the malicious URLs in the proposed network to identify their distinct behaviour in the hyperlink network that has been discussed in detail in section 7. To construct the proposed network model, we crawled a benchmark dataset and extracted hyperlink structures, internal and external links, and page-level content. Further applying balance theory on the proposed signed hyperlink network, we inferred the sign of unlabeled edges of those back-links of the unknown URL and classified previously unlabeled URLs. Preliminary results reveal that malicious websites show lower centrality scores, fewer internal links, and sparse clustering coefficients compared to legitimate ones, supporting the feasibility of our network-based detection approach. Specifically, it achieves a classification accuracy of 99.89%, surpassing the best-performing baseline by a margin of 2.4%, while also recording a precision of 99.62% and F1-score of 99.80%, indicating superior reliability in both minimizing false positives and capturing true malicious instances. Although hyperlink structures have the ability to differentiate between malicious and legitimate websites, there were a number of significant obstacles in the data collection process. First, trustworthy crawling and data

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

5

extraction are hampered by the short operational lifespan of many malicious URLs and their use of evasive techniques like bot detection, CAPTCHA, or restricted access (e.g., HTTP 403/404 errors). As a result, many URLs were either unparsable or produced hyperlink structures that were insufficient. Second, it is challenging to create hyperlink structure because malicious websites’ dynamic and unstable nature frequently results in sparse or out-of-date linking behavior. Third, the automated extraction of internal and external web pages was made more difficult by user interaction dependencies on contemporary websites, such as login-gated content or links rendered by JavaScript. These restrictions limited the overall pool of usable domains and required strict filtering. However, it reaffirmed how crucial it is to use structural patterns rather than conventional content-based signals when identifying malicious URLs. The lack of hyperlink information in the benchmark data set necessitated custom web scraping and filtering in order to create a signed, meaningful network, which was a major challenge. Despite these limitations, our study contributes a new angle to malicious detection by: • We propose a novel approach to identifying malicious URLs that models websites and hyperlinks as a signed, directed network, leveraging social balance theory for structural inference. • We propose a directed balance model that can reliably classify unlabeled nodes without requiring large amounts of training data. • Experiments on big benchmark datasets show that the proposed model has almost perfect detection ability, and it also provides clear explanations, is strong against tricky hidden attacks, and can handle large amounts of data. This paper is organised as follows. Section 2 reviews prior work on malicious URL detection and discusses key limitations in existing approaches. Section 3 presents the theoretical background of our approach, with a focus on social balance theory in signed networks. Section 5 describes the proposed methodology, including data pre-processing, network construction, and the classification algorithm. Section 6 reports and analyses the experimental results, while Section 7 examines the behaviour and characteristics of malicious URLs in more detail. Finally, Section 8 concludes the paper and outlines directions for future research. To enhance the readability of the paper, we have defined all the notation and symbols in the table 1 at the very beginning of the paper.

2

Related Works

Research on malicious URL detection has gradually shifted from simple list-based checks to more complex, network-aware approaches. Below, we briefly outline this evolution in roughly chronological order and highlight representative work along the way. Early systems relied on blacklists and whitelists, where each URL was checked against collections of known malicious or trusted entries. Services such as Google Safe Browsing and PhishTank helped popularise this strategy by maintaining continuously updated feeds [14, 26]. These methods work well for previously reported threats and offer fast lookups, but they perform poorly at zero-hour [23]. Studies report low coverage at the time of attack, since many phishing campaigns evolve quickly or disappear within hours, often before list updates can propagate [4, 17]. To move beyond pure lookup, researchers examined what a URL looks like: length, token patterns, special characters, and suspicious keywords. McGrath and Gupta [21] documented characteristic differences between phishing and benign URLs, and Joshi et al. [13] showed that ensembles over static lexical features can be accurate without crawling or list queries. The catch is brittleness: simple obfuscation (URL shortening, token insertion, homoglyphs) can defeat fixed rules. Supervised and unsupervised learning broadened the feature space to include lexical, host-based, and sometimes content or DNS signals. Sahoo et al. [27] surveyed these techniques, and Ma et al. [20] demonstrated that learned models improve over blacklist baselines when given richer representations (see also [25]). However, classic ML pipelines still rely on feature engineering and can drift as attacker tactics evolve.

6

•

Gayen et al.

Deep models reduce manual feature design by learning representations directly from raw strings or tokens. URLNet [18] learns embeddings for end-to-end classification, and hybrid CNN–GRU architectures further capture local patterns and sequence dependencies [7]. Patgiri et al.’s “DeepBF” [24] combines learned Bloom filters with evolutionary training to speed filtering. Despite strong results, these models are data- and compute-hungry, and real-time deployment must contend with latency, label scarcity, and concept drift. Because attacks span domains, IPs, and infrastructure, graph formulations model relationships among web entities. Recent work applies GNNs to heterogeneous graphs to capture higher-order structure [33]; other work combines URL-level features with network-based signals and applies probabilistic inference methods, such as Loopy Belief Propagation, to achieve scalable detection [10]. Graph-based approaches provide a more holistic view of the ecosystem but introduce their own challenges, including large-scale graph construction, handling streaming updates, and coping with noisy or unreliable edges. Signed relations (trust/distrust) bring social-theoretic priors into play. Heider’s balance theory and status theory, later operationalised by Leskovec et al. [11, 19], explain regularities in signed triads and hierarchical structure; they underpin tasks like sign prediction [6], trust-aware recommendation [32], and link recovery in noisy graphs [16], with validation on platforms such as Epinions and Slashdot [19]. For security, Kim et al. [15] analyse behavioural patterns over networks to resist common evasions, and Kou et al. [16] model missing links under privacy constraints. This body of work motivates trust-aware, signed-graph formulations for malicious URL detection, where balance/status cues help propagate credible signals through the web of entities. While recent work has applied graph learning to domain reputation and bot detection, applications of signed social theories to adversarial environments such as phishing remain sparse [30]. Existing approaches to malicious URL detection largely rely on blacklists, content-based ML models, or deep neural networks [15, 18, 24]. These methods, while powerful, often require labeled datasets and suffer from poor interpretability and robustness to obfuscation. Despite interpretability and success in modeling social relationships, signed networks remain underutilized in cybersecurity contexts. Thus, there is a strong requirement to explore the role of signed relationships among the URLs in malicious URLs. In this work, we propose a framework, SiNMULI (Signed Network-based Malicious URL Identification), that introduces a lightweight and interpretable alternative for malicious URL detection.

3

Background

This section provides the theoretical foundations required for our proposed framework. We first motivate the need for a network-theoretic perspective in malicious URL detection, then introduce two cornerstone concepts from signed network analysis: Balance Theory and Status Theory. These theories, originally developed for social networks, provide useful tools for modelling relational structure and inferring patterns of trust and distrust. While many existing URL detection methods focus on isolated features of individual URLs, we argue that incorporating these relational perspectives yields more robust and interpretable detection. This motivation arises from clear limitations in current approaches. Lexical, content-based, and standard machine learning methods typically treat each URL independently and overlook the underlying web of relations. In practice, websites form a complex system of interlinked entities. Hyperlinks encode implicit judgments: some links signal endorsement or trust, whereas others are adversarial or manipulative, crafted to mislead users or to mask malicious intent. Capturing these nuanced relationships requires theories that can systematically model and infer the structural consistency of trust–distrust dynamics. Balance Theory and Status Theory provide precisely such mechanisms, making them highly relevant for malicious URL identification. Importantly, this section only outlines their classical formulations; our proposed modified version of the balance theory in the context of malicious URL identification from the directed hyperlink network will be discussed in Section 4.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

7

In the next, we discuss in detail the two major social theories, i.e., a) Social Balance theory and b) Social Status theory. We outline the social theories as well as point out the rationale behind the adaptation of the social theory in the context of malicious URL identification.

3.1

Balance Theory

The balance theory, introduced by Heider (1946) and extended by Cartwright and Harary (1956), asserts that social networks evolve toward a balanced state, where triads of relationships conform to certain stability rules. In a signed network, a triad is defined as a set of three nodes connected by signed edges representing positive (+1, trust) or negative (−1, distrust) relationships. A triad (𝑖, 𝑗, 𝑘) is considered balanced if the product of its edge signs satisfies: 𝑠𝑖 𝑗 · 𝑠 𝑗𝑘 · 𝑠𝑘𝑖 > 0

(1)

where 𝑠𝑥 𝑦 ∈ {+1, −1} is the sign of the directed edge from node 𝑥 to node 𝑦. From a structural perspective, two configurations of triad yield balance: (1) Mutual trust: All three edges are positive (+, +, +). (2) Common adversary: Exactly one edge is positive and the other two are negative (+, −, −), indicating that two mutually distrustful nodes share a common enemy. In the balancing of the triad, there exist two main interpretations of balance in the literature: • Strong Balance (Cartwright–Harary) A triad is balanced only if it contains an even number of negative edges (0 or 2) (as shown in fig. 3a, 3b and 3c). Under this definition, a triad with all negative edges (−, −, −) is considered unbalanced, as it represents universal mutual distrust, which is structurally unstable. • Weak Balance (Davis) A triad is balanced if it contains no more than one positive edge. This broader definition permits (−, −, −) as balanced, modeling scenarios where mutual distrust can be stable, such as isolated hostile cliques (as shown in fig. 3d). In the area of detecting harmful actions, balance theory offers a clear way to figure out missing signs on connections by making sure the relationships between three connected items are consistent. If a group of three items has one or more connections with unknown signs, the missing signs can be guessed in a way that keeps the whole setup balanced. This method is especially helpful in networks where links have some known labels and others are not, since it helps determine whether a website is bad or safe when that information isn’t already known.

3.2

Status Theory

Status theory, introduced by Leskovec, Huttenlocher, and Kleinberg (2010 [19]), offers an alternative view that is well suited to directed signed networks. It assumes that trust (or esteem) is organised hierarchically: a positive edge from node 𝐴 to node 𝐵 means that 𝐴 assigns a higher status to 𝐵, while a negative edge indicates that 𝐴 views 𝐵 as lower in status. This framework stands strongly on the following principles— • A positive directed edge from node 𝐴 to node 𝐵 indicates that 𝐴 views 𝐵 as having higher status. • A negative directed edge from 𝐴 to 𝐵 indicates that 𝐴 perceives 𝐵 as having lower status. This approach captures asymmetrical relationships, making it well-suited for analysing online trust systems, reputation networks, or authority-based ranking structures. In hierarchical trust propagation, the aim is to position nodes along a latent “status axis” so that the direction and sign of edges align with these inferred rankings, as shown in figure 4. In the context of malicious URL identification, if a legitimate website frequently links positively to another site, it can be interpreted as elevating that site’s credibility. Conversely, a negative link

8

•

Gayen et al.

(a) Balanced: Strong Balanced

(+, +, +)

(b) Balanced: Strong Balanced

(+, −, −)

(c) Unbalanced: (+, +, −) Strong Unbalanced

(d) All negative: (−, −, −) Weak Balanced

Fig. 3. Figure represents the possible triads in Balance-theory. The solid green undirected edges denote trust (+), whereas red dashed undirected edges denote distrust (−). Two triads are balanced under both strong and weak definitions a, b. Triad c is unbalanced under both. Triad d is unbalanced under strong balance (Cartwright–Harary) but balanced under weak balance (Davis).

A

A

B

A

B

B

C

C

C

Case 1

Case 2

Case 3

Fig. 4. The figure represents a few cases of directed signed triads as per the status theory. The Green solid arrows denote positive (+) ties, while red dashed arrows denote negative (−) ties.

(e.g., a blacklist reference) indicates a lower perceived status. Thus, the intuition behind the back-link creation could be modelled well in the persuasion of status theory, which might be helpful in malicious URL identification.

4

Proposed Balance Theory to Identify Malicious URL

In the context of malicious URL detection, we use balance theory as a structural inference tool because it captures the inherent tendency of networks to evolve towards stable configurations of trust and distrust. Balance theory claims that social networks tend towards balanced states, where the relationships in a triangle obey certain stability rules. This property is particularly relevant for malicious behavior detection, as signed network structures can be used to infer missing edge labels and detect unusual patterns. However, classical balance theory[12] was formulated for undirected social graphs, assuming that all relationships are symmetric. In malicious URL networks, this assumption breaks down. Two key observations motivate our modified model of malicious URL detection, which adapts classical equilibrium ideas within a status-theoretic view: (A) Malicious URLs frequently create deliberate, asymmetric outbound links to benign domains, for example, to blend in, borrow legitimacy, or load external resources. Benign domains, in contrast, rarely link back to such malicious sites, so the resulting pattern is strongly one-sided. (B) The connections in our network are not all equivalent: edge direction encodes intent and influence, which is crucial in adversarial settings. Status theory offers a related viewpoint by imposing a hierarchical ordering on nodes in signed networks. However, classical status theory is defined for undirected graphs and does not

SiNMULI: Novel Signed Network Approach for Malicious URL Identification Classical Undirected Balance

Modified Directed Balance

A

Mal.

B

C

Balanced: (+, +, +)

Ben.

•

9

Ben.

Balanced: (−, +, −)

Fig. 5. Figure represents the comparison of the classical undirected balance triad(left) and the proposed modified directed balance triad(right) for malicious URL detection. In the modified directed balance triad, green solid arrows denote trust (+) and red dashed arrows denote distrust (−).

naturally handle asymmetric, intent-driven edges. As a result, it cannot be directly applied to our malicious URL detection task, which is based on directed hyperlink relationships. To address these limitations, we introduce a Directed Balance Theory that combines ideas from both equilibrium and state theory, specifically designed for directed signed graphs. Our approach keeps the structural stability rules from equilibrium theory and includes a direction-based understanding of trust and distrust, as suggested by state theory. This hybrid approach allows us to model asymmetric, malicious-to-benign and benign-to-malicious relationships accurately, enabling inference in partially labeled graphs and supporting more robust malicious URL classification.

4.1

Proposed Directed Balance Theory

Let 𝐺 = (𝑉 , 𝐸, 𝑆) be a directed signed graph, where 𝑉 is the set of nodes (URLs or websites), 𝐸 ⊆ 𝑉 × 𝑉 is the set of directed edges, and 𝑆 : 𝐸 → {+1, −1} assigns each directed edge a sign representing trust (+1) or distrust (−1). A directed triad (𝑢, 𝑣, 𝑤) consists of three distinct nodes connected by directed edges 𝑒𝑢𝑣 , 𝑒 𝑣𝑤 , and 𝑒 𝑤𝑢 . In a directed signed hyperlink network, we propose two basic hypotheses to integrate the directional asymmetry as well as the sign of the edge based on the intuition behind the development of that hyperlink— • 𝑆𝑥 𝑦 ≠ 𝑆 𝑦𝑥 • 𝑆𝑥 𝑦 is (+1), if 𝑥 is a benign URL, otherwise (−1) , if 𝑥 is malicious. In figure 5, we compare the existing balance theory and our proposed directed balance theory in the context of a signed hyperlink network. We further integrate the strong and weak balance theory in our proposed directed balance theory to be used for identifying malicious URLs. In our work, we consider that we have a large set of unknown URLs to classify them into either the malicious or the benign category. Thus, we consider that there exist three categories of nodes in the network, i.e., malicious, benign, and unlabeled. The edges originate from unlabeled URLs; we consider their signs to be unknown. Based on the proposed directed balance theory, we could infer them. We apply both strong balance possibilities as well as weak balance for inference. We demonstrate all possible triad balances in our proposed model in Figure 6. In the triadic relationship exploration in the proposed model, we have restricted at most one unlabeled node with exactly one unlabeled edge in a triad. This formation would help us further infer the sign of the unlabeled edge using the proposed directed balance theory. The proposed directed balance theory integrates Structural stability from balance theory. We consider the strong as well as weak balance theory in our proposed model. We also incorporate the directional asymmetry from status theory. By merging these concepts, the proposed Modified Directed Balance Theory extends balance theory to directed systems, enabling reliable inference of missing signs and robust classification of malicious URLs in adversarial, asymmetrical network environments. Let 𝐺 = (𝑉 , 𝐸, 𝑠) be a directed signed graph, where 𝑉 is the set of nodes (websites), 𝐸 ⊆ 𝑉 × 𝑉 is the set of directed edges (hyperlinks), and 𝑠 : 𝐸 → {−1, 0, +1} assigns a sign to each edge. A positive sign 𝑠 (𝑖, 𝑗) = +1

10

•

Gayen et al.

−

−

−

−

+

+

+ +

(a) Case I: Initial

(b) Case I: Weak

+

+

(c) Case I: Strong

+

−

+

+

+

+

(d) Case II: Initial

(e) Case II: Weak

(f ) Case II: Strong

−

−

(g) Case III: Initial

−

−

−

−

+

(h) Case III: Weak

(i) Case III: Strong

+

+

−

−

+

+

+

+

+

(j) Case IV: Initial

(k) Case IV: Weak

(l) Case IV: Strong

−

−

−

−

+

−

−

−

(m) Case V: Initial

(n) Case V: Weak

(o) Case V: Strong

+

−

+

+

+

+

+

+

(p) Case VI: Initial

(q) Case VI: Weak

(r) Case VI: Strong

−

−

−

−

+

−

−

−

(s) Case VII: Initial

(t) Case VII: Weak

(u) Case VII: Strong

1

Fig. 6. Figure shows the triad taxonomy across seven possible cases (I–VII). It shows the possible triad evolution under the proposed directed balance theory for malicious URL detection. Blue nodes in the triad represent the benign URL, whereas red nodes are considered to be malicious. We colored the unlabeled URL as grey, and the edges originating from those corresponding nodes have similar colors. Each row illustrates one of the seven canonical triad cases. The Initial column shows a partially signed triad. The Weak balance is shown in the second column, and the third column shows the possible strong balance.

denotes a trustful or benign relationship from 𝑖 to 𝑗, while 𝑠 (𝑖, 𝑗) = −1 indicates a distrustful or malicious tendency. Unknown or inferred edges are denoted by 𝑠 (𝑖, 𝑗) = 0. Each node 𝑣 ∈ 𝑉 is associated with a class label 𝑦 𝑣 ∈ {benign, malicious, unknown}. We use the incoming neighbourhood of 𝑣, N − (𝑣) = {𝑢 ∈ 𝑉 : (𝑢, 𝑣) ∈ 𝐸}, to infer its label from edge signs.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

11

Majority (51%) rule. Let 𝑛 + (𝑣) = |{𝑢 ∈ N − (𝑣) : 𝑠 (𝑢, 𝑣) = +1}| , −

𝑛 − (𝑣) = |{𝑢 ∈ N (𝑣) : 𝑠 (𝑢, 𝑣) = −1}| .

(2) (3)

We assign a label to 𝑣 as  benign     𝑦 𝑣 = malicious    unknown 

𝑛 + (𝑣) > 0.51, if 𝑛+ (𝑣)+𝑛 − (𝑣) 𝑛 − (𝑣) if 𝑛+ (𝑣)+𝑛 − (𝑣) > 0.51, otherwise.

Balance-based edge inference. For a triad (𝑖, 𝑗, 𝑘) with directed edges (𝑖, 𝑗), ( 𝑗, 𝑘), (𝑖, 𝑘), we denote the known signs by 𝑠 (𝑖, 𝑗) and 𝑠 ( 𝑗, 𝑘) and infer the unknown sign 𝑠 (𝑖, 𝑘) by imposing a strong-balance constraint 𝑠 (𝑖, 𝑗) · 𝑠 ( 𝑗, 𝑘) · 𝑠 (𝑖, 𝑘) = +1, Whenever two edge signs are known. If this constraint conflicts with existing node labels, we fall back to a weak-balance variant where only the product of signs on simple cycles is constrained to be non-negative.

5

Proposed Method

In this section, we describe the proposed method of the malicious URL identification framework. Initially, we describe the benchmark dataset used as a seed dataset for further crawling to figure out the hyperlink relationship among them in our work. We analyze the dataset before crawling the URLs from their backlinks to find new URLs that are unlabeled. Further, we propose a data collection technique based on the benchmark seed dataset to build the hyperlink connection among the URLs. We also provide an analysis of the collected dataset to gain insight into the data before forming the signed network. Afterward, we formed the signed hyperlink network based on the collected dataset. We finally propose our signed network-based malicious URL identification algorithm. The proposed SiNMULI framework employs a structured pipeline for malicious website detection based on signed network analysis as described in the given schematic diagram in figure 7. Beginning with a benchmark dataset, the system first extracts both internal and external URLs, where each unique domain or subdomain is represented as a distinct URL stored further for hyperlink signed network formation. From the developed signed network, we identify the triadic relationship among the URLs and filter to form the fundamental units for structural analysis. Leveraging our proposed directed balance theory, the algorithm infers missing edge signs to maintain structural consistency across triads. Subsequently, the label of the unknown URLs is determined using the 51% majority rule, wherein a node is labeled according to the predominant sign of its incident edges. This integrated inference and classification process enables reliable categorization of an unlabeled URL as benign or malicious. In the final stage, classification results are aggregated to produce actionable outputs for downstream security analysis and threat mitigation.

5.1

Seed Dataset

In our work, we have used a labeled benchmark dataset for collecting the hyperlink relation among the URLs. We employ the publicly available Phishing Websites Dataset [3] (Ariyadasa et al.) as a seed dataset. It is a large-scale corpus of legitimate and phishing webpages. The rationale behind the selection of this benchmark dataset as a seed is its large chunk of data points, as well as being labeled either as legitimate or phishing. The dataset is also very lightweight due to the minimal information regarding each URL compared to other existing benchmark datasets. Legitimate pages were sourced from two primary channels: (i) the top 5 results of keyword-based Google searches with domain diversity constraints (maximum of 10 URLs per domain), and (ii) the Ebbu2017 dataset, contributing approximately 25,874 active legitimate URLs. Phishing pages were obtained from three well-established

12

•

Gayen et al.

Fig. 7. The figure represents the schematic diagram of the proposed SiNMULI workflow for the identification of malicious URLs using a signed network approach. Table 2. Seed dataset summary and working 3-class distribution in the seed index (a) Seed dataset summary

Metric Source benchmark

Value Phishing Websites Dataset (Ariyadasa et al.) Raw URLs (before cleaning) 83,275 Retained URLs (after cleaning) 80,000 Label mapping (working index) +1 legitimate, −1 malicious, 0 unknown Exact duplicates removed 121 Columns (schema) URL (string), Label (int), source (string) Storage format CSV (UTF-8), one URL per row

(b) Working 3-class distribution in the seed index

Class Legitimate (+1) Malicious (−1) Unknown (0) Total

Count Percent 45,000 56.25% 30,000 37.50% 5,000 6.25% 80,000 100%

threat intelligence repositories: PhishTank (December 2020 – October 2021), OpenPhish (September – October 2021), and PhishRepo (September – October 2021). Automated scripts continuously monitored these feeds to capture live phishing pages, ensuring minimal loss due to the ephemeral nature of such pages. 5.1.1 Summary of Seed dataset. Table 2a reports the core properties of the seed. For transparency, we also report the class distribution of the working three-class index (used for all downstream analyses and ablations) in table 2b. Percentages are with respect to the 80,000 retained rows. Usage downstream. The seed is not the signed graph itself; it is the anchor list for systematic crawling and hyperlink extraction. After crawling, we canonicalize hosts, type internal/external links, and construct a directed signed network (nodes = sites/domains; edges = hyperlinks with trust/distrust semantics). Missing edge signs are inferred via balance-theoretic constraints on triads, and unlabeled nodes are resolved using a simple majority rule on incident edge signs. The resolved labels feed the subsequent evaluation and analysis.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

5.2

•

13

Dataset Description

The dataset used in this study, mysql_index_dataset.csv, is the starting point for building the signed hyperlink network analysed in the SiNMULI framework. It contains indexed web domains labelled as legitimate (B), malicious (M), or unknown/unlabeled (U). Each row represents a single website (domain) and records what we learned from large-scale crawls: basic host information and the outgoing links it makes to other sites. The resulting directed graph has 48,205 nodes and 384,592 edges, with a directed density of about 1.655 × 10−4 , so it is large but very sparse. Most nodes are already labelled—46,415 benign (B) and 1,790 malicious (M)—while the remaining unlabeled nodes are used for semi-supervised learning and triad-based balance checks. The graph naturally splits into 362 communities; the largest contains roughly 19,062 nodes (18,453 B and 609 M), showing that large benign clusters and smaller adversarial pockets coexist in the same network. We also identify 2,236 articulation points and 4,566 bridge edges, whose removal would disconnect parts of the graph. These weak points are important for understanding both network resilience and how signals propagate during inference. From a research perspective, this dataset captures the inherent properties of a real-world signed network where trust and hostility co-evolve. The high occurrence of legitimate nodes indicates a trust-dominated structure, while the dense existence of malicious edges brings about polarity and weak balance conditions within communities. The articulation points and bridges indicate regions sensitive to topological disruption, making them ideal for studying propagation decay, infiltration, and defensive graph rewiring strategies. Overall, this dataset supports multi-level analyses — from local triadic inference to global polarity stability — and provides a robust empirical foundation for validating the SiNMULI approach in cybersecurity-aware signed graph learning.

5.3

Data Collection

In this section, we describe the data collection process based on the benchmark seed dataset. We describe the web crawling from the seed dataset and further filtering and preprocessing of the crawled URLs for the development of a signed hyperlink network. We also propose a method for data collection in a formal way, using an algorithmic approach, and further analyze this algorithm to reveal the computational complexity. This formal presentation of the algorithm helps in the reproducibility of the dataset1 . The proposed algorithm has mainly three segments of task: a) Web scraping, b) Cleaning & Preprocessing, c) Output preparation. In the subsequent section, we describe the phases in detail, one after another. 5.3.1 Web scraping. In this step, we perform a one-hop crawl of external hyperlinks discovered during the scraping process. Specifically, every external link appearing on the seed pages was treated as a new candidate URL. Each of these external URLs was then fetched once, and their content and metadata were collected in the same manner as the seed dataset. This one-hop strategy lets us capture broader connections in the malicious ecosystem while keeping the dataset size manageable. The added external links brought in more malicious and legitimate pages and, at the same time, exposed useful structural and relational patterns between sites. Web scraping also comes with practical constraints, and we design around them. To reduce the chance of being blocked, we throttle requests, randomise intervals, and back off when error rates rise. When pages depend on JavaScript, we first try to use server-rendered HTML and switch to a headless browser only when needed. CAPTCHAs and strict bot checks are respected: if they appear, we stop collection rather than attempt to bypass them. Because real-world markup is often messy, our parser is fault-tolerant and can fall back to alternative strategies. To cut down link noise, we normalise and de-duplicate URLs, follow redirects, and store both the requested and final targets. To limit seed bias, we draw from multiple feeds and periodically review samples to maintain data quality. 1 All code and dataset used in this study—including data loaders, training scripts, pre-trained checkpoints, and the code that generates every

figure and table in this manuscript for analysis/visualization pipelines—is openly available at: https://github.com/sayanmondal2098/SinMuli

14

•

Gayen et al.

5.3.2 Data Cleaning & Preprocessing. The structure and density of the final signed network depend directly on how the data is cleaned and preprocessed. By removing structurally weak nodes, we increase the number of triads, reduce sparsity, and improve the reliability of downstream algorithms such as malicious URL classification and sign inference. The cleaning stage ensures that: (a) sparse or dangling nodes are removed; (b) dense, triad-rich subgraphs needed for balance-theoretic reasoning are preserved; and (c) classification of malicious URLs becomes more stable and accurate. To keep the constructed signed network structurally sound and analytically consistent, we apply a multi-stage cleaning procedure as described below.

Structural Validation of URLs. Before building the signed network, we first check whether each URL has meaningful hyperlink connections. In particular, we verify the presence of at least one internal or external link, which is required for triadic inference. URLs without such links are discarded to maintain a well-connected and informative graph. URLs that don’t have these links are removed to keep the structure strong and accurate. Let 𝑢 ∈ 𝑈 0 denote a URL from the seed dataset. A URL 𝑢 is retained only if: |𝐿int (𝑢)| + |𝐿ext (𝑢)| > 0, where 𝐿int (𝑢) and 𝐿ext (𝑢) denote the sets of internal and external hyperlinks, respectively.

Noise Reduction. Real-world web data often contains noise in the form of broken links, unreachable pages, or malformed content. In this stage, we remove such problematic entries so that weakly connected or fragmented components do not distort the analysis. This produces a cleaner, more coherent graph and improves the reliability of subsequent network-based inference.

Output Graph Consistency. To create a clear and easy-to-analyse signed network, we only finalise the nodes and connections after checking and cleaning the data: we standardise the hosts and combine all URLs from the same host into one node, remove broken or self-linking, JavaScript-based, tracking, and duplicate links, and fix any redirect issues. Each remaining hyperlink is typed as internal (same host) or external (different host) and assigned a sign that preserves trust/distrust semantics: +1 for edges originating from labeled legitimate sources and −1 for edges originating from labeled malicious sources; edges from unlabeled sources are retained but left unsigned.

5.3.3 Output preparation. After the data cleaning and preprocessing of the collected data, we only keep those meaningful URLs in the final dataset, which can further contribute to our signed hyperlink network formation. In this process, many URLs lack meaningful structural data, and we filter out pages without usable hyperlink structure or those returning inaccessible content (e.g., 403/404). Thus, only structurally valid URLs are kept in our final dataset to participate in network formation that improves connectivity and reliability. Further, remaining URLs and links are consolidated into a compact JSON artefact, preserving node features for signed-network construction and classification. We formally describe our proposed algorithm 1 for data collection, and afterwards we critically analyze the data collection algorithm to understand the computational complexity.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

15

Algorithm 1: Data Collection based on Benchmark dataset Input: Seed URL list U0 Output: Filtered dataset J for signed network analysis 1 𝑉 ← U0 ; ; // Initialize node set from URLs 2 𝐸 ← ∅; ; // Initialize edge set for hyperlink structure 3 foreach 𝑢 ∈ 𝑉 do 4 𝑐 (𝑢) ← Download and parse HTML content; 5 𝐿int (𝑢) ← Extract internal links; 6 𝐿ext (𝑢) ← Extract external links; 7 if |𝐿int (𝑢)| = 0 and |𝐿ext (𝑢)| = 0 then 8 Remove 𝑢 from 𝑉 ; ; // No network structure: discard 9 continue; 10 11 12 13 14 15

𝑠 (𝑢) ← Check SSL status (HTTPS or HTTP); 𝑟 (𝑢) ← Query reputation service (e.g., SafeBrowsing, optional); 𝐽 (𝑢) ← {𝐿int (𝑢), 𝐿ext (𝑢), 𝑠 (𝑢), 𝑟 (𝑢)}; Add 𝐿int (𝑢) ∪ 𝐿ext (𝑢) to 𝐸; J ← {𝐽 (𝑢) ∀𝑢 ∈ 𝑉 }; return J for downstream signed network analysis;

Analysis of Proposed Data collection Algorithm: This section reveals the computation complexity of the proposed data collection algorithm. To analyze the proposed data collection algorithm, we have systematically segregated the tasks performed in the algorithm and individually computed the complexity of each segment of the task. Web Scraping. To build the hyperlink graph for network modelling, we first scrape and parse the HTML for each URL in the seed set. This step records internal/external links, SSL status, and basic metadata, producing a structurally rich view of each site. Pages are processed independently for scalability. For each 𝑢 ∈ U0 : • HTML parsing runs in O (𝐿), where 𝐿 is the page size. • Anchor scanning (internal/external link extraction) is O (𝐿) with post-processing/storage O (𝑚), where 𝑚 is the number of discovered hyperlinks. Let 𝑛 = |U0 | and 𝑚 denote the average hyperlinks per page. The total time for scraping and link parsing is
O 𝑛 (𝐿 + 𝑚) . Filtering and URL Extraction. Many URLs contribute little structural signal. We therefore drop pages with no link structure or inaccessible content (e.g., 403/404). This improves graph connectivity and downstream reliability. Per-URL costs are: • SSL status check: O (1). • Optional reputation lookup (cached/parallelised): O (1) amortised. • Parsing and storing hyperlink features: O (𝑚). • Feature extraction per valid URL: O (𝑚).

16

•

Gayen et al.

Output Preparation. After filtering, we consolidate valid pages 𝑉 ′ ⊆ 𝑉 into a structured JSON suitable for signed-graph construction, preserving node-level features: |𝑉 ′ | ≤ 𝑛,

total output space O (𝑛 ′𝑚), where 𝑛 ′ = |𝑉 ′ |.
Overall Complexity. The collection and parsing stage costs O 𝑛 (𝐿 + 𝑚) time—covering seed URL scraping and a single hop over discovered out-links—while writing the curated JSON uses O (𝑛 ′𝑚) space. In practice, the pipeline parallelises naturally over seeds: independent asynchronous crawlers enforce per-domain rate limits, cache redirects/reputation results, invoke headless rendering only when needed, and aggressively prune non-structural pages to shrink |𝐸|, reducing compute and I/O overhead.

5.4

Summary of Collected Dataset

In this section, we analyze the collected dataset and find the insights of the dataset that strengthen our understanding of the data, which helps us to develop the signed hyperlink network further. From our parsed dataset, we identified a total of 261,113 URLs. Among them, 79,759 URLs are labeled using the provided ground truth, comprising 49,868 legitimate URLs and 29,891 malicious URLs. The remaining 181,354 URLs are unlabeled, typically discovered as external links or indirect connections during HTML parsing. In total, 684,114 directed hyperlinks were extracted from the hyperlink structure, forming the backbone of the directed graph. Notably, 685,552 of these are external edges, where the destination lies outside the original labeled dataset. These external connections are crucial in modeling real-world web browsing behavior, where benign and malicious pages often link to or are linked from external domains.

5.5

Network Formation

In this section, we describe the formation of a signed hyperlink network. We describe the systematic formation of a network. Further, we analyze the network to understand the distinct behavior of the malicious URLs from legitimate URLs. We represent the URLs as nodes, and the hyperlinks among them have been represented as edges among the nodes. In general, the URLs in the cyber world can be categorized into two basic types: a) main Website URL, b) subdomain URL. Thus, the hyperlinks formed between the URLs have also been classified as an internal edge: It connects between the main website URL and the subdomain URL. b) external edge: It connects different main website URLs. As the subdomains belong to the main website, we can simply consider the internal edges as a self-loop, which represents the existence of internal edges among the main website and its subdomains. However, in our proposed work, as the back-links play a major role at the time of network formation, we have considered all subdomain URLs of a main URL as a single node representation. The composition of multiple URLs of the same domain as a single node does not lose the role of a hyperlink network in our proposed model. To better understand the hyperlink structure of benign and malicious websites, we visualize the signed network by a schematic diagram as shown in Figure 8. In this schematic diagram, nodes represent domains, while directed edges indicate external hyperlinks among themselves. In our network, we have specifically three different kinds of nodes, i.e., a)malicious, b)benign, and c)unlabeled. The signs on the edges in the network are marked as indicated in the collected dataset. We have kept the back-links originating from malicious nodes as (−1) and (+1) for the edges originating from benign nodes. However, the edges from the unlabeled nodes are left unsigned at the initial phase of network formation. Network Analysis: Our seed is a list of URLs (80,000 rows), while the interaction network is constructed over domains/hosts that actually participate in hyperlink interactions during crawling. The reduction arises from: (i) URL→domain canonicalization (many URLs collapse to a single host node), (ii) removal of degree-0 nodes (no observed links), (iii) scope/media constraints (robots, login gates, non-HTML, HTTP errors), (iv) deduplication of repeated URL and

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

Benign Sites

Malicious Sites

•

17

Unknown Sites

J B D

E

A

C H

F

I G Fig. 8. Signed hyperlink network structure showing legitimate (blue) and phishing (red) sites and the unlabeled URLs(grey). The color of the edges corresponds to the color of the originating node.

URL+hop rows, and (v) partial label coverage (only hosts overlapping the seed can be label-stratified). Together, these steps yield a directed graph with markedly fewer nodes than the raw URL count. We summarize the detailed network analysis in table 3. We analyzed a directed interaction graph with Í 𝑁 = 48,205 nodes and an estimated 𝐸 = 384,592 edges (computed as outdeg). The network is sparse, with 𝐸 −4 density 𝜌 = 𝑁 (𝑁 −1) ≈ 1.66 × 10 . Degree statistics indicate skew: the mean out-degree is 7.98 while the median is 5; the median in-degree is 1. Community detection yields 362 modules; the largest comprises 19,062 nodes, of which 96.8% are labeled benign (B) and 3.2% malicious (M). Structural vulnerability is non-trivial: we identify 2,236 articulation points and 4,566 bridge edges, implying single-edge/node failure can disconnect portions of the graph. Labels are imbalanced overall (B = 46,415, 96.29%; M = 1,790, 3.71%). Label-stratified centrality shows systematic separation between benign and malicious nodes. Benign nodes occupy more central and connective positions: median out-degree 5 (vs. 2 for M) and median in-degree 1 (vs. 0 for M). Eigenvector centrality, which captures recursive influence, is higher for benign nodes (𝑒˜𝐵 = 2.538 × 10−3 vs. 𝑒˜𝑀 = 1.336×10−4 ). PageRank medians are close in magnitude but still lower for malicious nodes (𝑝˜ 𝐵 = 4.435×10−6 vs. 𝑝˜ 𝑀 = 3.720 × 10−6 ). Median betweenness centrality is 0 for both labels, consistent with a sparse, modular graph in which most vertices do not lie on many shortest paths. Taken together, these observations suggest malicious actors tend to be peripheral and poorly embedded within dominant communication backbones.

18

•

Gayen et al.

Table 3. Macro-level structural summary and label-stratified node centrality statistics of the signed network.

(a) Macro (graph-level) summary Property Value 48,205 legit.(46,415) Nodes (𝑁 ) Mal.(1,790) Directed edges (𝐸) 384,592 1.655 × 10−4 Density 𝜌 = 𝑁 (𝑁𝐸 −1) Communities (count) 362 19,062 legit.(18,453) Largest community (nodes) Mal.(609) 96.8% Legitimate Largest community label mix 3.2% Malicious Articulation points 2,236 Bridge edges 4,566

5.6

(b) Label-stratified node centrality (medians) Centrality Legit. Mal. Gen. Out-degree 5 2 5 In-degree 1 0 1 Eigenvector 𝑒˜ 2.54 × 1.34 × 2.50 × 10−3 10−4 10−3 PageRank 𝑝˜ 4.44 × 3.72 × 4.37 × 10−6 10−6 10−6 Betweenness 𝐶˜𝐵 4.90 × 1.62 × 0.00 10−8 10−11 Closeness 𝐶˜𝐻 100308.3 82798.1 78266.5 Clustering 𝐶˜ 0.2909 0.3000 0.2693

Proposed Malicious URL detection Algorithm: SiNMULI

In this section, we formally propose the signed hyperlink network-based malicious URL identification algorithm, SiNMULI. Our proposed algorithm is based on balancing the triadic relationships in the signed hyperlink network. In this algorithm, we have three distinct parts: a) Triad identification, b) Sign determination of unlabeled edges in the triad, c) Node labeling using majority voting. Triad Identification. Initially, we extract all 3-node subgraphs (triads) 𝑇 ⊆ 𝑉 3 from the signed network. This triadic relationship plays a vital role in further identification of the nature of unlabeled nodes. We specifically keep only those triads for our further observation for balancing, which contain one and only one unlabeled node with an unlabeled edge. Other kinds of triads are filtered out from our study. The objective of this filtering is to keep only those triads where unlabeled URLs have only one back-link in that concerned triad, which can be further inferred using the proposed directed balance theory. We find that many triads share common edges among themselves. This overlapping nature further helps to determine the sign of the unlabeled edges in the network, and thereby determines the label of the node further. Edge Sign Determination. We further determine the sign of the unlabeled edge in a given triad 𝑇 , which consists of nodes (𝑢, 𝑣, 𝑤), where exactly one node is unlabeled. We apply the proposed directed balance theory in the signed hyperlink triad to determine the sign of the unlabeled edge. In this method, we consider either weak or strong balance for all the possible cases of balancing situation described in figure 6. Node Labeling. Finally, we classify the unlabeled nodes into benign or malicious in the network with the help of the inferred edge sign. As there exist many overlapping triads in the signed hyperlink network, we apply 51% majority voting rule to identify the final label of the unlabeled edges in the network. Based on the final edge label. We determine the nature of the unlabeled node. We describe the algorithm formally in the following as algorithm 2. Analysis of Proposed SiMULI Algorithm: In this section, we analyze the proposed SiNMULI algorithm to measure the requirement of computational resources to run this framework to identify the malicious URLs. This formal method of analysis also helps us to compare the effectiveness of the proposed model over the existing

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

19

baselines. As the proposed algorithm has three distinct sections, we also analyze every individual section carefully and find the overall complexity of the proposed model. Let the signed directed network be denoted by 𝐺 (𝑉 , 𝐸), with 𝑉 being the set of nodes (websites) and 𝐸 the set of edges (hyperlinks), each edge 𝑒𝑢𝑣 carrying a sign 𝑠𝑢𝑣 ∈ {+1, −1}. The maximum possible number of triads in

the network would be |𝐸3 | , and assume 𝑇 is the set of triads kept after filtering, thus 𝑇 ⊆ |𝐸3 | . Therefore the 
 complexity of triad identification can be expressed as O |𝐸3 | , i.e., O (|𝐸| 3 ). The inference of the sign of the unlabeled edge using the proposed directed balance theory involves iteratively assigning missing edge signs to ensure this triadic balance. Given |𝑇 | total triads in the graph, the worst-case
complexity of triadic edge inference per iteration is O (|𝑇 |), therefore it can be expressed as O (|𝐸|) as 𝑇 ⊆ |𝐸3 | . Finally, after edge signs are inferred, unlabeled nodes 𝑣 ∈ 𝑉 are classified based on the 51% majority voting rule. As each unlabeled node of set 𝑣 belongs to the subset of 𝑇 . Thus, the computational complexity of labelling is O (|𝑣 |). Thus it can be deduced to O (|𝑉 |). Therefore, overall computational complexity could be estimated by combining the three phases of the proposed algorithm as O (|𝑉 | + |𝐸|). On the other hand, the memory (space) complexity for maintaining the network representation (adjacency structure and node labels) is O (|𝑉 | + |𝐸|). The algorithm leverages structural balance to deliver robust and interpretable malicious URL detection. The iterative inference method efficiently converges due to typically sparse real-world hyperlink structures, and the node labeling step provides an intuitive mapping between network trust dynamics and classification outcomes, enhancing both explainability and detection accuracy.

6

Result & Discussion

In this section, we empirically evaluate the proposed SiNMULI framework on the signed hyperlink network constructed from our crawled dataset. We first describe how ground-truth labels are established using independent threat-intelligence sources and then visualize representative local signed subgraphs to build intuition about how benign and malicious sites are embedded in the network. Next, we characterize the distribution of the seven triad types defined in Section IV and relate their prevalence to strong and weak balance configurations. Finally, we present quantitative detection results, analyze standard evaluation metrics, and compare SiNMULI against state-of-the-art blacklist, traditional machine-learning, deep-learning, and graph-based baselines.

6.1

Ground Truth for Validation

To validate the effectiveness of our proposed model, we establish the ground truth labels through independent verification using authoritative third-party threat intelligence services. Specifically, the unlabeled URLs of the test set are cross-validated against public reputation databases, PhishTank, and OpenPhish. These platforms maintain updated blacklists of confirmed phishing URLs contributed and vetted by the security community. This external lookup allows us to independently confirm the correctness of our model’s predictions without relying solely on internally annotated labels. We only include URLs that receive an exact match from the third-party database to ensure high-confidence validation. This external validation methodology enhances the reliability of our evaluation framework by introducing an unbiased reference standard. The high agreement observed between our predictions and the third-party ground truth supports the trustworthiness and real-world applicability of the SiNMULI framework.

6.2

Visualising Local Signed Subgraphs

To build intuition for how SiNMULI propagates trust signals, we first inspect a small local region of the signed network centered on a popular cross-domain infrastructure site. Such hubs are important because they receive links from many heterogeneous domains and can act as conduits through which both benign and malicious influence spreads. By examining a concrete example, Fig. 9, we can see how balance-based inference reshapes

20

•

Gayen et al.

Algorithm 2: Signed Network Edge Sign Inference and Node Classification Input: Filtered dataset J (from Algorithm 1) Output: Node label set Y ∈ {+1, −1} (legitimate or malicious) 1 Initialize signed directed graph 𝐺 (𝑉 , 𝐸) from dataset J ; 2 Set initial node labels: legitimate (+1), malicious (−1), unknown (0); 3 Set initial edge signs 𝑠𝑢𝑣 : legitimate → legitimate (+1), involving malicious (−1), unknown (0); // Triad identification 4 𝑇 ← AllDirectedTriads(𝐺); ★ 5 𝑇 ← {𝜏 ∈ 𝑇 : countUnknownEdges(𝜏) = 1 ∧ countUnlabeledNodes(𝜏) = 1}; ★ ★ 6 Build index TriadsByEdge[(𝑢, 𝑣)] ↦→ {𝜏 ∈ 𝑇 : (𝑢, 𝑣) ∈ 𝜏 } and set 𝑄 ← 𝑇 ; // Edge sign inference via balance theory 7 foreach triad (𝑢, 𝑣, 𝑤) ∈ 𝑄 do 8 if exactly one unlabeled edge exists then 9 Let 𝑒 ? = 𝑥 →𝑦; ; // 𝑒 ? : unlabeled edge 10 If 𝑦 (𝑥) = +1, prefer 𝑠𝑥 𝑦 = +1; if 𝑦 (𝑥) = −1, prefer 𝑠𝑥 𝑦 = −1; 11 Infer the edge sign to satisfy strong balance, otherwise weak balance; 12 Update 𝑠 (𝑒 ? ) and enqueue 𝜏 ′ ∈ TriadsByEdge[𝑒 ? ]; // Node labeling via majority voting foreach unlabeled node 𝑣 ∈ 𝑉 do 14 Let 𝐸 𝑣− = {(𝑢, 𝑣) ∈ 𝐸 : 𝑠𝑢𝑣 = −1} and 𝐸 𝑣+ = {(𝑢, 𝑣) ∈ 𝐸 : 𝑠𝑢𝑣 = +1}; 15 If |𝐸 𝑣+ | + |𝐸 𝑣− | = 0, continue; set Majority = 0.51 and TiePolicy ∈ {abstain, malicious, benign}; |𝐸 𝑣+ |  +1,  + |+|𝐸 − | > Majority,  |𝐸 𝑣 𝑣   |𝐸 𝑣− | ; 16 Assign 𝑦 𝑣 according to 𝑦 𝑣 = −1, + |𝐸 𝑣 |+|𝐸 𝑣− | > Majority,    0/−1/+1, otherwise (by TiePolicy). 

13

17

return Final node labels 𝑦 𝑣 ;

local neighbourhoods around these shared infrastructure nodes. To qualitatively inspect how phishing URLs are embedded within the hyperlink structure, we examine a representative subgraph centered on a popular cross-domain infrastructure site. Fig. 9 shows the same subgraph before and after SiNMULI’s balance-based inference. Before inference (Fig. 9a), only a subset of nodes are labeled as legitimate or phishing. Many neighbours of the central hub remain unlabeled (grey). Benign nodes (blue) form small, tightly connected groups. Malicious nodes (red) appear as thin branches at the periphery. Because the unlabeled nodes sit between these groups, it is difficult to understand the local risk pattern by inspection alone. After applying SiNMULI (Fig. 9b), the previously unlabeled nodes are classified using edge signs inferred from directed triads. We apply our proposed algorithm 2 to segregate the unlabeled URLs into malicious and benign. The resulting subgraph is more structured: benign and malicious pockets become clearly separated around the infrastructure hub. This view helps analysts see which regions of the local neighbourhood are safe, which clusters concentrate malicious activity, and how risk can propagate through shared infrastructure.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

(a) Before inference

•

21

(b) After SiNMULI inference

Fig. 9. Figure shows the example signed hyperlink subgraph containing a small set of URLs among which a few are malicious, and some are legitimate, whereas the majority are unlabeled. Blue nodes denote legitimate URLs, red nodes denote malicious URLs, and grey nodes are unlabeled. The figure 9a corresponds to the network structure prior to the identification of unlabeled URLs by SiNMULI. Whereas, the figure 9b corresponds to the network structure after the identification of unlabeled URLs.

6.3

Distribution of Triads

In this section, we characterize the local signed structure of the SiNMULI network via triads, i.e., the smallest motifs that encode balance/imbalance and status asymmetries in signed (and directed) graphs. Triads are theoretically well-motivated: classical structural balance theory predicts that certain sign patterns are more prevalent and stable than others, while modern treatments for directed settings emphasize status/ordering effects. Both of the prior frameworks use triads as their basic diagnostic unit. We quantify how often each label combination in the triads{B = legitimate, M = malicious, U = unknown}occurs. To understand skew better, we plot their frequencies on both linear and logarithmic scales. This triad census provides a local view of the network and complements the overall graph and community-level statistics by showing where imbalance or uncertainty tends to cluster. Triad filtering and counting protocol. We enumerate triads over the induced interaction graph and retain the seven informative node-label compositions that contain at least two labeled vertices: I (B, B, U), II (B, B, M), III (B, M, U), IV (B, M, M), V (M, M, U), VI (B, B, B), VII (M, M, M). We filter out triads with insufficient label signal, i.e., (B, U, U), (M, U, U), and (U, U, U), because balance/status predicates become indeterminate when fewer than two vertices are known. We also exclude degenerate cases (self-loops, missing edges) and collapse isomorphic label permutations via canonicalization, such that each composition is counted once. This protocol aligns with signed-network theory, where the balance test is defined over known signed relations, and unknowns are handled via inference rather than included as evidence. As shown in Fig. 10, mixed-type triads dominate the SiNMULI signed network. The (𝐵, 𝐵, 𝑀) pattern is most common (≈ 3.0 × 1013 ), followed by (𝐵, 𝑀, 𝑀) (≈ 2.0 × 1013 ); together they account for roughly 60–65% of all triads. Purely benign (𝐵, 𝐵, 𝐵) triads occur at about 1.5 × 1013 , while purely malicious (𝑀, 𝑀, 𝑀) are rarer (∼ 0.8 × 1013 ), indicating strongly balanced but less prevalent clusters. Triads involving unknown nodes—e.g., (𝐵, 𝐵, 𝑈 ) and (𝑀, 𝑀, 𝑈 )—fall in the 1012 –1013 range and contribute only marginally to overall balance. In short, benign–malicious interactions shape the network’s typical motif, producing semi-stable, tension-prone structures that capture the system’s structural imbalance. On a logarithmic scale, triad counts span nearly three orders of magnitude, consistent with a heavy-tailed (scalefree) structure. The sharp drop from (𝐵, 𝐵, 𝑀) to (𝐵, 𝐵, 𝐵) shows that benign–malicious interlinks are far more

22

•

Gayen et al.

common than purely cooperative clusters—an observation with direct implications for anomaly detection and propagation. The prevalence of (𝐵, 𝑀, 𝑀) and (𝐵, 𝐵, 𝑀) suggests a tendency toward weakly balanced states, where local inconsistencies coexist with global stability; these triads often act as “tension hubs” where polarity flips or edge re-evaluation occur during inference. By contrast, the relative scarcity of (𝐵, 𝐵, 𝐵) and (𝑀, 𝑀, 𝑀) indicates that strongly balanced communities appear as isolated cores rather than dominant formations. Quantitatively, these patterns support the SiNMULI hypothesis: real-world malicious ecosystems stabilise in partially balanced configurations, so weak triadic balance governs macro-dynamics and underpins triad-driven inference and sign propagation. We further examine these seven triad types through the lens of strong and weak balance. By construction, triads of type (B,B,B) are strongly balanced under the Cartwright–Harary definition, since all three edges are positive. In contrast, (M,M,M) triads correspond to the all-negative configuration, which is unbalanced under strong balance but permitted under Davis’s weak balance and therefore models hostile but internally stable clusters. Mixed triads such as (B,B,M) and (B,M,M) admit both strongly and weakly balanced edge-sign patterns: a single negative edge attached to the malicious node yields a strongly balanced (+,+,−) configuration, whereas sign assignments with three negative edges are only weakly balanced. In our inference pipeline, SiNMULI tends to favour sign assignments that move frequently occurring mixed triads toward these balanced configurations, either strong or weak. This behaviour is consistent with structural balance theory and provides a principled explanation for why triad-driven sign propagation stabilises quickly in the signed hyperlink network. The triad-level analysis reveals a clear separation between structurally weak and structurally strong configurations. Triads of type II and VI predominantly instantiate weakly balanced patterns, in which the combination of edge signs fails to stabilise a consistent trust or distrust assignment across the three vertices and remains sensitive to small perturbations. In contrast, triads of type I, III, IV, V, and VII systematically generate strongly balanced cases, where the induced sign structure is internally consistent and reinforces either cohesive benign clusters or cohesive malicious clusters. This distribution implies that only a narrow subset of triad types acts as a source of local instability, while the majority of observed motifs contribute to the emergence of robustly polarized communities that drive reliable label propagation over the signed network.

6.4

Evaluation Metrics

In our work, we have used several metrics to measure the performance of our proposed model as follows: Confusion Matrix. The assessment of the proposed signed hyperlink classifier’s effectiveness in predicting the malicious URLs from the collected dataset containing unlabeled URLs can be conducted through the utilization of a confusion matrix as depicted in the following:

Malicious Benign

Malicious TP FN

Benign FP TN

Where, (1) TP= Total number of Malicious URLs correctly classified as Malicious. (2) TN=Total number of Benign URLs correctly classified as Benign. (3) FP=Total number of Benign URLs misclassified as Malicious. (4) FN=Total number of Malicious URLs misclassified as Benign. Accuracy. Accuracy measures the percentage of correct predictions the algorithm makes on a given dataset. Mathematically, accuracy is calculated by dividing the number of correct predictions by the total number of

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

23

Fig. 10. Figure shows the distribution of the seven distinct types of triads in the network. Along the x-axis, we plot each category, and along the y-axis, we plot the counts on a logarithmic scale.

predictions: 𝑇𝑁 +𝑇𝑃 (4) 𝑇𝑃 + 𝐹𝑁 + 𝐹𝑃 + 𝑇 𝑁 Precision. Precision is a performance metric that evaluates the performance of a classification algorithm, specifically for positive class predictions. Mathematically, precision is calculated as: 𝑇𝑃 𝑃𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛 = (5) 𝑇𝑃 + 𝐹𝑃 Recall. Recall is a performance metric that measures the ability of the model to correctly identify positive instances or the proportion of actual positive instances that are correctly identified by the algorithm. The formula to calculate recall is as follows: 𝑇𝑃 𝑅𝑒𝑐𝑎𝑙𝑙 = (6) 𝑇𝑃 + 𝐹𝑁 F1-score. F1-score combines precision and recall into a single value to provide a balanced assessment of the algorithm’s effectiveness. The F1-score is the harmonic mean of precision and recall, calculated using the following formula: 2 × (𝑃𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛 × 𝑅𝑒𝑐𝑎𝑙𝑙) 𝐹1 = (7) 𝑃𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛 + 𝑅𝑒𝑐𝑎𝑙𝑙 ROC. The Receiver Operating Characteristic (ROC) curve is a graphical representation of the performance of a binary classification algorithm. 𝑇𝑃 𝑇 𝑃𝑅 = (8) 𝑇𝑃 + 𝐹𝑁 𝑇𝑁 𝐹 𝑃𝑅 = (9) 𝑇 𝑁 + 𝐹𝑃 𝐴𝑐𝑐𝑢𝑟𝑎𝑐𝑦 =

24

•

Gayen et al.

AUC. In machine learning, the AUC (Area Under the Curve) is a metric used to evaluate the performance of binary classification models, typically in the context of a Receiver Operating Characteristic (ROC) curve. We summarize the performance of our proposed model in table 5. In this table, we show the confusion matrix, which mentions the number of malicious and benign URLs that were tested to measure the performance. The results also show the performance of the model based on the standard performance metric. The proposed signed network approach offers several notable advantages over traditional machine learning and deep learning-based systems:–a) Interpretability: The model leverages sociological balance theory and hyperlink structure, which makes the inference process transparent—an essential feature for cybersecurity practitioners. b) Low Resource Requirements:Unlike models such as DeepBF [24], or LBP-based models [10], which require labeled training data and computational overhead, our method operates with minimal training and relies on existing network structures. c) Robustness to Obfuscation:Content- or URL-string-based approaches (e.g., [18], [20]) are often fooled by adversarial patterns. Our signed network-based approach is more resilient since hyperlink behaviour is harder to spoof at scale. d) Effective for Unknown Nodes:Through majority-rule and triad reasoning, our system can label previously unseen domains without needing re-training or additional labeled samples. Table 4 summarizes the key characteristics of SiNMULI relative to existing approaches across multiple evaluation dimensions. Table 4. Comparison of SiNMULI with Existing Malicious URL Detection Approaches Approach

Feature Dependency

SiNMULI (Proposed) DeepBF [24] URLNet [18] LBP-GNN [10] Traditional ML [13] Blacklist Methods [20]

Structural (Signed Graph) Learned Bloom + CNN Lexical (Deep CNN) Graph + IP/Host-level Lexical & Host-based Manual Reports

6.5

Adversarial InterRobustness portability High High Medium Medium Low Low Low High Medium Low High Low

Scalability

New Domain Handling

Complexity

High Medium Medium Medium High High

Strong (51% rule) Medium Medium Strong Weak Very Weak

Low (Rule-based, no training) Medium (Hybrid filter + CNN) High (Deep NLP pipeline) High (GNN + Message Passing) Low (Shallow models + features) Very Low (Lookup only)

Comparison with Existing Models

To fully place SiNMULI in the changing world of detecting bad URLs, we compare it with other methods that are already in use, including traditional machine learning, deep learning, and graph-based approaches. To perform this comparative study, we selected 6 different existing modes: 1) Black-White List method [20] 2) Traditional ML Model [13] 3) DeeBF [24] 4) URLNet [18] 5) LBP-GNN [10]. Table 4 summarizes the end-to-end performance of SiNMULI relative to six representative baselines spanning blacklist lookup, traditional lexical/host-feature models, deep lexical CNNs, and graph neural approaches. Across all metrics, SiNMULI achieves near-perfect results (Precision = 99.99%, Recall = 99.62%, F1 = 99.80%, AUC = 0.9981), while maintaining a competitive computational cost per URL. In particular, SiNMULI consistently matches or exceeds the AUC of deep lexical models (URLNet, DeepBF) and graph-based baselines (LBP-GNN), despite relying on lightweight signed-network inference rather than heavy end-to-end training. Insight of the Performace Comparison: SiNMULI delivers strong, near-perfect performance across our experiments: Accuracy = 0.9989, Precision = 0.9999, Recall = 0.9962, and F1 = 0.9980. The confusion matrix (TP = 12,958, TN = 33,175, FP = 1, FN = 50) implies a negligible false-positive rate (≈ 3 × 10−5 ) alongside high sensitivity, yielding a balanced error profile suitable for deployment. The ROC curve in Fig. 11(b) places SiNMULI on the upper performance envelope relative to baselines across operating points, showing consistently higher true-positive rates at comparable false-positive rates. We attribute these gains to the explicit use of signed hyperlink structure and balance-theoretic triadic reasoning, which propagate trust/distrust signals to confidently label weakly connected or previously unseen nodes, and to the framework’s low training overhead that leans on

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

25

Table 5. Performance comparison of SiNMULI with baseline models and confusion matrix of predictions. (a) Performance comparison of SiNMULI with baseline models Approach

Acc (%)

Prec (%)

Rec (%)

F1 (%)

AUC

SiNMULI (Proposed)

99.89

99.99

99.62

99.80

0.9981

URLNet

97.63

91.87

96.02

93.90

0.9914

DeepBF

97.98

91.98

97.90

94.85

0.9936

Traditional ML

59.79

30.12

84.27

44.38

0.6471

LBP-GNN

58.41

19.65

38.36

25.99

0.6412

Blacklist

85.91

100.00

26.00

41.26

0.6300

(a) Accuracy, F1-score, Precision and Recall comparison of SiNMULI with baseline models.

(b) Confusion Matrix of SiNMULI Mal.

Ben.

Mal.

12958

50

Ben.

1

33175

(b) ROC comparison of SiNMULI with baseline models.

Fig. 11. Performance visualization of the proposed SiNMULI model: (a) Accuracy, Precision, Recall and F1-score comparison across models; (b) ROC curve comparison with baseline approaches.

network structure rather than large labeled corpora—traits that also improve robustness to content obfuscation (as shown in Fig. 11(a) and Table 5). Collectively, the results indicate that structure-aware, multi-layer signed modeling yields reliable, generalisable, and resource-efficient malicious-URL detection that outperforms the traditional ML, deep lexical, and graph baselines reported alongside SiNMULI.

6.6

Application in Industrial and Enterprise Environments

Industrial control systems and large enterprise networks increasingly rely on web-based update channels (e.g., firmware repositories, vendor portals, SCADA configuration endpoints. In such environments, misclassified or Compromised URLs can directly translate into plant downtime or safety issues incidents. SiNMULI’s lightweight, training-free design makes it suitable for deployment on industrial gateways and secure web proxies, where it can continuously monitor hyperlink interactions among update servers, mirrors, and internal hosts.

26

•

Gayen et al.

Because SiNMULI operates on local triads and majority rules over edges, much of the inference can be pushed to the edge of the network. Routers, industrial gateways, or SDN switches can maintain local signed subgraphs and apply balance-based updates incrementally as new URLs and links appear, forwarding only aggregated trust scores to a central controller. This distributed design reduces bandwidth overhead and enables low-latency decisions close to where traffic is observed. For example, URLs involved in firmware distribution often form a tightly knit a benign cluster in the signed hyperlink graph; sudden emergence of links to low-trust domains or previously unseen external hosts can be flagged and scored by SiNMULI, yielding an interpretable risk signal for operators before an update is rolled out fleet-wide.

7

Analysis of Malicious Sites

We analyze malicious sites in detail because a realistic detector cannot be designed in the abstract: it must be grounded in how phishing and other attacks are actually realized in the wild. Systematic characterization of our malicious HTML corpus along lexical, content/DOM, and hyperlink-structure axes exposes the concrete design choices of attackers, such as how they shape URLs, structure forms and scripts, and wire pages into the web graph. This, in turn, tells us where the most discriminative and stable signals live, which features from prior work remain useful, and which additional cues are needed to handle modern kits, obfuscation, and template reuse. By quantifying these patterns rather than assuming them, the analysis reduces feature engineering to an evidence-driven process, helps avoid overfitting to URL-only heuristics or brittle blacklists, and ultimately supports the construction of hybrid models that generalize better to previously unseen lures and evolving malicious infrastructures. We have summarized all the features that are to be analyzed from the malicious URL perspective (listed in table 6). This section characterizes our HTML corpus along three complementary axes that are widely used in phishing analysis: (i) lexical signals derived from the page URL (length/entropy, special characters, subdomain depth, tokens), (ii) content/DOM cues (document size, forms and input controls, scripting/iframes, inline/base64 assets), and (iii) hyperlink structure (internal vs. external links, unique outbound domains, empty and mailto: anchors). Jointly, these views capture both the page’s surface-level appearance and the ways it connects to the web graph—two facets that prior work has repeatedly shown to be complementary. Content-based detectors such as CANTINA motivated DOM/text features, while later hybrid systems explicitly fuse URL-, HTML/JS-, and link-based indicators to improve generalization beyond blacklist matching. We adopt the same rationale here and report descriptive statistics to guide feature selection for downstream models. Document size is highly right-skewed (Fig. 13a): most pages are small, with a long tail of large files—often templates with inlined assets or obfuscated bundles. Forms and input controls exhibit a sparse core (typically 0–2 per page) and a thin tail of complex pages (Fig. 12); for phishing, the type and destination of forms matter more than raw counts (e.g., password fields and off-domain handlers). Hyperlink boxplots reveal many pages with few links and a minority with hundreds (Fig. 13b); separating internal from external links is useful because pages that push users off-domain (and whose forms post off-domain) are riskier in aggregate. Finally, the tag mix (Fig. 13c) is dominated by layout/navigation elements (div, a, span); variance in script, input, iframe, and link/meta is especially informative because that is where credential capture, obfuscation, and third-party dependencies typically live. Beyond detection, the external-link heavy tail is operationally relevant: large-scale studies show nontrivial link rot over time, implying that pages with heavy external dependencies are more brittle to reproduce. Implications for feature design and detection. These distributions support a hybrid feature set: lexical URL cues (e.g., host as IP, “@”, redirection “//”, hyphens, token matches like login/verify, shorteners), content/DOM heuristics (right-click disabling, pop-ups, onmouseover, base64 density, number and type of forms), and hyperlink/SFH signals (internal vs. external link ratio, unique outbound domains, server form handler domain

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

27

Fig. 12. Left: histogram of forms per page. Right: histogram of input fields per page. Both are highly right-skewed.

(a) Distribution of doc. lengths (bytes).

(b) External vs. relative link distri.

(c) Top HTML tags distribution.

Fig. 13. Figure 13a, Distribution of document lengths (bytes) across the corpus. Along the x-axis, we plot document length measured in bytes, whereas the y-axis represents the raw count. In figure 13b, we show external vs. relative link distributions. Figure 13c shows the distribution of top HTML tags across pages. Along the x-axis, we plot the top tags, and the y-axis plots the raw count of that corresponding tag.

compared to page domain, mailto: submissions). Public benchmarks (e.g., the UCI “Phishing Websites”/“Website Phishing” datasets) encode many of these exact attributes—SFH, Request_URL, URL_of_Anchor, Links_in_tags, popUpWindow, having_IP_Address—and surveys consistently report that models combining URL + HTML/JS + link features outperform URL-only baselines, particularly on look-alike domains and previously unseen lures. In our corpus, we therefore prioritize where forms submit, the external-resource/link profile, and the presence of obfuscating script patterns alongside standard URL lexicals; together these yield transparent, engineerable signals that align with prior art and explain the outliers seen in Figures 12– 13.

8

Conclusions and Future Works

In this paper, we presented SiNMULI, a signed-network–based framework for detecting malicious URLs. Starting from a labeled phishing dataset, we constructed a large-scale signed hyperlink graph where websites act as nodes and hyperlinks as directed trust/distrust edges. Using a directed balance theory tailored to adversarial web graphs, we inferred missing edge signs and classified previously unseen domains through a simple 51% majority rule. Experimental evaluation shows that SiNMULI achieves near-perfect performance (accuracy 99.89%, precision 99.99%, Recall 99.62%, F1 99.80%), while remaining interpretable, training-free, and computationally efficient compared with machine-learning baselines. Our proposed model not only explores the social aspect of hyperlink generation but also explores the new horizon of malicious URL detection. Performance of SiMULI is compared with existing baselines, and it reveals that our proposed model performs better than existing ones. Our results also demonstrate that structural properties, e.g., lower centrality, sparse internal links, and weaker clustering,

28

•

Gayen et al.

Table 6. Summary of analysis features for malicious sites and their relevance to detection. Axis / group

feature

Lexical URL structure

Host representation & redirection tricks Semantic URL tokens

Document size & inlined assets Forms and input controls Scripting and UI behaviour Iframes and embedded widgets

Hyperlink structure (internal vs. external)

Anchor semantics & mailto targets External resource profile & brittleness

Representative signals

Why it matters for detection

URL length, character entropy, subdomain depth, use of separators and repeated “//”. Host as raw IP, URL shorteners, unusual TLDs, “@” and pseudo-redirect segments.

Phishing URLs often use long, noisy, deeply nested paths to hide impersonation and tracking parameters, diverging from typical benign URL structure. Raw IP hosts, shorteners, and misleading separators are common in transient malicious infrastructure and help expose the true origin of the page. Presence of tokens such as login, verify, Security- and brand-related terms are over-represented update, secure, brand names. in credential-theft and verification lures and become more discriminative when combined with structural URL cues. HTML size, number/size of inline images Very large pages or high base64 density often indiand scripts, base64-encoded content. cate obfuscated bundles or reusable phishing templates rather than ordinary, modular benign pages. Counts of forms, presence of password Credential harvesting requires specific inputs and offfields, server form handler (SFH) domain domain handlers; mismatches between page and SFH vs. page domain. domains (e.g., SFH) are strong phishing indicators. Number of script tags, pop-up windows, Aggressive or anti-inspection UI patterns and obfusright-click disabling, event handlers such cated scripts are more prevalent on malicious pages as onmouseover. and capture behaviours not visible from the URL alone. Use of iframe and similar embedding Embedded widgets enable visual cloning of legiticonstructs, embedded login panels. mate sites while redirecting credentials to attackercontrolled endpoints, providing a structural cloning signal. Counts and ratios of on-domain vs. off- Atypical internal/external link ratios and many disdomain links, number of unique outbound tinct outbound domains are characteristic of spam and domains. phishing landing pages; related to features such as URL_of_Anchor and Links_in_tags. Empty anchors, anchors pointing to Such anchors often appear in low-effort spam and mailto:, misleading or non-navigational contact-harvesting pages and help distinguish them links. from well-structured, benign navigation menus. Fraction of scripts/images/styles loaded High external dependence (e.g., Request_URL) and britfrom external domains; long external-link tle link profiles are typical of short-lived malicious intail; reliance on a few critical endpoints. frastructures and support longitudinal fingerprinting beyond simple blacklists.

consistently differentiate phishing sites from legitimate ones. These findings confirm that signed connectivity patterns carry strong maliciousness signals and effectively answer our three research questions on model utility, efficiency, and balance-theoretic inference. Despite its strong performance, SiNMULI has several limitations. Comprehensive data collection was difficult because many phishing websites are short-lived, block crawlers, or reveal only partial content. It results in incomplete link structures and isolated nodes in the graph. This incomplete coverage may obscure clusters or relationships within the malicious ecosystem. Thus, it restricts how well the model generalizes to live traffic. Further, modern websites often load essential content through scripts or user interactions that basic crawlers do

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

29

not capture. Thus, it leads to additional missing links. Finally, the current pipeline operates offline: constructing the full signed network and running iterative balance-based label propagation are computationally costly, making real-time deployment challenging without substantial engineering improvements. Future work can strengthen SiNMULI in several ways. First, developing an incremental or streaming version of the signed-network model would allow the system to update trust relationships dynamically as new pages and links appear. Thus, it would be able to improve the adaptability of the model to fast-moving phishing campaigns. Second, integrating network-structure signals with content-based features, e.g., text, images, or URL components, could enhance robustness in cases where link structure is sparse or ambiguous. Improving the efficiency of the model is also essential to cope with real-world scenarios. Thus, incorporating faster data structures, improved pruning strategies, and targeted crawling could reduce computation and enable near–real-time analysis on large web graphs.

Declarations • Funding: No funds, grants, or other support were received to conduct this study. • Conflict of interest/Competing interests: On behalf of all authors, the corresponding author states that there is no conflict of interest. • Data availability: Publicly available. • Author contribution: Avijit Gayen: Conceptualization, Methodology, Experiment, Writing. Sayan Mondal: Data collection, Methodology, Experiment, Writing. Angshuman Jana: Supervision, Writing review & editing.

References [1] Ross J. Anderson. 2010. Security Engineering: A Guide to Building Dependable Distributed Systems. John Wiley & Sons. [2] Anti-Phishing Working Group. 2023. Phishing Activity Trends Report, 2nd Quarter 2023. https://docs.apwg.org/reports/apwg_trends_ report_q2_2023.pdf Accessed: 2023-11-16. [3] Subhash Ariyadasa, Shantha Fernando, and Subha Fernando. 2021. Phishing Websites Dataset. https://doi.org/10.17632/n96ncsr5g4.1. doi:10.17632/n96ncsr5g4.1 [4] Simon Bell and Peter Komisarczuk. 2020. An Analysis of Phishing Blacklists: Google Safe Browsing, OpenPhish, and PhishTank. In Proceedings of the Australasian Computer Science Week Multiconference. 1–11. [5] Dorwin Cartwright and Frank Harary. 1956. Structural Balance: A Generalization of Heider’s Theory. Psychological Review 63, 5 (1956), 277–293. doi:10.1037/h0046049 [6] Kai-Yang Chiang, Nikhil Natarajan, Nikolaj Tatti, and Inderjit S. Dhillon. 2014. Prediction and Clustering in Signed Networks: A Local to Global Perspective. Journal of Machine Learning Research 15, 1 (2014), 1177–1213. [7] Jian Gao et al. 2020. Phishing URL Detection based on CNN and GRU. IEEE Access 8 (2020), 25681–25688. [8] Avijit Gayen, Sukriti Santra, Ayush Dey, and Angshuman Jana. 2024. A Network Model to Study the Underlying Characteristics of Phishing Sites. IEEE Networking Letters 6, 1 (2024), 46–49. doi:10.1109/LNET.2023.3347724 [9] Paul Gibbs, Linda Neuhauser, and Dena Fam. 2018. Introduction–The Art of Collaborative Research and Collective Learning: Transdisciplinary Theory, Practice and Education. In Transdisciplinary Theory, Practice and Education. Springer, 3–9. [10] W. Guo et al. 2025. Efficient Phishing URL Detection Using Graph-based Machine Learning and Loopy Belief Propagation. arXiv preprint arXiv:2501.06912 (2025). arXiv:2501.06912 [cs.CR] [11] Fritz Heider. 1946. Attitudes and Cognitive Organization. Journal of Psychology 21, 1 (1946), 107–112. [12] Chester A. Insko. 1984. Balance Theory, The Jordan Paradigm, and The Wiest Tetrahedron. Advances in Experimental Social Psychology, Vol. 18. Academic Press, 89–140. doi:10.1016/S0065-2601(08)60143-4 [13] Anupam Joshi et al. 2019. Using Lexical Features for Malicious URL Detection: A Machine Learning Approach. arXiv preprint arXiv:1910.06277 (2019). arXiv:1910.06277 [cs.CR] [14] M. Khonji, Y. Iraqi, and A. Jones. 2013. Phishing Detection: A Literature Survey. IEEE Communications Surveys & Tutorials 15, 4 (2013), 2091–2121. doi:10.1109/SURV.2013.032213.00009 [15] T. Kim et al. 2022. Phishing URL Detection: A Network-based Approach Robust to Evasion. IEEE Transactions on Information Forensics and Security (2022).

30

•

Gayen et al.

[16] H. Kou et al. 2020. Trust-based Missing Link Prediction in Signed Social Networks. ACM Transactions on Knowledge Discovery from Data 14, 3 (2020), 1–27. [17] Abhishek Kumar, Jyotir Moy Chatterjee, and Vicente García Díaz. 2020. A novel hybrid approach of SVM combined with NLP and probabilistic neural network for email phishing. International Journal of Electrical and Computer Engineering 10, 1 (2020), 486. [18] Hai Le, Minh Pham, Doyen Sahoo, and Steven C. Hoi. 2018. URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection. In Proceedings of the 32nd AAAI Conference on Artificial Intelligence. 7950–7957. [19] Jure Leskovec, Daniel Huttenlocher, and Jon Kleinberg. 2010. Signed Networks in Social Media. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI). ACM, 1361–1370. doi:10.1145/1753326.1753532 [20] Justin Ma, Lawrence K. Saul, Stefan Savage, and Geoffrey M. Voelker. 2009. Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs. In Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 1245–1254. [21] D. K. McGrath and M. Gupta. 2008. Behind Phishing: An Examination of Phisher Modi Operandi. In Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET). [22] National Crime Records Bureau. 2020. Crime in India 2020: Statistics, Volume I. https://ncrb.gov.in. Accessed: 2024-01-10. [23] Robert O’Harrow. 2013. Zero day: the threat in cyberspace. Diversion Books. [24] R. Patgiri et al. 2021. DeepBF: A Deep Learning based Bloom Filter for Malicious URL Detection. IEEE Transactions on Information Forensics and Security 16 (2021), 2495–2505. [25] Fariza Rashid, Ben Doyle, Soyeon Caren Han, and Suranga Seneviratne. 2024. Phishing URL Detection Generalisation Using Unsupervised Domain Adaptation. Computer Networks 245 (2024), 110398. doi:10.1016/j.comnet.2024.110398 [26] Muhammad Fakhrul Safitra, Muharman Lubis, and Hanif Fakhrurroja. 2023. Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity. Sustainability 15, 18 (2023). doi:10.3390/su151813369 [27] Doyen Sahoo, Chenghao Liu, and Steven C. Hoi. 2017. Malicious URL Detection using Machine Learning: A Survey. arXiv preprint arXiv:1701.07179 (2017). arXiv:1701.07179 [cs.CR] [28] Javeriah Saleem, Rafiqul Islam, and Muhammad Ashad Kabir. 2022. The Anonymity of the Dark Web: A Survey. IEEE Access 10 (2022), 33628–33660. [29] Bruce Schneier. 2015. Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World. W. W. Norton & Company. [30] Reza Tajbakhsh et al. 2020. Fake News Detection Based on Hierarchical Attention Networks with Semantic–Syntactic Structure. Expert Systems with Applications 149 (2020), 113280. [31] Verizon. 2025. 2025 Data Breach Investigations Report (DBIR). Technical Report. Verizon Enterprise Solutions. https://www.verizon. com/business/resources/reports/dbir/ Accessed: 2025-09-26. [32] Bo Yang, Jiming Liu, and Irwin King. 2012. Trust Inference in Signed Social Networks. In Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, 1048–1056. [33] X. Zhou et al. 2023. Detecting Malicious Domains with Graph Neural Networks. IEEE Transactions on Dependable and Secure Computing (2023).

Author Biographies Avijit Gayen received the B.Tech. degree in information technology from Kalyani University, Kalyani, India, in 2004, and the M.E. degree in software engineering from Jadavpur University, Kolkata, India, in 2013. From 2013 to 2018, he was a Research Fellow with the Department of Computer Science and Engineering at the Indian Institute of Technology (IIT) Patna, India. He is currently pursuing a Ph.D. degree with the Department of Computer Science and Engineering at the Indian Institute of Information Technology Guwahati (IIITG), India. Since 2019, he has been an assistant professor in the Department of Computer Science and Engineering at Techno India University, Kolkata. His research interests include computational social science, network mobility, Federated Learning, Natural Language processing, and related fields. He has contributed to several peer-reviewed publications and projects in these areas.

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

•

31

Sayan Mondalreceived the B.Tech. degree in Computer Science and Engineering from Techno India University, Kolkata, India, in 2020, and the M.Tech. degree in Computer Software Engineering from Birla Institute of Technology and Science (BITS) Pilani, India, in 2024. He is a Research Scholar (Ph.D.) with the Department of Computer Science and Engineering at the Indian Institute of Information Technology Guwahati (IIITG), India. From November 2020 to March 2025, he was with Virtusa, Hyderabad, India, serving in successive engineering roles. Since March 2025, he has been a Solutions Architect (AI–ML & ServiceNow) with Humanize, Bengaluru, India. His research interests include cybersecurity, signed networks, graph-based threat detection, trust inference, and applied machine learning systems. He has contributed to open-source projects and industry deployments in phishing detection and LLM-assisted security. Angshuman Jana received the B.Tech. degree in Computer Science and Engineering from West Bengal University of Technology, Kolkata, India, in 2011, the M.Tech. degree in Computer Science and Engineering from the National Institute of Technology, Durgapur, India, in 2013, and the Ph.D. degree in Computer Science and Engineering from the Indian Institute of Technology (IIT) Patna, India, in 2019. From January to June 2019, he served as a Visiting Faculty at Motilal Nehru National Institute of Technology (MNNIT), Allahabad. Since July 2019, he has been an assistant professor in the Department of Computer Science and Engineering at the Indian Institute of Information Technology, Guwahati (IIITG), India. His research interests include formal methods, programming languages, static analysis and verification, information flow security analysis, abstract interpretation, and model checking. He has published several peer-reviewed articles in reputed journals and conferences, particularly focusing on database program verification and secure query analysis. Received 24 February 2024; revised 12 March 2024; accepted 5 June 2024

Related documents

• ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking#160734
• Security Considerations for Transient Numeric Identifiers Employed in Network Protocols#502727
• SoK: Cross-Chain Transaction Identification and Matching#463158
• Structural Analysis of Cryptographic Sequences using Stringology-Based Fingerprinting#204734
• List-Id: A Structured Field and Namespace for the Identification of Mailing Lists#134889