SiNMULI: Novel Signed Network Approach for Malicious URL Identification
2026-08-19 • Cryptography and Security
Cryptography and SecurityNetworking and Internet ArchitectureSoftware EngineeringSocial and Information Networks
AI summaryⓘ
The authors developed a new method called SiNMULI to spot harmful websites by looking at the links between URLs like a social network, where each URL is a node and links are positive or negative connections. Instead of just analyzing static data, their approach uses social balance theory to decide if a website is bad based on the majority of its connected links. They tested this method on real data and found it to be very accurate, better than common machine learning and deep learning methods. Additionally, their approach can explain its decisions, resist tricks from attackers, and works without needing extensive training.
Malicious URL detectionSigned networksSocial network analysisSocial balance theoryBacklinksBinary classificationAdversarial obfuscationMachine learningDeep learningCybersecurity
Authors
Avijit Gayen, Sayan Mondal, Angshuman Jana
Abstract
In today's era of rapid advancements in artificial intelligence, computer security and online safeguarding measures have undergone significant improvements. However, malicious websites continue to facilitate the spread of phishing schemes, fraudulent activities and unsolicited communications. Conventional methodologies in machine learning, deep learning and counterfeit website detection predominantly depend on static data analysis, which frequently proves ineffective against the evolving nature of malicious online entities. In response to these challenges, in this work, we propose a signed network-based approach for malicious URL identification, SiNMULI. We introduce an innovative framework that conceptualises the identification of harmful URLs as a signed network-based binary classification problem strongly rooted in the fundamental principles of social network analysis and social balance theory. In this approach, a signed network is constructed based on the backlinks, i.e., external hyperlinks of URLs, wherein each node symbolises a URL and the hyperlinks function as signed edges. Utilising a balance-theoretic inference mechanism, our methodology propagates edge signs and classifies unlabeled domains by employing a 51% majority rule across incoming links. Experimental results on this real-world dataset demonstrate that SiNMULI achieves 99.89% accuracy, 99.62% precision, and 99.80% F1-score, outperforming traditional ML and deep learning baseline models. Beyond high accuracy, SiNMULI offers interpretability, resilience against adversarial obfuscation, and independence from training data, making it a lightweight and scalable solution for real-world cyber defence.