Multi-model detection of malicious URL using its network

A method of classifying a uniform resource locator (URL) said method comprising:

• requesting an input URL by a virtual browser;
• collecting a plurality of resource URLs requested by said input URL to form a network graph comprising nodes representing said input URL and said resource URLs and edges linking said input URL to each of said resource URLs;
• determining, using an identity model, whether said input URL is malicious or benign using host features of said input URL;
• determining, using an activity model, whether a network of said input URL is malicious or benign using said network graph and said edges;
• determining that said input URL is malicious when said identity model determines that said input URL is malicious or said activity model determines that said input URL's network is malicious.

A method of classifying a uniform resource locator (URL) said method comprising:

• requesting an input URL by a virtual browser;
• collecting a plurality of resource URLs requested by said input URL to form a network graph consisting of said input URL and said resource URLs;
• determining, using an identity model, whether said input URL is malicious or benign using lexical features of said input URL, wherein said lexical features are based upon the structural components of said input URL;
• determining, using an activity model, whether a network of said input URL is malicious or benign using said network graph;
• determining that said input URL is malicious when said identity model determines that said input URL is malicious or said activity model determines that said input URL's network is malicious.