Abstract

In todays era of rapid advancements in artificial intelligence, computer security, and online safeguarding measures have undergone significant improvements. However, malicious websites continue to facilitate the spread of phishing schemes, fraudulent activities, and unsolicited communications. Conventional methodologies in machine learning, deep learning, and detection technologies for counterfeit websites predominantly depend on static data analysis, which frequently proves ineffective against the onslaught of malicious online entities. In response to these challenges, in this work, we propose a signed network-based approach for malicious URL identification(S _i_ NMULI). We introduce an innovative framework that conceptualises the identification of harmful URLs as a signed network-based binary classification problem that is strongly rooted in the fundamental principles of social network analysis and social balance theory. In this approach, a signed network is constructed based on the back-links, i.e., external hyperlinks of URLs, wherein each node symbolizes a URL and the hyperlinks function as signed edges. Utilising a balance-theoretic inference mechanism, our methodology propagates edge signs and classifies unlabeled domains by employing a 51% majority rule across incoming links. Experimental results on this real-world dataset demonstrate that S _i_ NMULI achieves 99.89% accuracy, 99.62% precision, and 99.80% F1-score, which outperforms traditional ML and deep learning baseline models. Beyond high accuracy, S _i_ NMULI offers interpretability, resilience against adversarial obfuscation, and independence from training data, making it a lightweight and scalable solution for real-world cyber defence.