A Comparative Analysis of SHAP and LIME in Detecting Malicious URLs

Malicious URLs pose significant vulnerabilities, leaving users exposed as they navigate the digital world. To counter this, cybersecurity experts develop machine learning models using complex algorithms to protect users from cybercrime. Machine learning models are often referred to as “black boxes” due to their opaque nature. However, understanding the decision-making processes of these models is crucial. In fact, it is through this understanding that we can build robust protections for users and platforms. This research investigates the structural properties of URLs using machine learning models trained to classify them into five categories, specifically, benign, malware, phishing, defacement, and spam. By leveraging LIME and SHAP analysis, we identify key features that influence the model’s decision-making process for each classification. Through detailed analysis, the study highlights influential factors that impact URL classification, including positive, negative, and interactive effects between features. Benign URLs are characterized by simplicity, often shorter with fewer numeric or special characters, and minimal domain complexity. Malware URLs tend to be longer, with a higher density of numeric characters and complex domain structures, masking their malicious intent. Phishing URLs are detected based on features like short query lengths and minimal domain tokens, designed to resemble trusted sources and deceive users. Defacement URLs show complex domain structures and advanced techniques aimed at webpage tampering. Spam URLs exhibit shorter domains and simple paths, making them ideal for bulk distribution in spam campaigns. These insights provide a deeper understanding of how harmful and benign URLs can be distinguished based on structural attributes. The findings contribute to refining URL classification models and improving their effectiveness in the ever-changing threat landscape.