We formulate the problem of malicious URL detection as a binary classification task for two-class prediction: “malicious" versus “benign". Specifically, given a data set with $T$ URLs $\{(\u_1, y_1), \dots, (\u_T, y_T)\}$, where $\u_t $ for $t = 1,\dots, T$ represents a URL from the training data, and $y_t \in \{1, -1\}$ is the corresponding label where $y_t = 1$ represents a malicious URL and $y_t=-1$ represents a benign URL. The crux to automated malicious URL detection is two-fold:

1.  *Feature Representation*: Extracting the appropriate feature representation: $\u_t \rightarrow \x_t$ where $\x_t \in \R^d$ is a $d$-dimensional feature vector representing the URL; and

2.  *Machine Learning*: Learning a prediction function $\f: \R^d \rightarrow \R$ which predicts the class assignment for any URL instance $\x$ using proper feature presentations.

Consider a binary classification task, the goal of machine learning for malicious URL detection is to maximize the predictive accuracy. Both of the folds above are important to achieve this goal. While the first part of feature representation is often based on domain knowledge and heuristics, the second part focuses on training the classification model via a data driven optimization approach. Fig. \[fig:framework\] illustrates a general architecture of solving Malicious URL Detection 