perspective. Instead, the URL string has to be processed to extract useful features. Next we review some of the lexical features used for malicious URL detection.

*Traditional Lexical Features*: The most commonly used lexical features include statistical properties of the URL string, like the length of the URL, length of each of the components of the URL (Hostname, Top Level Domain, Primary domain, etc.), the number of special characters, etc. [@kolari2006svms] were one of the first to suggest extracting words from the URL string. The string was processed such that each segment delimited by a special character (e.g. “/”, “.”, “?”, “=”, etc.) comprised a word. Based on all the different types of words in all the URLs, a dictionary was constructed, i.e., each word became a feature. If the word was present in the URL, the value of the feature would be $1$, and $0$ otherwise. This is also known as the bag-of-words model.

Directly using the bag-of-words model, causes a loss of information about the order in which the words occurred in the URL. [@ma2009beyond; @ma2009identifying] also used similar lexical features, but they made the distinction between the tokens belonging to the hostname, the path, the top-level domain 