Hybrid Ensemble Learning For Malicious URL Detection: A Literature Review of Machine Learning, Deep Learning, and Feature-Fusion Approaches

Abstract

The rapid evolution of phishing, malware distribution, and other web-based attacks has made malicious Uniform Resource Locator (URL) detection an important cybersecurity research problem. Traditional blacklist and rule-based mechanisms provide efficient protection against known malicious addresses but may fail when attackers generate previously unseen URLs, employ URL shortening, manipulate lexical structures, or rapidly change domains. Consequently, machine learning and deep learning approaches have increasingly been investigated for detecting malicious URLs using lexical, structural, host-based, contextual, and semantic information. More recently, hybrid and ensemble learning architectures have emerged as promising alternatives to individual classifiers because they combine complementary representations and learning mechanisms. This structured review synthesizes twenty studies published primarily between 2020 and 2026 across IEEE, Elsevier, Springer, and related peer-reviewed venues. The analysis is organized around representation diversity rather than reported accuracy alone and covers handcrafted lexical and structural features, sparse character n-grams, convolutional and recurrent neural representations, transformer-based contextual models, graph neural networks, and heterogeneous ensemble or fusion architectures. The evidence indicates a clear transition from single-representation classifiers toward multi-branch models that combine complementary statistical, sequential, contextual, and relational signals. However, reported benchmark performance is not directly comparable across studies because datasets, class distributions, preprocessing, temporal splits, and operating thresholds vary substantially. Persistent research challenges include cross-dataset generalization, temporal drift, domain-level leakage, class imbalance, false-positive control, adversarial robustness, explainability, and deployment latency. Based on these gaps, the review proposes a four-branch hybrid ensemble architecture and a formal evaluation plan emphasizing ablation, temporal and cross-dataset validation, adversarial testing, low-false-positive operating points, and computational efficiency.