← All publications

Latest research · arXiv preprint · October 2026

CyberHull: Deterministic Malicious URL Isolation via Convex Hull

Geometric threat detection using explicit convex boundaries over content entropy, semantic features, and hyperlink structure.

Read the paper ↗ Download BibTeX Code & data ↗
RecordarXiv:2610.27675v2
Published2026-10-20
StatusPreprint · revised 23 Oct 2026

Authors: Avijit Gayen, Aniket Ghosal, Durba Chakraborty, Sayan Mondal, Md Abdul Aziz Al Aman, Angshuman Jana.

Research question

Can geometric boundaries make URL decisions inspectable?

The problem

Phishing infrastructure changes faster than static blacklists. CyberHull studies whether explicit boundaries around observed legitimate web behaviour can identify suspicious URLs without a deep neural classifier.

The contribution

The framework projects content, language, and link features into several geometric spaces called vaults. Each vault encloses legitimate examples in a convex hull. A request is accepted by the model only when its projected features satisfy every selected boundary.

Methodology

From web features to a geometric decision.

  1. Extract web features
  2. Rank feature pairs
  3. Construct convex hulls
  4. Project an unseen URL
  5. Check each boundary
  6. Return a URL label
Offline construction
  • Extract 91 features from the enriched benchmark.
  • Rank candidate pairs using the difference between class means divided by the sum of class standard deviations.
  • The study evaluates 4,095 pairs and retains 46 vaults; its explanation highlights three complementary feature domains.
  • Use QuickHull to enclose the legitimate training points in each selected space.
Inference

Project an incoming URL into the same feature spaces and apply containment tests. Falling outside a selected hull produces a malicious classification. This is a deterministic decision rule over measured features; being inside a hull is not proof that a website is safe.

Feature design

Three complementary views of a website.

Feature domains described in the preprint
DomainSignalsPurpose
Structural entropyShannon entropy and internal-page entropyDescribe content variability and repetition.
Semantic contentTF-IDF distributions of informational and urgency-related tokensRepresent language and page intent.
Hyperlink topologyInternal link density and outbound link ratiosDescribe site connectivity.

Reported evaluation

92% accuracy in the paper’s benchmark.

The revised preprint describes an 80/20 stratified split and reports averaged results from stratified five-fold cross-validation. Table 3 compares methods on the same feature representation. These are author-reported experimental results, not independently reproduced measurements.

Reported results · arXiv v2, Table 3
MethodAccuracyPrecisionRecallF1False-positive rate
PCA32%0.280.310.290.41
SVM81%0.790.760.770.14
Random Forest88%0.860.840.850.09
XGBoost90%0.890.870.880.07
CyberHull92%0.930.910.920.03

Source: CyberHull v2, Table 3 ↗. The separate count of 1,314 intercepted attacks out of 1,470 in Table 2 is not the same statistic as the cross-validation accuracy above.

The implementation uses Python 3.12, NumPy, Pandas, and SciPy Spatial. The paper describes CPU experiments on an Intel Core i7 with 16 GB RAM, with scikit-learn and XGBoost baselines.

Scope and future work

Boundary quality depends on the data behind it.

Current boundaries
  • Contaminated legitimate training data can distort the learned hulls.
  • Strict feature extraction removes unusable samples and limits the diversity represented in the evaluation.
  • Changes in legitimate websites can produce false positives unless boundaries are refreshed.
  • Results from this benchmark should not be directly ranked against SiNMULI or ASTriA results from different evaluations.
Future directions

The authors propose adaptive perimeter updates, broader validation on changing traffic, and federated feedback between edge nodes. These are research directions rather than established deployment capabilities.