Latest research · 2026

SiNMULI: signed-network reasoning for malicious URLs.

SiNMULI reframes malicious URL identification as inference over a directed network of websites and hyperlinks, using trust and distrust relationships to classify previously unseen domains.

Read on arXiv ↗Download BibTeX Code & data ↗
RecordarXiv:2608.19190v1
Submitted19 August 2026
StatusPreprint

Authors: Avijit Gayen, Sayan Mondal, and Angshuman Jana.

Methodology

Use the web’s relationships, not only the URL string.

Core method
  • Represent websites as nodes and hyperlinks as directed signed edges encoding trust or distrust.
  • Extract directed triads from the network and apply strong or weak social-balance constraints.
  • Infer missing edge signs while preserving the network’s local structural consistency.
  • Label an unseen domain using a 51% majority rule over its known incoming edge signs.
Why it matters

Blacklists miss new threats, while feature-based classifiers can depend on labeled training data and brittle surface signals. SiNMULI provides a rule-based, interpretable decision path from hyperlink structure to each classification.

Architecture diagram

Signed-network identification flow

80,000 cleaned seed URLsOne-hop link crawlDirected signed graphTriad extractionBalance-based sign inference51% majority classification

Dataset and evaluation

A large, sparse real-world hyperlink graph.

Dataset context

The pipeline starts with 80,000 cleaned seed URLs, then crawls and canonicalizes their hyperlink relationships. The resulting directed graph contains 48,205 nodes and 384,592 edges, including 46,415 benign and 1,790 malicious labeled nodes.

Reported results

The paper reports 99.89% accuracy and a 99.80% F1-score, placing SiNMULI above the evaluated traditional machine-learning and deep-learning baselines while avoiding classifier training.

Scope and limitations

Strong structural signals depend on observable links.

Claimed strengths
  • Transparent decisions grounded in signed graph structure.
  • No learned model or retraining step for new domains.
  • Less dependence on easily obfuscated URL-string features.
  • Rule-based inference designed for sparse graph structure.
Current boundaries

Short-lived, crawler-blocking, JavaScript-heavy, or login-gated sites may expose too few links for reliable graph construction. The paper also identifies incremental, real-time graph updates as future work beyond the current offline pipeline.