ThreatLens AI
Malicious URL Detection · AI-Based Web Attack Detection & Classification
Risk score = 100 × (1 − P(benign)) from the URL neural network
Malicious URL Scanner
Classifies any URL as benign, phishing, malware or defacement, with a 0–100 risk score and the red flags behind it. Batch mode scans up to 100 URLs and exports CSV.
Web Attack Detector
Inspects an HTTP parameter or path and names the attack — SQL injection, XSS, command injection, path traversal or template injection — highlighting the exact characters that gave it away.
How it works
- 1
Input
A URL, or a raw HTTP payload — query string, form body or request path.
https://… · id=1' OR … - 2
Feature extraction
URLs → 30 lexical features (lengths, entropy, TLD, IP host, keywords) + 512 hashed char 3–5-grams. Payloads → URL-decoded, normalised, 1,024 hashed char n-grams + 8 handcrafted.
x ∈ ℝ³⁰ · x ∈ ℝ¹⁰³² - 3
Multi-layer perceptron
Two fully connected ReLU hidden layers of 64 and 32 neurons, then a softmax output layer over the classes.
relu(xW₁+b₁) → relu(·W₂+b₂) → softmax - 4
Classification + explanation
The most probable class, its confidence, all class probabilities, and human-readable indicators or highlighted spans.
label · p · indicators