About ThreatLens AI
Abstract
Malicious URLs — phishing pages, malware droppers and defaced sites — are the most common way attacks reach users, and web-application attacks such as SQL injection and cross-site scripting remain at the top of the OWASP Top 10. Blocklists and hand-written signatures miss new domains and obfuscated payloads the moment attackers change a character.
ThreatLens AI treats both problems as supervised classification and solves them with multi-layer perceptron neural networks. A URL is described by 30 lexical features (length, entropy, suspicious TLDs and keywords, IP hosts, ports, brand names…) plus 512 hashed character 3–5-grams. An HTTP payload is URL-decoded, normalised and turned into 1,024 hashed character n-grams plus 8 handcrafted features. Each vector passes through two ReLU hidden layers (64 → 32 neurons) and a softmax output layer.
Neural networks learn non-linear combinations of weak signals — a long host and a brand name and a .tk domain — that rules and linear models struggle to capture, and character n-grams let the attack model generalise to encodings and spacing it never saw. The trained weights are exported to JSON and run by a TypeScript inference engine, so every prediction is served in milliseconds with no Python at runtime.
Datasets
- Malicious URLs dataset (Kaggle)Model A
651,191 real URLs labelled benign, phishing, malware or defacement (malicious_phish.csv); 60,000-row stratified sample used.
- HttpParamsDataset (GitHub)Model B
31,067 real HTTP parameter values labelled normal, SQLi, XSS, command injection or path traversal.