WMPA-ConvBERT-BM: A hybrid deep learning model optimized by whale-marine predator algorithm for IoT-enabled malicious URL detection

Abstract

The increasing prevalence of malicious Uniform Resource Locators (URLs) in Internet of Things (IoT) environments poses a significant threat to network security. To address this challenge, we propose WMPA-ConvBERT-BM, a novel hybrid deep learning architecture that integrates ConvBERT and a multi-head attention-enhanced bidirectional Gated Recurrent Unit to effectively capture both semantic and structural features from URLs. The model utilizes a dual embedding strategy combining word-level and character-level representations for enriched multi-granular input. Furthermore, we introduce a Whale-Marine Predator Algorithm (WMPA), a hybrid intelligent optimization algorithm designed to adaptively search for optimal learning rates during training, enhancing convergence and generalization. Comprehensive experiments conducted on a large-scale multi-class malicious URL dataset demonstrate that our model achieves state-of-the-art performance, attaining an accuracy of 97.6%, precision of 96.769%, recall of 97.344% and F1-score of 97.032%, outperforming existing baselines and optimization methods. Ablation studies validate the critical contributions of each component, and further comparisons show the superiority of WMPA over conventional intelligent optimization algorithms. Additionally, SHAP-based interpretability analysis reveals how integrated embeddings contribute to prediction decisions, offering transparency and insights into model behavior. Results show that our WMPA-ConvBERT-BM provides an effective and interpretable solution for robust malicious URL detection in IoT scenarios.