CNN-Based URL Phishing Detection in Virtual Private Network Architecture

Brawijaya University is actively advancing cybersecurity through its currently ongoing project, “Implementation of Convolutional Neural Networks for URL-Based Phishing Detection in Virtual Private Network Architecture.” Led by Ari Kusyanti and Fariz Andri Bakhtiar, the project aims to strengthen VPN security by detecting malicious URLs before they reach users.

Phishing attacks commonly use deceptive URLs to steal login credentials, financial information, and other sensitive data. Conventional blacklist and rule-based systems are often unable to detect newly created phishing URLs because they depend on previously recorded threats. To address this limitation, the research integrates a Convolutional Neural Network (CNN) into the VPN gateway for real-time URL classification.

An Intelligent Security Layer for VPN

VPNs protect network traffic through encryption, authentication, and secure tunneling. However, they do not automatically prevent users from accessing phishing websites. This research introduces an additional detection layer within the VPN architecture.

When a user accesses a website through the VPN, the system analyzes the available domain or URL information. A Redis cache first checks whether the URL has already been classified. New URLs are then processed by the CNN model and classified as phishing or legitimate. Based on the result, the gateway can allow or block the connection.

Key Research Components

Character-Level URL Analysis

The system analyzes URLs based on their character patterns rather than relying entirely on blacklists or manually designed features. URL data is collected from Kaggle to train the CNN method, Common Crawl for legitimate addresses, and additional URLs observed during the experiment.

Each URL is normalized, converted into a fixed-length character representation, and prepared for CNN processing. This approach allows the model to identify suspicious lexical patterns commonly found in phishing URLs without analyzing the full content of the website.

Lightweight CNN Classification

The proposed model consists of character-based representation, convolutional layers, max-pooling, dropout, and a fully connected layer for binary classification. The convolutional layers automatically identify relevant patterns in URL strings, while dropout helps prevent overfitting.

Because the model will operate inside a VPN gateway, it is designed to remain lightweight and responsive. The research targets an accuracy of at least 95 percent, an F1-score of at least 0.95, a model size below 600 KB, and classification latency of no more than 10 milliseconds per URL.

Adaptation to New Phishing Threats

The system is also designed to identify previously unseen phishing URLs by learning structural patterns instead of memorizing a fixed list of malicious addresses. Its effectiveness will be tested using new phishing samples that are not included in the original training dataset.

A periodic retraining mechanism will incorporate newly verified URLs from sources such as PhishTank and VPN server logs. This process enables the model to adapt to evolving phishing techniques without requiring major changes to the VPN architecture.

Supporting Safer Digital Communication

This project combines artificial intelligence and network security to extend the role of VPNs beyond encrypted communication. By detecting suspicious URLs at the gateway level, the proposed system may help reduce credential theft, financial fraud, and exposure of personal data.

The research is expected to produce a trained CNN model, a real-time VPN-integrated phishing detection prototype, technical documentation, and an academic publication. Its results may provide a foundation for developing adaptive and lightweight cybersecurity systems for organizations and individuals that rely on VPN infrastructure.