AQRACE: MACHINE-LEARNING-BASED DETECTION OF MALICIOUS URLS IN QR CODES FOR REAL-TIME SECURITY ASSESSMENT

The widespread use of Quick Response (QR) codes has increased exposure to QR-based phishing, malicious redirection, and malware distribution because users cannot readily inspect the destination before scanning. This study develops aQRace, a machine-learning-based QR code security application that analyses embedded Universal Resource Locators (URLs) before users access their destinations. The study combines URL-based feature extraction, comparative machine-learning evaluation, and operational system integration. URL characteristics covering structural, linguistic, technical, and advanced properties were extracted for classification. Four supervised machine-learning algorithms–XGBoost, Random Forest, Decision Tree, and Logistic Regression–were trained and evaluated using a balanced dataset of 14,000 URLs comprising 7,000 safe and 7,000 malicious samples. Model performance was compared using accuracy, precision, recall, and F1-score. XGBoost achieved the highest accuracy of 84% and precision of 0.80, whereas Random Forest achieved the highest recall of 0.95. Both models achieved an F1 Score of 0.84. XGBoost was selected for deployment based on its overall performance profile and integrated into a client-server application comprising a Flutter mobile frontend and Flask cloud backend. The application supports QR code image uploads and camera-based scanning, and performs URL processing, feature extraction, classification, and user warnings before destination access. Functional testing with representative safe and malicious QR codes confirmed the operation of the complete detection workflow. The findings demonstrate that conventional machine learning using URL-based features can support pre-access QR code security assessment while providing an operational alternative to increasingly complex deep learning approaches.

1. Alsawi, W., Ibrahim, D. M. QR Code-Based Access Control Systems: Architectural Taxonomy, Security Landscape, and Future Research Directions. International Journal of Advanced Computer Science and Applications, 17(4), (2026).

2. Njuguna, D., Ndia, J. Quick Response Code Security Attacks and Countermeasures: A Systematic Literature Review. Journal of Cybersecurity (2579-0072), 7(1), 1 (2025). https://doi.org/10.32604/ jcs.2025.059398

3. Trad, F., Chehab, A. Detecting quishing attacks with machine learning techniques through qr code analysis. IFIP International Conference on Artificial Intelligence Applications and Innovations, 194–206 (2026). https://doi.org/10.1007/978-3-032-30805-4_14

4. Vaithilingam, S., Shankar, S. a. M. Enhancing security in QR code technology using AI: Exploration and mitigation strategies. International Journal of Intelligence Science, 14(02), 49–57 (2024). https://doi.org/10.4236/ijis.2024.142003

5. Al-Zahrani, M. S., Wahsheh, H. A., Alsaade, F. W. Secure Real‐Time Artificial Intelligence System against Malicious QR Code Links. Security and Communication Networks, 2021(1), 5540670 (2021). https://doi.org/10.1155/2021/5540670

6. Sarkhi, M., Mishra, S. Detection of QR code-based cyberattacks using a lightweight deep learning model. Engineering, Technology & Applied Science Research, 14(4), 15209–15216 (2024). https://www.etasr.com/index.php/ETASR/article/view/7777/3803

7. Herlina, B., Soeparno, H. Machine learning model to improve classification performance in the process of detecting phishing URLs in QR codes. Journal of Theoretical and Applied Information Technology, 101(18), 5755–5765 (2023). http://www.jatit.org/volumes/Vol101No18/27Vol101No18.pdf

8. Pawar, A., Fatnani, C., Sonavane, R., Waghmare, R., Saoji, S. Secure qr code scanner to detect malicious url using machine learning. 2022 2nd Asian Conference on Innovation in Technology (ASIANCON), 1-8 (2022). https://doi.org/10.1109/ASIANCON55314.2022.9908759

9. Furqan, M., Katuk, N., Hartama, D. Multiclass Skin Lesion Classification Algorithm using AttentionBased Vision Transformer with Metadata Fusion. Journal of Applied Data Sciences, 7(1), 203–217 (2026). https://doi.org/10.47738/jads.v7i1.1017

10. Alsulami, A.-A., Al-Haija, Q.-A., Alturki, B., Yafoz, A., Alqahtani, A., Alsini, R., Binyamin, S.-S. Efficient Malicious QR Code Detection System Using an Advanced Deep Learning Approach. Computer Modeling in Engineering & Sciences, 145(1), 1117–1140 (2025). https://doi.org/10.32604/cmes.2025.070745

11. Tian, Y., Zhu, E. Incremental Phishing Defense Method Based on QR Code Decoding and Multimodal Deep Learning. Proceedings of the 2026 5th International Conference on Cryptography, Network Security and Communication Technology, 209–214 (2026). https://doi.org/10.1145/3802927.3802959

12. Fauzi, M. A., Yang, B., Hayati, Y. S., Setiawan, B. D., Sari, I. N., Bayona, J., Katuk, N., Dewi, D. A., Surasak, T. Hybrid GCN-LSTM for Privacy-Preserving Fall Detection in Human Pose-Based Elderly Monitoring Systems. Proceedings of the 14th International Conference on Advances in Information Technology, 1–8 (2026). https://doi.org/10.1145/3816713.3819508