Abstract:The expansion of the Internet has led to the widespread proliferation of malicious URLs, becoming a primary vector for cyber threats. Detecting malicious URLs is now essential for improving network security. The technological revolution spurred by pre-trained language models holds great promise for advancing the detection of malicious URLs. However, current research applying these models to URLs fails to address several crucial factors, including the lack of domain-specific adaptability, the omission of character-level information, and the neglect of both local detail extraction and low-order encoding information. In this paper, we propose PMANet, a pre-trained Language Model-Guided multi-level feature attention network, for addressing these issues. To facilitate a smooth transition of the pre-trained Transformer into the URL domain and to enable it to effectively capture information at both subword and character levels, we propose a post-training program that continues training the model on URLs using three self-supervised learning objectives: masked language model, noisy language model, and domain discrimination task. Subsequently, we develop a module to capture the output of each encoding layer, thus extracting hierarchical representations of URLs spanning from low-level to high-level. In addition, we propose a layer-wise attention mechanism that dynamically assigns weight coefficients to these feature layers based on their relevance. Finally, we apply spatial pyramid pooling to perform multi-scale down-sampling in order to obtain both local features and global context. PMANet achieves multifaceted integration in URL feature extraction, including capturing information at both the lexical and character levels, extracting features from low to high order, and discerning patterns at both global and local scales. We evaluate PMANet against challenging real-world scenarios, such as small-scale data, class imbalance, cross-dataset, adversarial attacks, and case studies on active malicious URLs. All experiments demonstrate that PMANet exhibits superiority over both the previous state-of-the-art pre-trained models and conventional deep learning models. Specifically, PMANet still achieves a 0.9941 AUC under adversarial attacks and correctly identifies all 20 actively malicious URLs in the case study. The code and data for our research are available at: https://github.com/Alixyvtte/Malicious-URL-Detection-PMANet.

A Joint Approach to Detect Malicious URL Based on Attention Mechanism.

LSTM Android Malicious Behavior Analysis Based on Feature Weighting

Malicious URL Detection Based on Improved Multilayer Recurrent Convolutional Neural Network Model

Malicious URL Detection via Pretrained Language Model Guided Multi-Level Feature Attention Network

A Malicious Domain Detection Model Based on Improved Deep Learning

Cascaded capsule twin attentional dilated convolutional network for malicious URL detection

Robust Detection of Malicious URLs with Self-Paced Wide & Deep Learning

A Malicious URL Detection Method Based on CNN

A Hybrid Deep Learning Model for Malicious Behavior Detection

A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion

Research on phishing webpage detection technology based on CNN-BiLSTM algorithm

CNN-MHSA: A Convolutional Neural Network and multi-head self-attention combined approach for detecting phishing websites.

Phishing Websites Detection Via CNN and Multi-Head Self-Attention on Imbalanced Datasets

Detecting Malicious Web Requests Using an Enhanced TextCNN.

An intelligent identification and classification system for malicious uniform resource locators (URLs)

Hybrid Malware Classification Method Using Segmentation-Based Fractal Texture Analysis and Deep Convolution Neural Network Features

Hybrid Deep Learning Approach Based on LSTM and CNN for Malware Detection

Malicious Code Variant Identification Based on Multiscale Feature Fusion CNNs

Malicious URL Detection using Machine Learning: A Survey

TransURL: Improving Malicious URL Detection with Multi-Layer Transformer Encoding and Multi-Scale Pyramid Features

PMANet: Malicious URL Detection Via Post-Trained Language Model Guided Multi-Level Feature Attention Network