Abstract:The expansion of the Internet has led to the widespread proliferation of malicious URLs, becoming a primary vector for cyber threats. Detecting malicious URLs is now essential for improving network security. The technological revolution spurred by pre-trained language models holds great promise for advancing the detection of malicious URLs. However, current research applying these models to URLs fails to address several crucial factors, including the lack of domain-specific adaptability, the omission of character-level information, and the neglect of both local detail extraction and low-order encoding information. In this paper, we propose PMANet, a pre-trained Language Model-Guided multi-level feature attention network, for addressing these issues. To facilitate a smooth transition of the pre-trained Transformer into the URL domain and to enable it to effectively capture information at both subword and character levels, we propose a post-training program that continues training the model on URLs using three self-supervised learning objectives: masked language model, noisy language model, and domain discrimination task. Subsequently, we develop a module to capture the output of each encoding layer, thus extracting hierarchical representations of URLs spanning from low-level to high-level. In addition, we propose a layer-wise attention mechanism that dynamically assigns weight coefficients to these feature layers based on their relevance. Finally, we apply spatial pyramid pooling to perform multi-scale down-sampling in order to obtain both local features and global context. PMANet achieves multifaceted integration in URL feature extraction, including capturing information at both the lexical and character levels, extracting features from low to high order, and discerning patterns at both global and local scales. We evaluate PMANet against challenging real-world scenarios, such as small-scale data, class imbalance, cross-dataset, adversarial attacks, and case studies on active malicious URLs. All experiments demonstrate that PMANet exhibits superiority over both the previous state-of-the-art pre-trained models and conventional deep learning models. Specifically, PMANet still achieves a 0.9941 AUC under adversarial attacks and correctly identifies all 20 actively malicious URLs in the case study. The code and data for our research are available at: https://github.com/Alixyvtte/Malicious-URL-Detection-PMANet.

Multiclass Malicious URL Attack Type Detection Via Capsule-Based Neural Network

Cascaded capsule twin attentional dilated convolutional network for malicious URL detection

Towards Fighting Cybercrime: Malicious URL Attack Type Detection using Multiclass Classification

Malicious URL Detection Based on Improved Multilayer Recurrent Convolutional Neural Network Model

A Malware Classification Method Based on the Capsule Network

An intelligent identification and classification system for malicious uniform resource locators (URLs)

Improved Capsule Networks Based on Nash Equilibrium for Malicious Code Classification

Robust Detection of Malicious URLs with Self-Paced Wide & Deep Learning

Malicious URL Detection via Pretrained Language Model Guided Multi-Level Feature Attention Network

A Malicious URL Detection Method Based on CNN

An ensemble classification method based on machine learning models for malicious Uniform Resource Locators (URL)

TransURL: Improving Malicious URL Detection with Multi-Layer Transformer Encoding and Multi-Scale Pyramid Features

PMANet: Malicious URL Detection Via Post-Trained Language Model Guided Multi-Level Feature Attention Network

TransURL

Malicious URL Detection Based on Associative Classification

FACILE: A capsule network with fewer capsules and richer hierarchical information for malware image classification

Visual Intrusion Detection Based On CBAM-Capsule Networks

CNN-MHSA: A Convolutional Neural Network and multi-head self-attention combined approach for detecting phishing websites.

Random CapsNet Forest Model for Imbalanced Malware Type Classification Task

Detecting Malicious Web Requests Using an Enhanced TextCNN.

Malicious URL Detection using Machine Learning: A Survey