PaperlayerView exact revision on arXiv

Source-linked AI summary

URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection

Hung Le, Quang Pham, Doyen Sahoo, Steven C. H. Hoi

arXiv:1802.03162v2cs.CRcs.LG

TL;DR

Malicious URL detection must handle incomplete blacklists and conventional features that miss sequential patterns, require manual engineering, and struggle with unseen or rare words. URLNet learns URL embeddings directly by jointly applying CNNs to characters and words, using advanced word embeddings for rare and unseen words. Experiments on a large-scale dataset report significant performance gains over existing methods, with ablations evaluating its components.

  • Problem

    Conventional malicious URL detectors rely on Bag-of-Words and expert features that miss semantic or sequential patterns and struggle with unseen or rare URL words.

  • Method

    URLNet jointly applies character-level and word-level CNNs to URL strings and uses character-based advanced word embeddings.

  • Results

    URLNet offers a significant jump in AUC over baselines without expert or hand-designed features, while its Full variant generally outperforms the character- and word-level variants.

  • Takeaways & Limitations

    URLNet captures semantic and structural URL information while reducing reliance on manual features and supporting representations for unseen words.

  • Takeaways & Limitations

    Character-level CNNs do not exploit long component sequences, ignore word boundaries, and can struggle when malicious URLs make minor word-level modifications.

Abstract

from arXiv · show

Malicious URLs host unsolicited content and are used to perpetrate cybercrimes. It is imperative to detect them in a timely manner. Traditionally, this is done through the usage of blacklists, which cannot be exhaustive, and cannot detect newly generated malicious URLs. To address this, recent years have witnessed several efforts to perform Malicious URL Detection using Machine Learning. The most popular and scalable approaches use lexical properties of the URL string by extracting Bag-of-words like features, followed by applying machine learning models such as SVMs. There are also other features designed by experts to improve the prediction performance of the model. These approaches suffer from several limitations: (i) Inability to effectively capture semantic meaning and sequential patterns in URL strings; (ii) Requiring substantial manual feature engineering; and (iii) Inability to handle unseen features and generalize to test data. To address these challenges, we propose URLNet, an end-to-end deep learning framework to learn a nonlinear URL embedding for Malicious URL Detection directly from the URL. Specifically, we apply Convolutional Neural Networks to both characters and words of the URL String to learn the URL embedding in a jointly optimized framework. This approach allows the model to capture several types of semantic information, which was not possible by the existing models. We also propose advanced word-embeddings to solve the problem of too many rare words observed in this task. We conduct extensive experiments on a large-scale dataset and show a significant performance gain over existing methods. We also conduct ablation studies to evaluate the performance of various components of URLNet.

1 INTRODUCTION

URLNet addresses weaknesses in blacklist- and feature-based malicious URL detection by learning URL representations directly from characters and words with jointly optimized CNNs.

  • Blacklists are fast and expected to have low false-positive rates, but cannot exhaustively cover malicious URLs or newly generated URLs.New URLs are generated every day, making blacklist incompleteness a severe limitation.
  • Existing machine-learning detectors commonly extract URL representations before training prediction models, using lexical, host-based, content, context, or popularity features.
  • Bag-of-Words features do not effectively capture semantic or sequential patterns in URL strings.They indicate word presence but not the sequence of words or characters.
  • Traditional approaches require substantial expert-guided feature engineering and struggle with unseen words and very large URL vocabularies.Unseen test words may provide no useful information, while large vocabularies create severe memory constraints.
  • URLNet applies CNNs to both URL characters and words to learn a URL embedding for malicious URL detection.The character- and word-level representations are jointly optimized.
  • URLNet reduces reliance on expert features and improves generalization by learning semantic and sequential patterns from character and word embeddings.Character-based advanced word embeddings can represent unseen test words.

2 MALICIOUS URL DETECTION

The paper formulates malicious URL detection as binary classification and contrasts conventional lexical representations with URLNet's proposed solution.

  • The task is to classify each URL as malicious or benign using a learned prediction function.Malicious URLs receive label +1 and benign URLs receive label −1.
  • Deep-learning prediction functions are trained by minimizing a loss function, potentially including a regularizer, using a deep neural network.The supplied formulation identifies CNNs as one example of such a network.
  • Conventional lexical detection splits URLs into words, builds a dictionary from training data, and maps each URL to a Bag-of-Words vector.
  • Lexical features lack within-segment sequence information, cannot exploit substrings within words, and provide limited information from rare words.
  • URLNet is proposed to address these limitations.

3 URL NET

This section introduces URLNet as the paper's deep-learning framework for malicious URL detection and points readers to its network visualization.

  • URLNet is presented as a deep-learning framework for malicious URL detection, with the complete network visualized in Figure 1.

3.1 Deep Learning for Malicious URL Detection

URLNet uses CNNs at character and word levels to transform URL sequences into embeddings, extract local structural patterns, pool salient features, and classify URLs.

  • URLNet applies CNNs separately at character and word levels to learn structural information from URL representations.The component can be either a character or a word.
  • Each URL sequence is represented as a matrix of k-dimensional embeddings for L contiguous characters or words.The embeddings are randomly initialized and learned end-to-end with the model.
  • For parallelization, URL sequences are padded or truncated to a common length L.
  • A convolution applies a filter to each h-length input segment, followed by a nonlinear activation, producing local features.The filter output uses a predefined stride and includes a bias term.
  • The convolution outputs are concatenated, then pooling reduces feature dimensionality and identifies the most important features.Pooling may be max pooling or average pooling.
  • Multiple filter sets and convolution-pooling blocks can be stacked before pooled features are concatenated and passed to fully connected classification layers.The network can be trained with stochastic gradient descent and backpropagation.

3.2 Character-level CNN for Malicious URL Detection

The character-level CNN converts URLs into character embeddings and learns local sequential patterns with convolutional filters. It handles unseen URLs, but ignores word boundaries and may miss longer or minor word-level changes.

  • Character representation: Each URL is represented as a sequence of embedded characters, padded or truncated to 200 positions before convolution.Characters use learned 32-dimensional vectors, producing a 200 × 32 URL matrix.
  • Convolutional architecture: Convolutional filters spanning 3, 4, 5, and 6 characters learn temporal patterns, followed by max pooling and a dropout-regularized fully connected layer.The resulting representation is concatenated with other URLNet branches before the output layer.
  • Strengths and limitations: The character-level CNN learns structural patterns and can obtain embeddings for new test URLs without relying on unseen word representations.Its fixed character inventory also keeps model size fixed as data size grows.
  • Strengths and limitations: Character-level CNNs alone are insufficient because they ignore word boundaries, struggle with long component sequences, and may miss minor word-level modifications.URLs with similar character spellings can produce similar convolutional outputs even when word-level distinctions matter.
  • URLNet integration: URLNet combines the character-level CNN with a word-level CNN, whose word representation incorporates character information for each word.Figure 1 depicts these as two CNN branches.

3.3 Word-level CNN for Malicious URL Detection

The word-level CNN applies convolution over URL words while incorporating special characters and character-derived word embeddings. These additions address the large vocabulary, rare-word, unseen-word, and URL-specific delimiter challenges of basic word models.

  • Basic word-level CNN: Word-level CNNs apply convolutional operators over sequences of URL words using the same general CNN architecture as the character branch.URLs are represented with 32-dimensional word vectors and a uniform length of 200 words.
  • Basic word-level CNN: Basic word models replace rare words with a single <UNK> token to reduce embedding-matrix memory demands, also mapping unseen test words to <UNK>.This discards distinctions among rare and previously unseen words.
  • Special characters as words: Special characters are treated as unique words to retain their distribution, types, and the temporal relations between neighboring URL components.The paper motivates this choice because special characters are more frequent and contextually relevant in URLs than in ordinary natural language.
  • Improved word embedding: Character-level word embeddings combine each original word embedding with embeddings of its individual characters.Each word is padded or truncated to 20 characters, and the resulting character representation is summed before being added to the word representation.
  • Improved word embedding: The improved embedding gives rare words mostly unique representations during training and unique embeddings for new test words.It also reduces memory constraints and captures subword information.

3.4 Model Configuration

URLNet’s configuration processes raw URLs through character-level and word-level CNN branches, while the experiments compare its learned representations with lexical and expert-engineered baselines. The dataset analysis highlights the scale and rarity of URL words, which make conventional word-based features costly.

  • Model Configuration: URLNet processes each raw URL through character-level and word-level branches, with the word branch combining word embeddings and character-level word embeddings before convolution and fully connected layers.The two branches produce character-level and word-level representations that are jointly used by the model.
  • Large Scale Dataset: VirusTotal labels URLs using 64 blacklists, with URLs absent from all blacklists assumed benign.The corpus was collected from VirusTotal queries during May–June 2017 after duplicate removal and domain-frequency limiting.
  • Feature Extraction: Baseline feature extraction uses Whole URL Bag-of-Words plus expert-designed representations including URL Component Tokenization and Position Sensitive & Bigrams.These features divide URLs into components or encode token positions and bigrams to capture some sequential information.
  • Feature Extraction: Lexical feature counts become very large as training data grows, and word-based model size increases correspondingly.The comparison covers corpora of 1 million and 5 million URLs and includes basic, bigram, and character-trigram features.
  • Word-frequency Distribution: More than 90% of training-corpus words appear only once, making exhaustive storage and embedding learning computationally prohibitive.Rare words constitute most of the dictionary, creating memory constraints for large datasets.

4.2 Evaluation of URLNet

URLNet was evaluated against SVM baselines on 1-million- and 5-million-URL training corpora, with testing on 10 million URLs using AUC and TPR at different false-positive rates. Across the evaluation, URLNet variants outperform the baselines, while the full model combines complementary character- and word-level behavior.

  • Results: URLNet methods significantly outperform baseline methods across AUC and TPR@FPR metrics.The baselines use five lexical-feature configurations, while URLNet is evaluated in character-level, simple word-level, and full variants.
  • Results: URLNet provides a significant AUC gain over baselines without expert or hand-designed features.The reported comparison attributes the improvement to capturing semantic and structural URL information beyond bag-of-words features.
  • Results: URLNet(Full) generally performs better than its character-level and word-level components by combining both types of URL information.Word-level URLNet performs better at low FPRs, whereas Character-level URLNet performs better at higher FPRs; the full model is better except at FPR = 0.0001.
  • Results: Increasing training data from 1 million to 5 million URLs improves performance across all reported metrics.The evaluation uses AUC because of dataset imbalance and also compares true-positive rates at different false-positive rates.
  • Results: All URLNet variants outperform baselines in the AUC evaluation trained on 1 million and tested on 10 million URLs.URLNet(Full) is slightly worse than URLNet(Word-level) at FPR = 10^-4 but better otherwise, and consistently exceeds Character-level URLNet.

4.3 Ablation Analysis

The ablation analysis evaluates how special-character tokens and character-level word embeddings affect URLNet’s performance. Adding these components improves the word-level model’s AUC and produces steady gains in the full model, with a minor low-FPR trade-off.

  • Ablation Analysis: Treating special characters as words and adding character-level word embeddings improve the Word-Level URLNet AUC score.The improvement remains consistent across training-data sizes, although low-FPR TPR can decline slightly.
  • Ablation Analysis: URLNet(Full) shows steady AUC improvement as special-character words and character-level word embeddings are added incrementally.The full model exploits both character-level and word-level information and significantly outperforms the individual character- and word-based models.

4.4 Visualization

URLNet’s learned embeddings separate benign and malicious URLs more clearly than Character Trigrams while producing a substantially smaller feature vector. The visualization also reveals clusters associated with lexical patterns in URL components.

  • Embedding visualization: URLNet embeddings clearly separate benign and malicious URLs, with few malicious points overlapping benign ones.Most benign URLs occupy the left area and malicious URLs the right area, unlike the baseline embedding.
  • Embedding visualization: Character Trigrams produce less distinct class separation, with many benign and malicious URLs overlapping centrally.
  • Lexical-pattern clusters: The embeddings contain clusters associated with lexical patterns in primary domains, URL paths, and file extensions.The analysis uses marker types to identify these component-level patterns and refers to example URLs in Table 5.
  • Representation efficiency: URLNet’s feature vector is about 14 times smaller than the baseline vector for 2,000 URLs.The reduced dimensionality is presented as making the representation lightweight and more efficient for downstream processing and storage.

5 RELATED WORK

Prior malicious URL detection methods rely heavily on engineered feature representations, especially lexical features, but struggle with sequential structure, unseen words, scalability, and engineering cost. URLNet applies deep learning to learn representations directly from raw URL strings using character- and word-level information.

  • Feature representation: Machine-learning URL detection first converts URLs into feature vectors and then trains prediction models using those representations.Candidate features include lexical, host-based, content, context, and popularity information.
  • Feature representation: Lexical features are popular because they are directly obtainable, but Bag-of-Words and n-grams do not effectively capture sequential URL properties or unseen test words.
  • Feature representation: Advanced lexical features often require substantial expert engineering or fail to scale to millions of URLs.These constraints reduce their practical applicability.
  • Deep learning: Deep learning learns feature representations from raw or unstructured data end-to-end without hand-designed features.
  • Deep learning: URLNet extends limited prior deep-learning work by jointly using character-level and word-level information, including embeddings for rare and unseen words.The paper also emphasizes longer temporal patterns captured by word-level information and joint optimization of the full model.

6 CONCLUSION

URLNet is a jointly optimized CNN framework that learns malicious-URL representations from character and word information. Its advanced embeddings address rare and unseen words without expert features, while visualizations show stronger class separation than Character Trigrams.

  • Conclusion: URLNet jointly optimizes Character CNNs and Word CNNs to learn URL representations for malicious URL detection.
  • Conclusion: Advanced word embeddings handle rare words, unseen test words, and subword information without requiring expert features.
  • Conclusion: URLNet’s feature embeddings show clearer benign–malicious separation than Character Trigrams.The corresponding visualizations color-code URL classes and mark lexical patterns in domains, paths, and file extensions.
Loading 1802.03162v2…