[Paper Review] eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys

Joshua Saxe, Konstantin Berlin|arXiv (Cornell University)|Feb 27, 2017

Network Security and Intrusion Detection116 citations

TL;DR

eXpose trains a character-level CNN with embeddings to detect malicious URLs, file paths, and registry keys directly from raw strings, outperforming manually engineered features at similar false positive rates.

ABSTRACT

For years security machine learning research has promised to obviate the need for signature based detection by automatically learning to detect indicators of attack. Unfortunately, this vision hasn't come to fruition: in fact, developing and maintaining today's security machine learning systems can require engineering resources that are comparable to that of signature-based detection systems, due in part to the need to develop and continuously tune the "features" these machine learning systems look at as attacks evolve. Deep learning, a subfield of machine learning, promises to change this by operating on raw input signals and automating the process of feature design and extraction. In this paper we propose the eXpose neural network, which uses a deep learning approach we have developed to take generic, raw short character strings as input (a common case for security inputs, which include artifacts like potentially malicious URLs, file paths, named pipes, named mutexes, and registry keys), and learns to simultaneously extract features and classify using character-level embeddings and convolutional neural network. In addition to completely automating the feature design and extraction process, eXpose outperforms manual feature extraction based baselines on all of the intrusion detection problems we tested it on, yielding a 5%-10% detection rate gain at 0.1% false positive rate compared to these baselines.

Motivation & Objective

• Motivate reducing manual feature engineering in security detectors by using deep learning on raw string inputs.
• Develop a unified model that can detect multiple artifact types (URLs, file paths, registry keys) with a single architecture.
• Demonstrate that learned character embeddings and convolutional features improve detection over baselines.
• Show that end-to-end training yields robust performance across diverse security artifacts.

Proposed method

• Embed input character sequences into s x m matrices using trainable character embeddings (s=200, m=32).
• Apply multiple 1D convolutions with kernel sizes k∈{2,3,4,5} and t=256 filters per event, then SumPool to obtain a fixed-length feature vector.
• Concatenate convolution outputs into a 1024-dimensional feature vector then pass through a two-layer dense network with a final DenseSigmoid for binary classification.
• Use layer-wise BatchNorm and Dropout (0.5, 0.2 for registry keys) for regularization during end-to-end training.
• Train with binary cross-entropy loss using Adam optimizer and maintain balanced batches (256 per batch with 128 malicious and 128 benign).
• Compare against baselines including n-gram features (with 1024-d hashed vectors) and an expert feature model for URLs.

Experimental results

Research questions

• RQ1 Can a character-level CNN with embeddings automatically learn discriminative features from raw artifact strings without hand-crafted features?
• RQ2 How does the eXpose architecture perform across malicious URLs, file paths, and registry keys compared to traditional n-gram or expert feature baselines?
• RQ3 Does end-to-end deep learning improve detection at deployment-relevant low false-positive rates across multiple security artifact types?
• RQ4 What is the impact of embedding dimensionality, string length handling, and regularization on performance?
• RQ5 Do learned character embeddings cluster semantically similar characters in a meaningful way across tasks?

Key findings

• eXpose outperforms manual feature baselines across all three problems (URLs, file paths, registry keys).
• At a false positive rate of 10^-3, eXpose achieves about 5%–10% higher detection rate than baselines.
• For URLs, eXpose substantially surpasses n-gram and expert feature baselines in AUC and low-FPR regions.
• For file paths and registry keys, eXpose improves detection over baselines though results are constrained by labeling challenges and data volume.
• Learned character embeddings cluster semantically similar characters, indicating meaningful representations.
• End-to-end CNN with embeddings effectively extracts discriminative features from raw strings, reducing the need for hand-crafted features.