[Paper Review] PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention network

Ruitong Liu, Yanbin Wang+5 more|arXiv (Cornell University)|Nov 21, 2023

Spam and Phishing Detection4 citations

TL;DR

This paper proposes PMANet, a pre-trained language model-guided multi-level feature attention network for malicious URL detection, leveraging CharBERT to extract hierarchical character-level embeddings, applying layer-aware attention for adaptive feature weighting, and using spatial pyramid pooling for multi-scale feature aggregation. The method achieves a peak accuracy improvement of 8.43% over state-of-the-art baselines on benchmark datasets.

ABSTRACT

The proliferation of malicious URLs has made their detection crucial for enhancing network security. While pre-trained language models offer promise, existing methods struggle with domain-specific adaptability, character-level information, and local-global encoding integration. To address these challenges, we propose PMANet, a pre-trained Language Model-Guided multi-level feature attention network. PMANet employs a post-training process with three self-supervised objectives: masked language modeling, noisy language modeling, and domain discrimination, effectively capturing subword and character-level information. It also includes a hierarchical representation module and a dynamic layer-wise attention mechanism for extracting features from low to high levels. Additionally, spatial pyramid pooling integrates local and global features. Experiments on diverse scenarios, including small-scale data, class imbalance, and adversarial attacks, demonstrate PMANet's superiority over state-of-the-art models, achieving a 0.9941 AUC and correctly detecting all 20 malicious URLs in a case study. Code and data are available at https://github.com/Alixyvtte/Malicious-URL-Detection-PMANet.

Motivation & Objective

• Address the growing challenge of deceptive, brand-spoofing phishing URLs that evade traditional detection methods.
• Overcome limitations of rule-based, heuristic, and blacklist-based systems that struggle with zero-day and evolving threats.
• Leverage deep learning and pre-trained language models to automate feature extraction and improve detection accuracy.
• Enhance model robustness and generalization across cross-dataset evaluation and adversarial attack scenarios.
• Develop an efficient, end-to-end framework requiring minimal manual feature engineering and computational resources.

Proposed method

• Utilizes CharBERT, a character-aware and subword-aware pre-trained language model, as the foundational encoder for URL representation.
• Employs a hierarchical feature extraction module that captures multi-level embeddings from different Transformer layers of CharBERT.
• Applies a layer-aware attention mechanism to dynamically assign importance weights to features across hierarchical levels.
• Integrates a spatial pyramid pooling module to perform multi-scale downsampling on the weighted feature pyramid, capturing both local and global patterns.
• Combines these components into an end-to-end trainable network that processes raw URL strings without manual preprocessing.
• Leverages transfer learning from CharBERT to enable fast convergence, achieving optimal performance in just 5 training epochs.

Experimental results

Research questions

• RQ1 Can a pre-trained language model like CharBERT be effectively leveraged to improve multi-level feature representation for malicious URL detection?
• RQ2 How does layer-aware attention enhance feature selection and model performance across hierarchical representations from a pre-trained model?
• RQ3 To what extent does spatial pyramid pooling improve the capture of local and global features in URL strings compared to standard pooling methods?
• RQ4 How does PMANet generalize across diverse datasets and resist adversarial attacks compared to existing state-of-the-art models?
• RQ5 Can the proposed architecture achieve high accuracy with minimal training epochs and low computational overhead, especially on resource-constrained hardware?

Key findings

• PMANet achieves a maximum accuracy gain of 8.43% over the previous state-of-the-art method on public benchmark datasets.
• In real-world case studies, PMANet correctly classified all 20 active phishing URLs from PhishTank, outperforming Grambeddings (75% accuracy) and URLNet (95% accuracy).
• The model demonstrates superior robustness in cross-dataset evaluation and adversarial attack scenarios, indicating strong generalization capability.
• Despite using a pre-trained model, PMANet achieves optimal performance within only 5 training epochs, significantly reducing training time compared to baseline methods.
• The model operates efficiently on a single GPU with over 20GB memory, making it practical for real-world deployment without extensive computational resources.
• The integration of layer-aware attention and spatial pyramid pooling enables effective noise filtering and salient feature learning, particularly improving detection of deceptive, hard-to-distinguish URLs.