[Paper Review] URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection

H Le, Quang Pham+2 more|arXiv (Cornell University)|Feb 9, 2018

Spam and Phishing Detection34 references193 citations

TL;DR

URLNet use dual CNN branches on characters and words (with advanced word embeddings) to learn a robust URL representation for detecting malicious URLs, outperforming traditional lexical-feature baselines and handling unseen/rare words effectively.

ABSTRACT

Malicious URLs host unsolicited content and are used to perpetrate cybercrimes. It is imperative to detect them in a timely manner. Traditionally, this is done through the usage of blacklists, which cannot be exhaustive, and cannot detect newly generated malicious URLs. To address this, recent years have witnessed several efforts to perform Malicious URL Detection using Machine Learning. The most popular and scalable approaches use lexical properties of the URL string by extracting Bag-of-words like features, followed by applying machine learning models such as SVMs. There are also other features designed by experts to improve the prediction performance of the model. These approaches suffer from several limitations: (i) Inability to effectively capture semantic meaning and sequential patterns in URL strings; (ii) Requiring substantial manual feature engineering; and (iii) Inability to handle unseen features and generalize to test data. To address these challenges, we propose URLNet, an end-to-end deep learning framework to learn a nonlinear URL embedding for Malicious URL Detection directly from the URL. Specifically, we apply Convolutional Neural Networks to both characters and words of the URL String to learn the URL embedding in a jointly optimized framework. This approach allows the model to capture several types of semantic information, which was not possible by the existing models. We also propose advanced word-embeddings to solve the problem of too many rare words observed in this task. We conduct extensive experiments on a large-scale dataset and show a significant performance gain over existing methods. We also conduct ablation studies to evaluate the performance of various components of URLNet.

Motivation & Objective

• Motivate robust malicious URL detection beyond blacklists and hand-engineered lexical features.
• Propose an end-to-end deep learning model that learns URL embeddings directly from raw URL strings.
• Capture semantic and sequential patterns in URLs via character-level and word-level CNNs with advanced word embeddings.
• Address issues of rare/ unseen words and memory constraints in large-scale URL datasets.
• Evaluate URLNet against strong lexical baselines and perform ablation studies to understand component contributions.

Proposed method

• Introduce URLNet with two CNN branches: character-level and word-level representations of URLs.
• Use multiple filter sizes (h in {3,4,5,6}) with 256 filters per size for both branches.
• For words, employ an advanced embedding that combines word-level and character-level information to handle rare and unseen words.
• Incorporate special characters as words to capture additional sequential information.
• Train end-to-end with dropout and Adam optimizer, concatenating branch outputs before final dense layers.

Experimental results

Research questions

• RQ1 Can URLNet outperform traditional Bag-of-Words-based lexical features and handcrafted lexical baselines for malicious URL detection?
• RQ2 How do character-level, word-level, and full URLNet variants compare, and what is the contribution of the combined (URLNet Full) model?
• RQ3 Does the model generalize to unseen/rare words through character-based word embeddings and special-character handling?
• RQ4 What is the impact of training data size on URLNet performance, and how do different feature architectures contribute to robustness?

Key findings

• URLNet variants significantly outperform baseline lexical feature models in AUC and TPR@FPR across metrics.
• Combining character- and word-level CNNs (URLNet Full) yields the strongest and most consistent performance advantages.
• Character-level and word-level CNNs offer complementary strengths, with the Full model leveraging both to improve detection at various FPRs.
• Using advanced word embeddings that integrate character information helps address memory constraints and enables handling unseen words.
• Increasing training data from 1M to 5M URLs improves performance across metrics.
• Character-level CNNs are good at recognizing patterns in long sequences, while word-level CNNs capture token-level semantics; their combination outperforms each individually.