Multi-View Representation Fusion for Malicious URL Classification
Working title, simplified until fully published. The description on this page accurately reflects the actual research, without disclosing implementation-level methodology.
This research compares multiple complementary representations, handcrafted lexical/structural features, text-based (TF-IDF) representations, and transformer-based (BERT) embeddings, for classifying malicious URLs, evaluated under a registrable-domain-disjoint protocol that prevents URLs from the same domain appearing across training and test partitions. A meta-level fusion approach that combines these representations achieved the strongest result among all approaches compared, with an F1 score above 0.91.
Malicious URLs are commonly used for phishing and malware delivery, and detecting them directly from the URL string offers a lightweight alternative to approaches that require retrieving the full webpage. Prior work has explored handcrafted lexical characteristics and, more recently, transformer-based language models for this task, but it remains unclear whether these different types of representation are genuinely complementary, or whether one simply dominates the others.
This research addresses that question directly, comparing several representation types, including handcrafted features, text-frequency-based representations, and transformer embeddings, both individually and in combination. Evaluation uses a registrable-domain-disjoint split, meaning URLs from the same domain never appear in both training and test data, which guards against a common source of inflated results in this research area.
The strongest individual representations performed closely to one another, and combining information across representations produced a further, smaller improvement, suggesting that while transformer-based representations capture most of the useful signal, there is still complementary information to be gained by fusing multiple views of the same URL.
Full methodology, results, and the underlying paper are not disclosed here, as this research is intended for conference submission and/or currently under review.