Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

IP-Augmented Multi-Modal Malicious URL Detection Via Token-Contrastive Representation Enhancement and Multi-Granularity Fusion

Ye Tian, Yanqiu Yu, Liangliang Song, Zhiquan Liu, Yanbin Wang, Jianguo Sun

TL;DR

CURL-IP tackles malicious URL detection by fusing URL content with IP-context signals through a token-aware Transformer (TACL-BERT), a cross-layer multi-scale aggregator (CLMSA), and a blockwise multimodal coupler (BMMC). The approach preserves fine-grained lexical cues, models hierarchical semantic structure, and enables fine-grained cross-modal interactions to enhance robustness against obfuscation and adversarial perturbations. Across binary and multi-class tasks, with adversarial testing and real-world validation, CURL-IP achieves state-of-the-art performance in F1 and AUC and demonstrates strong resilience to evasion tactics. The framework offers practical deployment advantages, including efficiency and compatibility with production security stacks, indicating strong potential for real-world cybersecurity deployments.

Abstract

Malicious URL detection remains a critical cybersecurity challenge as adversaries increasingly employ sophisticated evasion techniques including obfuscation, character-level perturbations, and adversarial attacks. Although pre-trained language models (PLMs) like BERT have shown potential for URL analysis tasks, three limitations persist in current implementations: (1) inability to effectively model the non-natural hierarchical structure of URLs, (2) insufficient sensitivity to character-level obfuscation, and (3) lack of mechanisms to incorporate auxiliary network-level signals such as IP addresses-all essential for robust detection. To address these challenges, we propose CURL-IP, an advanced multi-modal detection framework incorporating three key innovations: (1) Token-Contrastive Representation Enhancer, which enhances subword token representations through token-aware contrastive learning to produce more discriminative and isotropic embeddings; (2) Cross-Layer Multi-Scale Aggregator, employing hierarchical aggregation of Transformer outputs via convolutional operations and gated MLPs to capture both local and global semantic patterns across layers; and (3) Blockwise Multi-Modal Coupler that decomposes URL-IP features into localized block units and computes cross-modal attention weights at the block level, enabling fine-grained inter-modal interaction. This architecture enables simultaneous preservation of fine-grained lexical cues, contextual semantics, and integration of network-level signals. Our evaluation on large-scale real-world datasets shows the framework significantly outperforms state-of-the-art baselines across binary and multi-class classification tasks.

IP-Augmented Multi-Modal Malicious URL Detection Via Token-Contrastive Representation Enhancement and Multi-Granularity Fusion

TL;DR

CURL-IP tackles malicious URL detection by fusing URL content with IP-context signals through a token-aware Transformer (TACL-BERT), a cross-layer multi-scale aggregator (CLMSA), and a blockwise multimodal coupler (BMMC). The approach preserves fine-grained lexical cues, models hierarchical semantic structure, and enables fine-grained cross-modal interactions to enhance robustness against obfuscation and adversarial perturbations. Across binary and multi-class tasks, with adversarial testing and real-world validation, CURL-IP achieves state-of-the-art performance in F1 and AUC and demonstrates strong resilience to evasion tactics. The framework offers practical deployment advantages, including efficiency and compatibility with production security stacks, indicating strong potential for real-world cybersecurity deployments.

Abstract

Malicious URL detection remains a critical cybersecurity challenge as adversaries increasingly employ sophisticated evasion techniques including obfuscation, character-level perturbations, and adversarial attacks. Although pre-trained language models (PLMs) like BERT have shown potential for URL analysis tasks, three limitations persist in current implementations: (1) inability to effectively model the non-natural hierarchical structure of URLs, (2) insufficient sensitivity to character-level obfuscation, and (3) lack of mechanisms to incorporate auxiliary network-level signals such as IP addresses-all essential for robust detection. To address these challenges, we propose CURL-IP, an advanced multi-modal detection framework incorporating three key innovations: (1) Token-Contrastive Representation Enhancer, which enhances subword token representations through token-aware contrastive learning to produce more discriminative and isotropic embeddings; (2) Cross-Layer Multi-Scale Aggregator, employing hierarchical aggregation of Transformer outputs via convolutional operations and gated MLPs to capture both local and global semantic patterns across layers; and (3) Blockwise Multi-Modal Coupler that decomposes URL-IP features into localized block units and computes cross-modal attention weights at the block level, enabling fine-grained inter-modal interaction. This architecture enables simultaneous preservation of fine-grained lexical cues, contextual semantics, and integration of network-level signals. Our evaluation on large-scale real-world datasets shows the framework significantly outperforms state-of-the-art baselines across binary and multi-class classification tasks.
Paper Structure (26 sections, 24 equations, 4 figures, 7 tables)

This paper contains 26 sections, 24 equations, 4 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Character-aware Methods
  4. Transformer-based Methods
  5. Dataset
  6. Methodology
  7. Backbone Network: TACL-BERT
  8. CLMSA Module
  9. IP Embedding
  10. BMMC Module
  11. Experiments
  12. Setup
  13. Experimental Infrastructure
  14. Baseline Methods
  15. Evaluation Metrics
  16. ...and 11 more sections

Figures (4)

  • Figure 1: Example of URL
  • Figure 2: Architecture: Composed of Three Core Modules. TACL-BERT serves as the backbone encoder for token-aware subword representations; CLMSA hierarchically aggregates multi-layer features through convolution and gated MLPs; BMMC performs structured multi-scale attention fusion across URL and IP modalities.
  • Figure 3: Model performance comparison across different training dataset sizes.
  • Figure 4: Detection results comparison of baseline methods and our proposed approach on multi-class dataset.