|
Despite the variety of cybercrimes, malicious Uniform Resource Locators (URLs) remain one of the most common threats to cybersecurity and bring huge economic losses every year. How to detect malicious URLs accurately has attracted great interests from both academia and industry. However, few focus on the multiclass malicious URL attack type detection and existing methods cannot provide robust performance due to the diversity of obfuscation strategies. In this paper, we propose a capsule-based deep neural network for malicious URL detection and classification, using character-level information from the URL string sequences. To be specific, our method transforms an input URL into character-level embedding representation firstly, then passes it into the designed convolution module to extract local features of different sizes and the local features are fed into the designed capsule module to retain the spatial hierarchical relationship of the URL string, extract accurate feature representation and output the accurate classification result finally. The experimental results on a public dataset constructed by four different classes of URLs show that compared with other baseline methods, our capsule-based method can achieve better detection and classification results, with F1-score of benign URL, malware URL, defacement URL and phishing URL at 98.94%, 95.81%, 99.63% and 94.04%, respectively. Due to the excellent performance of our capsule-based method for the detection of malicious URLs, it could be deployed in the main-stream web browsers to identify URL attack types and intercept malicious URLs effectively to protect vulnerable users against cyberattacks.
|
