Research Of Malicious URL Detection Based On Bidirectional Long Short-Term Memory And Convolutional Networks

With the rapid development of Internet technology,malicious URLs(Universal Resource Locator)have become one of the most common threats in the field of network security.A URL that is used in a cyber attack and has been modified or corrupted is known as a malicious URL,which often closely resembles the original URL,leaving the victim vulnerable to spoofing.Effective detection of malicious URLs can protect users’ personal information and property.However,traditional malicious URL detection methods rely too much on similarity matching rules and are no longer able to cope with the threat of malicious URLs.In this thesis,we analyse the current state of malicious URL attacks and detection,and in order to improve the accuracy and efficiency of malicious URL detection,the main work is as follows:(1)A malicious URL detection model,URLBi CNN,based on Bidirectional Long Short-Term Memory(Bi LSTM)and Parallel Convolutional Neural Networks(PCNN)is proposed.A word embedding method is used to obtain the character embedding matrix,which is used to initialize the parameters of the Embedding Layer,and the parameters of the Embedding Layer are updated as the network is trained to obtain a suitable vectorized representation of the URL.A Bi LSTM network is used to extract global features of URLs,which is combined with PCNN to extract different types of local features to enhance the model’s ability to extract URL features.Soft Pooling(Soft Pool)is used in the pooling layer to better retain the features of the input feature map,thus improving the accuracy of the model for malicious URL detection.(2)The parallel convolution layer of the URLBi CNN model is improved by adding an offset module to the convolution operation and changing the CNN to a Deformable Convolutional Network(DCNN).The improved model is called URLBi DCNN,and the convolutional kernel of DCNN can dynamically adjust the sampling position according to the output of the offset module,and the improved model has stronger generalization ability than the normal CNN.Compared with other detection models,the URLBi DCNN has higher detection accuracy and lower false alarm rate for malicious URL detection on three sampled data sets.(3)A malicious URL detection model,URLTrans DCNN,based on Transformer and parallel DCNN,is proposed,which combines the advantages of Transformer and DCNN and has higher detection accuracy and lower false alarm rate for malicious URL detection on three sampled datasets compared with other detection models.URLTrans DCNN and URLBi DCNN are comparable in detecting malicious URLs on the sampled dataset PBWD30000,but URLTrans DCNN detects URLs nearly 4.8 times faster than URLBi DCNN.After comparing with other malicious URL detection models,the accuracy of the proposed malicious URL detection model is higher and the false alarm rate is lower.The proposed model has a certain application value...