Malicious URL detection method based on fusion of character-level language model and structural features

Abstract

The present invention discloses a malicious URL detection method based on the fusion of a character-level language model and structural features, comprising: using a character-level language model to obtain character-level URL semantic features; feeding the URL semantic features into an expanding pyramid attention algorithm for semantic enhancement to obtain enhanced character-level URL semantic features; extracting the structural features of the URL string to obtain URL structural features; dynamically weightedly fusing the URL structural features with the enhanced character-level URL semantic features, and outputting a malicious URL judgment result through a classifier. Through character-level semantic understanding, the method breaks away from a predefined vocabulary and improves its adaptability to random characters appearing in URLs. Simultaneously, the integration of URL structural features further enhances the model's recognition performance for malicious URLs.

Description

Technical Field

[0001] The present invention belongs to the technical field of malicious URL detection, and the present invention relates to a malicious URL detection method based on the fusion of a character-level language model and structural features. Background Art

[0002] Malicious URL detection is a crucial component of network security, aiming to identify and intercept potential threats. It plays a crucial role in protecting user privacy. Malicious URLs are often used to carry out attacks such as phishing and information theft. Therefore, detecting them is crucial for building a secure and trustworthy network environment.

[0003] Currently, there are three main approaches to detecting malicious websites: blacklist and whitelist databases, machine learning (ML) algorithms, and deep learning (DL) technology. Early approaches primarily relied on blacklist mechanisms and rule-based feature engineering. While simple to implement and highly efficient, they often struggled to cope with the rapidly evolving characteristics of new or variant malicious URLs, resulting in limited detection effectiveness.

[0004] Detection methods based on machine learning have improved the level of intelligence to a certain extent, but most of them still rely on manual extraction of URL features, which is not only time-consuming and labor-intensive, but also performs poorly when faced with malicious URLs with complex structures and frequent changes.

[0005] In recent years, the rapid development of pre-trained language models (such as BERT and GPT) has demonstrated powerful capabilities in semantic understanding and feature representation, opening up new avenues for malicious URL detection. Researchers have begun applying these models to URL detection to mine the deep semantic information contained in URLs, and have achieved initial success. However, existing methods generally focus on semantic modeling, ignoring the structural characteristics of URLs themselves, and failing to effectively integrate structural and semantic information.

[0006] Furthermore, pre-trained language models rely heavily on predefined vocabularies, and URLs often contain a large number of random characters. Traditional word segmentation methods struggle to capture their fine-grained semantics, resulting in poor performance when dealing with out-of-scope (OOV) words or new malicious URLs. This limitation significantly hinders the model's detection effectiveness in real-world applications. Summary of the Invention

[0007] The purpose of the present invention is to provide a malicious URL detection method based on the fusion of character-level language models and structural features. Through character-level semantic understanding, it breaks away from the predefined vocabulary library and improves the adaptability to random characters appearing in URLs. At the same time, it integrates the structural features of URLs to further improve the model's recognition performance for malicious URLs.

[0008] The technical solutions for achieving the purpose of the present invention are:

[0009] A malicious URL detection method based on the fusion of character-level language model and structural features includes the following steps:

[0010] S01: Use character-level language model to obtain character-level URL semantic features;

[0011] S02: Send the URL semantic features to the expanded pyramid attention for semantic enhancement to obtain the enhanced character-level URL semantic features;

[0012] S03: extracting the structural features of the URL character string to obtain the URL structural features;

[0013] S04: Dynamically weight the URL structure features and the enhanced character-level URL semantic features, and output the malicious URL judgment results through the classifier.

[0014] In the preferred technical solution, step S01 also includes segmenting each URL string according to special symbols and alphanumeric characters, adding special marks at the beginning and end, converting each segmentation and special mark into a character-level index representation of a fixed length, filling in the insufficient parts, and the overall character-level index of the URL is composed of all segmentation indexes as model input.

[0015] In the preferred technical solution, step S01 further includes:

[0016] Character CNN is used to replace the word embedding layer to generate a unified representation at the character level. Character CNN extracts character-level features through the Character CNN and Highway network to generate character-level embeddings. Character CNN includes a character embedding layer, a convolutional feature extractor, a Highway network, and a projection layer.

[0017] The character embedding layer is used to map characters into fixed-length vectors;

[0018] The convolutional feature extractor includes multiple one-dimensional convolution kernels to extract sequences of n consecutive characters at the character level. Multiple convolution kernels of different sizes are applied in parallel to the character sequence to obtain different fine-grained information in the short text. The output of each CNN is max-pooled in the character sequence and concatenated with other CNN outputs to produce a single representation.

[0019] Highway network is used to filter information from CNN representations;

[0020] The projection layer is used for dimension conversion.

[0021] The preferred technical solution also includes:

[0022] Combine character-level word embeddings with position embeddings and segment embeddings, and generate the final text representation that combines BERT and character-level embeddings after normalization and regularization;

[0023] After the embedding is processed by multiple layers of Transformer encoders and pooling layers, it finally outputs 12 hidden layers. The hidden states in these layers include both the representation of each token and the pooling results at the sentence level.

[0024] In the preferred technical solution, step S02 of expanding the pyramid attention includes depthwise separable convolution and spatial pyramid attention;

[0025] For input features Apply a single depth-wise separable convolution to extract common information from each branch :

[0026] ;

[0027] in, Denotes a depth-wise separable convolution operation, and performs extended depth-wise separable convolution operations with different expansion rates on different branches to obtain the first The output features of each branch :

[0028] ;

[0029] in, Indicates that the branch The extended depth-wise separable convolution operation is performed at is the number of branches, and context information from different scales is connected using residual connections, namely:

[0030] ;

[0031] Adopting element summation strategy optimization, the aggregation features are refined through 1x1 convolution operation:

[0032] ;

[0033] Represents the standard convolution operation that fuses contextual information of different scales, the original feature map Integration is performed through a residual connection mechanism, using different dilation rates to capture multi-scale contextual information;

[0034] Spatial pyramid attention consists of point-by-point convolution, spatial pyramid structure, and multi-layer perceptron. Point-by-point convolution is used to integrate information and align channels; the spatial pyramid structure integrates adaptive average pooling at multiple scales to enhance feature integration and regularization; the multi-layer perceptron generates an attention map to provide key spatial information;

[0035] The attention mechanism extracts attention weights from the input data and multiplies them with learnable weights of each channel to generate output, spatial pyramid structure The output expression is as follows:

[0036] ;

[0037] For the connection operation, Reshape the tensor, is the adaptive average pooling, is the feature map output by depth-wise separable convolution;

[0038] Omit batch normalization and activation layers, basic transformation As shown below:

[0039] ;

[0040] is the fully connected layer, is the Sigmoid activation function;

[0041] At the end of the network, the weighted feature map is mean pooled along the fixed sequence length dimension to extract a representative feature vector.

[0042] In the preferred technical solution, the method of extracting the structural features of the URL string in step S03 includes:

[0043] Use the tld library to parse the URL, extract its structural components, and count the structural feature information. The structural features include the total length of the URL, the number of special characters, whether it contains sensitive words, the number of top-level domains, and the number of subdomains. These features are combined into a URL structural feature list.

[0044] In the preferred technical solution, the method of dynamic weighted fusion in step S04 includes:

[0045] S41: Project the two eigenvectors into the same dimensional space:

[0046] ;

[0047]

[0048] in, and is the projection matrix, and is the bias term, is the semantic feature vector, is the URL structure feature vector.

[0049] S42: Calculate gate weights :

[0050] ;

[0051] in, is the Sigmoid activation function;

[0052] S43: Use gated weights to perform weighted fusion of two feature vectors:

[0053] ;

[0054] in, represents element-wise multiplication;

[0055] S44: Generate the fused feature vector through a fully connected layer:

[0056] ;

[0057] in, and are the weights and biases of the fully connected layers.

[0058] In the preferred technical solution, after obtaining the URL structural features in step S03, the step further includes performing dimensionality-upgrading processing on the obtained URL structural features through a linear layer so that the dimensions thereof are consistent with the dimensions of the semantic features.

[0059] The present invention also discloses a malicious URL detection system based on the fusion of character-level language model and structural features, comprising:

[0060] Semantic feature extraction module, which uses character-level language model to obtain character-level URL semantic features;

[0061] The highly fine-grained semantic module feeds URL semantic features into the dilated pyramid attention for semantic enhancement, obtaining enhanced character-level URL semantic features.

[0062] The structural feature extraction module extracts the structural features of the URL string to obtain the URL structural features;

[0063] The fusion judgment module dynamically weights and fuses the URL structure features with the enhanced character-level URL semantic features, and outputs the malicious URL judgment results through the classifier.

[0064] The present invention further discloses a computer storage medium on which a computer program is stored. When the computer program is executed, the malicious URL detection method based on the fusion of character-level language model and structural features is implemented.

[0065] Compared with the prior art, the present invention has the following significant advantages:

[0066] 1. No need to rely on predefined vocabulary, enhancing character-level semantic perception capabilities

[0067] Compared with traditional models such as BERT that rely on WordPiece, this invention uses a character-level convolutional network (CharacterCNN) to replace the word embedding module, completely breaking away from the vocabulary restrictions. It can directly process raw URL strings containing random characters and introduces a multi-scale attention mechanism to enhance semantic modeling, significantly improving the ability to detect malicious URLs.

[0068] 2. Fully explore the internal semantics and structural patterns of URLs to improve detection accuracy

[0069] The present invention integrates the structural feature information of the URL (such as length, number of subdomains, whether it contains sensitive words, etc.) with the character-level semantic vector, and dynamically learns the fusion strategy through an innovative gating mechanism to achieve "structure + semantics" joint representation modeling, effectively alleviating the misjudgment problem caused by incomplete semantic features or missing structural information. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 This is a flowchart of the malicious URL detection method based on the fusion of character-level language model and structural features in this embodiment;

[0071] Figure 2 This is a diagram showing the overall structure of the model of the malicious URL detection method based on the fusion of character-level language model and structural features in this embodiment;

[0072] Figure 3 This is a model flow chart of the malicious URL detection method based on the fusion of character-level language model and structural features in this embodiment;

[0073] Figure 4 This is the difference between CharacterBERT and BERT in this embodiment;

[0074] Figure 5 This is the CharacterBERT flow chart of this embodiment. DETAILED DESCRIPTION

[0075] Principle of the invention: Construct a multi-feature malicious URL detection framework with a character-level language model as the semantic backbone, structural URL features as the supplementary information source, and a fusion mechanism as the connecting bridge;

[0076] The described architecture is applicable to any character-level encoder and context modeling module that can output embedding vectors, as well as the multi-scale feature enhancement module.

[0077] Example 1:

[0078] like Figure 1 As shown in FIG, a malicious URL detection method based on the fusion of character-level language model and structural features includes the following steps:

[0079] S01: Use character-level language model to obtain character-level URL semantic features;

[0080] S02: Send the URL semantic features to the expanded pyramid attention for semantic enhancement to obtain the enhanced character-level URL semantic features;

[0081] S03: extracting the structural features of the URL character string to obtain the URL structural features;

[0082] S04: Dynamically weight the URL structure features and the enhanced character-level URL semantic features, and output the malicious URL judgment results through the classifier.

[0083] Another embodiment, a malicious URL detection system based on the fusion of character-level language model and structural features, includes:

[0084] Semantic feature extraction module, which uses character-level language model to obtain character-level URL semantic features;

[0085] The highly fine-grained semantic module feeds URL semantic features into the dilated pyramid attention for semantic enhancement, obtaining enhanced character-level URL semantic features.

[0086] The structural feature extraction module extracts the structural features of the URL string to obtain the URL structural features;

[0087] The fusion judgment module dynamically weights and fuses the URL structure features with the enhanced character-level URL semantic features, and outputs the malicious URL judgment results through the classifier.

[0088] Specifically, the character-level language model is explained using CharacterBERT as an example. The entire model consists of the following components: Figure 2 Shown, including:

[0089] 1) Data preprocessing module

[0090] Used to perform preliminary word segmentation and structural information extraction on the original URL input, including:

[0091] Symbol segmentation and token segmentation (e.g., splitting www.baidu.com into ['www','.','baidu','.','com']);

[0092] Structural indicators such as URL length, number of subdomains, and whether it contains sensitive words are extracted to form a structural feature vector.

[0093] 2) Character-level encoding module (CharacterCNN)

[0094] Each token is mapped to a character ID, and character n-gram patterns are extracted through multiple sets of convolution kernels to obtain token-level character embedding representations.

[0095] 3) CharacterBERT module

[0096] The difference from traditional BERT is that CharacterBERT uses CharacterCNN to replace the word embedding part of the original BERT. Figure 4 shown.

[0097] The character-level word embedding generated by CharacterCNN is combined with the position embedding and paragraph embedding and finally used as the input of the BERT encoder. The character-level context representation is obtained through multi-layer Transformer encoding to form a semantic vector sequence for the entire URL.

[0098] 4) Expanding Pyramid Attention (e.g. Figure 2 Attention section)

[0099] The output of 3) above is fed into the DPAM module, which includes dilated convolution and spatial pyramid pooling. This expands the receptive field without changing the resolution, thus achieving multi-scale contextual information extraction and feature enhancement.

[0100] 5) Structural feature mapping module

[0101] The structural feature vector obtained by data preprocessing is upgraded through linear mapping to make its dimension consistent with the semantic vector, preparing for the subsequent fusion module.

[0102] 6) Gated Fusion Unit

[0103] The gating mechanism is used to dynamically learn the fusion strategy between semantic information and structural information to obtain a joint representation.

[0104] 7) Classification and discrimination module

[0105] The fused joint representation is fed into the Dropout and fully connected layers to output the malicious or not prediction result of the URL.

[0106] The model's principle workflow, such as Figure 3 As shown:

[0107] URL input ➝ passes through the CharacterBERT module and structural feature extraction model to obtain semantic information and structural features;

[0108] The primary semantics obtained by the CharacterBERT module enters the expanded pyramid attention, which provides more fine-grained semantic information.

[0109] The structural features are upgraded through the dimension processing module to make their dimensions consistent with those of CharacterBERT.

[0110] The outputs from step 2 and step 3 are input into the gated fusion unit to obtain an output vector that combines URL structural features and semantic information.

[0111] The fused vector passes through the loss layer and the fully connected layer to obtain the prediction result - malicious / benign.

[0112] The specific implementation steps are described below:

[0113] Step S1: Obtain a dataset of URL samples, which includes URL text and labels corresponding to the URLs - benign and malicious;

[0114] Step S2: Use CharacterCNN to convert the URL string into a URL character vector, and then feed the URL character vector into CharacterBERT for contextual semantic modeling to obtain the character-level semantic features of the URL.

[0115] Step S3: Send the URL semantic features obtained in step S2 to the expanded pyramid attention for semantic enhancement to obtain the enhanced URL character-level semantic features F c ;

[0116] Step S4: Use the tld library to parse the URL string, extract the structural features of the parsed URL string, and construct the URL structural features;

[0117] Step S5: The URL structure feature obtained in step S4 is processed through a linear layer to increase the dimension so that it is aligned with the dimension of CharacterBERT, and the URL structure feature F after the dimension increase is obtained. s ;

[0118] Step S6: F obtained in step S5 s and F obtained in step S3 c Send it to the access control fusion unit, so that the two features can be dynamically weighted and fused to obtain the fused URL feature Furl ;

[0119] Step S7: F obtained in step S6 url Through standard Dropout layer and fully connected layer processing, the URL features are converted into binary class representation for prediction, and the final URL detection model is obtained.

[0120] The specific method of step S2 converting the URL string into a URL character vector and feeding it into CharacterBERT for semantic modeling is as follows:

[0121] (a) Data preprocessing: Each URL string is segmented according to special symbols and alphanumeric characters. For example, "www.baidu.com" becomes ['www', '.', 'baidu', '.', 'com'] after segmentation. The maximum length of the segmentation is n, and any length exceeding the limit is truncated.

[0122] (b) Character-level word embedding: CharacterBERT is similar to traditional BERT, but the method of constructing the initial representation is different. Traditional BERT relies on a built-in vocabulary to decompose unknown tokens into independent word blocks for embedding, while CharacterBERT uses CharacterCNN to replace the word embedding layer and generate a unified representation at the character level. This method improves the flexibility of text processing and eliminates the dependence on the vocabulary. Figure 4 shown.

[0123] CharacterCNN consists of a character embedding layer, a convolutional feature extractor, a Highway network, and a projection layer.

[0124] Character Embedding Layer: In CharacterCNN, characters are mapped to vectors of fixed length 50. The embedding matrix dimensions are typically 262 × 16 (262 represents the supported character types, including the UTF-8 character set and six custom special tokens, and 16 represents the embedding dimension). The character embedding layer converts discrete character indices into trainable continuous vector representations. These continuous vectors are then used as input to subsequent convolutional layers to extract character-level features.

[0125] Convolutional Feature Extractor: The core of this module is a multi-layer one-dimensional convolutional kernel (1D-CNN), which is used to extract character-level n-gram patterns (sequences of n consecutive characters). This enhances the ability to capture local features and thus capture fine-grained semantic information. Multiple convolutional kernels of different sizes are applied in parallel to the character sequence to capture different levels of fine-grained information in short text. The output of each CNN is then max-pooled within the character sequence and concatenated with the outputs of other CNNs to produce a single representation.

[0126] Highway Network: To enhance the nonlinear expression capability of the model and enable it to selectively retain or discard features, CharacterCNN uses the Highway Network to filter information from the CNN representation.

[0127] Projection layer: After convolution and the Highway network, the output feature vector is large in dimensionality and requires dimensionality reduction through the projection layer to ensure compatibility with models like BERT. The projection layer uses a linear transformation to map the output features to the 768-dimensional BERT input format.

[0128] (c) CharacterBERT semantic modeling: Character-level word embeddings are combined with position embeddings and segment embeddings, and the final BertCharacterEmbeddings are generated after normalization and Dropout layers (regularization). Subsequently, the embeddings are processed through a multi-layer Transformer encoder and pooling layer, and finally output 12 hidden layers. The hidden states in these layers include both the representation of each token and the sentence-level pooling results - the character-level semantic information of the URL string. Figure 5 shown.

[0129] The detailed method of the expanded pyramid attention in step S3 is:

[0130] Dilated Pyramid Attention, which consists of Depthwise Separable Convolution (DSConv) and Spatial Pyramid Attention, is implemented as follows:

[0131] Depthwise Separable Convolution:

[0132] Assuming the input is CharacterBERT's high-dimensional output feature representation , where C, H and W represent the number of channels, height and width of the feature map respectively. We first input Apply a single depth-wise separable conv3x 3 (DSConv3x3 for short) to extract the common information of each branch , the specific formula is as follows:

[0133] ;

[0134] in, Represents a depth-separable conv3 x 3 operation; on different branches, the expanded DSConv3 x3 with different expansion rates is applied , get the The output features of each branch ,Right now:

[0135] ;

[0136] in, Indicates that the branch The expanded DSConv3x3 operation is performed at is the number of branches, and context information from different scales is connected using residual connections, namely:

[0137] ;

[0138] Since the concatenation operation significantly increases the number of channels, exacerbating computational complexity and parameter expansion, we instead adopt an element-wise summation strategy for optimization. Finally, we refine the aggregated features through 1x1 convolution operations, aiming to achieve compact and efficient feature representation, namely:

[0139] ;

[0140] Represents the standard conv1x1 operation that fuses contextual information of different scales. Original feature map Integration is performed through a residual connection mechanism to promote gradient flow and improve training efficiency. We adopt a dilation rate configuration of [1, 2, 4, 8] to capture multi-scale contextual information, thereby enhancing the richness and diversity of URL feature representation.

[0141] Spatial Pyramid Attention

[0142] The spatial pyramid attention mechanism consists of point-by-point convolution, a spatial pyramid structure, and a multi-layer perceptron. Point-by-point convolution integrates information and aligns channels; the spatial pyramid structure incorporates adaptive average pooling at three scales to enhance feature integration and regularization; and the multi-layer perceptron generates an attention map, providing key spatial information.

[0143] For precise description, we mark adaptive average pooling, fully connected layer, connection operation, Sigmoid activation function and tensor reshaping as 、 、 、 、 The feature map output by the multi-scale learning module can be expressed as In this framework, the attention mechanism extracts attention weights from the input data and multiplies them with the learnable weights of each channel to generate the output. Spatial pyramid structure The output expression is as follows: ;

[0144] For clarity, batch normalization and activation layers are omitted. The basic transformation It can be expressed as follows:

[0145] ;

[0146] The number of channels is 12, used to align the 12 hidden layers output by the CharacterBERT model. At the end of the network, the weighted feature maps are mean-pooled along the fixed sequence length dimension to extract representative feature vectors. The resulting vectors are passed to the gating unit and dynamically weighted and fused with the URL structure features.

[0147] In step S4, the tld library is used to parse the URL structure and extract structural features. The detailed method is as follows:

[0148] Use the tld library to parse the URL, separate the URL structures, and count the required structural feature information, such as the total length of the URL, whether the URL contains sensitive words, the number of top-level domains in the URL, the number of subdomains in the URL, etc. The judgment class uses 0 (no) and 1 (yes), and the statistical class uses the number value, which is composed of the above information and a list of URL structural features.

[0149] The specific method of step S6 is:

[0150] Project the two eigenvectors into the same dimensional space:

[0151] ;

[0152] ;

[0153] in, and is the projection matrix, and is the bias term. represents the semantic feature vector from BERT, A feature vector representing structural features from a URL.

[0154] Calculating gating weights :

[0155] ;

[0156] in, is the Sigmoid activation function, which ensures that the gate weights are in the range [0,1].

[0157] Use gating weights to perform weighted fusion of two feature vectors:

[0158] ;

[0159] in, Represents element-wise multiplication.

[0160] Finally, a fully connected layer is used to generate the fused feature vector:

[0161] ;

[0162] in, and are the weights and biases of the fully connected layers.

[0163] Finally, the output of the gated fusion unit is input into the dropout layer and the fully connected layer to obtain the prediction result.

[0164] In another embodiment, a computer storage medium stores a computer program, which, when executed, performs any of the above-mentioned malicious URL detection methods based on the fusion of character-level language models and structural features.

[0165] To validate the model's effectiveness, this paper used two URL classification datasets: Grambeddings and Kaggle_1. Grambeddings contains 800,000 real phishing samples collected from PhishTank and OpenPhish, with 400,000 each of good and bad URLs. Kaggle_1, sourced from Kaggle, contains approximately 316,000 each of good and bad URLs. To reduce computing resource consumption and improve experimental efficiency, we randomly sampled half of the samples from each category in each dataset for the experiment. Specific information is shown in Table 1.

[0166] Table 1. URL types and quantity statistics of the three datasets

[0167]

[0168] The experiment uses test indicators such as precision (P), recall (R), comprehensive evaluation index (F1) and accuracy to evaluate the performance of the model, as shown in formulas (12) to (15).

[0169] (12)

[0170] (13)

[0171] (14)

[0172] (15)

[0173] Where TP represents the number of URLs predicted by the model to be malicious that are actually malicious; FP represents the number of URLs predicted by the model to be malicious that are actually benign; TN represents the number of URLs predicted by the model to be benign that are actually benign; and FN represents the number of URLs predicted by the model to be benign that are actually malicious.

[0174] Comparative experimental analysis

[0175] The experiment used Python 3.8 and the PyTorch-2.0 deep learning framework. The hardware configuration consisted of an A800 GPU with 48GB of video memory. The AdamW optimizer was used, with three training rounds. The extracted dataset was split into a training and test set with an 8:2 ratio.

[0176] The experiment selected PMANet and TransURL as comparison models, and the performance comparison is shown in Table 2.

[0177] Table 2 Comparative experimental results

[0178]

[0179] The results show that the proposed model outperforms the comparison methods on both datasets, especially in terms of recall rate and F1 index. It can effectively reduce false positives and missed positives, and has high application value in actual security scenarios.

[0180] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A malicious URL detection method based on the fusion of character-level language model and structural features, characterized by: The following steps are involved: S01: Use character-level language model to obtain character-level URL semantic features; S02: Send the URL semantic features to the expanded pyramid attention for semantic enhancement to obtain the enhanced character-level URL semantic features; The dilated pyramid attention includes depth-separable convolution and spatial pyramid attention; A single depth-wise separable convolution is applied to extract the common information of each branch. Expanded depth-wise separable convolution operations with different dilation rates are performed on different branches. By using residual connections, different dilation rates are adopted to capture multi-scale contextual information. Spatial pyramid attention is used to extract representative feature vectors. S03: extracting the structural features of the URL character string to obtain the URL structural features; S04: The URL structural features and the enhanced character-level URL semantic features are weightedly fused using the gating weights of the gating unit to output the malicious URL judgment result through the classifier.

2. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: Step S01 also includes segmenting each URL string according to special symbols and alphanumeric characters, adding special marks at the beginning and end, converting each segmentation and special mark into a fixed-length character-level index representation, filling in the missing parts, and the overall character-level index of the URL is composed of all segmentation indexes as model input.

3. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: Step S01 also includes: Character CNN is used to replace the word embedding layer to generate a unified representation at the character level. Character CNN extracts character-level features through the Character CNN and Highway network to generate character-level embeddings. Character CNN includes a character embedding layer, a convolutional feature extractor, a Highway network, and a projection layer. The character embedding layer is used to map characters into fixed-length vectors; The convolutional feature extractor includes multiple one-dimensional convolution kernels to extract sequences of n consecutive characters at the character level. Multiple convolution kernels of different sizes are applied in parallel to the character sequence to obtain different fine-grained information in the short text. The output of each CNN is max-pooled in the character sequence and concatenated with other CNN outputs to produce a single representation. Highway network is used to filter information from CNN representations; The projection layer is used for dimension conversion.

4. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 3 is characterized in that: Also includes: Combine character-level word embeddings with position embeddings and segment embeddings, and generate the final text representation that combines BERT and character-level embeddings after normalization and regularization; After the embedding is processed by multiple layers of Transformer encoders and pooling layers, it finally outputs 12 hidden layers. The hidden states in these layers include both the representation of each token and the pooling results at the sentence level.

5. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: Public information in step S02 : ， in, Denotes a depth-wise separable convolution operation, and performs extended depth-wise separable convolution operations with different expansion rates on different branches to obtain the first The output features of each branch : ， in, Indicates that the branch The extended depth-wise separable convolution operation is performed at is the number of branches, and context information from different scales is connected using residual connections, namely: ， Adopting element summation strategy optimization, the aggregation features are refined through 1x1 convolution operation: ， Represents a standard convolution operation that fuses contextual information at different scales; Spatial pyramid attention consists of point-by-point convolution, spatial pyramid structure, and multi-layer perceptron. Point-by-point convolution is used to integrate information and align channels; the spatial pyramid structure integrates adaptive average pooling at multiple scales to enhance feature integration and regularization; the multi-layer perceptron generates an attention map to provide key spatial information; The attention mechanism extracts attention weights from the input data and multiplies them with learnable weights of each channel to generate output, spatial pyramid structure The output expression is as follows: ， For the connection operation, Reshape the tensor, is the adaptive average pooling, is the feature map output by depth-wise separable convolution; Omit batch normalization and activation layers, basic transformation As shown below: ， is the fully connected layer, is the Sigmoid activation function; At the end of the network, the weighted feature map is mean pooled along the fixed sequence length dimension.

6. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: The method of extracting the structural features of the URL character string in step S03 includes: Use the tld library to parse the URL, extract its structural components, and count the structural feature information. The structural features include the total length of the URL, the number of special characters, whether it contains sensitive words, the number of top-level domains, and the number of subdomains. These features are combined into a URL structural feature list.

7. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: The weighted fusion method in step S04 specifically includes: S41: Project the two eigenvectors into the same dimensional space: ， ， in, and is the projection matrix, and is the bias term, is the semantic feature vector, is the URL structure feature vector; S42: Calculate gate weights : ， in, is the Sigmoid activation function; S43: Use gated weights to perform weighted fusion of two feature vectors: ， in, represents element-wise multiplication; S44: Generate the fused feature vector through a fully connected layer: ， in, and are the weights and biases of the fully connected layers.

8. The malicious URL detection method based on the fusion of character-level language model and structural features according to claim 1 is characterized in that: After obtaining the URL structural features in step S03, the step also includes performing dimensionality-upgrading processing on the obtained URL structural features through a linear layer so that the dimensions thereof are consistent with the dimensions of the semantic features.

9. A malicious URL detection system based on the fusion of character-level language model and structural features, characterized by: include: Semantic feature extraction module, which uses character-level language model to obtain character-level URL semantic features; The highly fine-grained semantic module feeds URL semantic features into the dilated pyramid attention for semantic enhancement, obtaining enhanced character-level URL semantic features. The dilated pyramid attention includes depth-separable convolution and spatial pyramid attention; A single depth-wise separable convolution is applied to extract the common information of each branch. Expanded depth-wise separable convolution operations with different dilation rates are performed on different branches. By using residual connections, different dilation rates are adopted to capture multi-scale contextual information. Spatial pyramid attention is used to extract representative feature vectors. The structural feature extraction module extracts the structural features of the URL string to obtain the URL structural features; The fusion judgment module uses the gating weight of the gating unit to weightedly fuse the URL structure features and the enhanced character-level URL semantic features on the two feature vectors, and outputs the malicious URL judgment result through the classifier.

10. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, the malicious URL detection method based on the fusion of character-level language model and structural features described in any one of claims 1 to 8 is implemented.

Images