Multi-task url detection method and system fusing structural and semantic features

Abstract

The application discloses a multi-task URL detection method and system fusing structure and semantic features, and comprises the following steps: obtaining a word-level input sequence and extracting structure features; using a dynamic convolution attention module to model features of the word-level input sequence, wherein the dynamic convolution attention module combines multiple basic convolution kernels through input perception weights, dynamically adjusts convolution results, and obtains context-related semantic features; interacting the semantic features output by the dynamic convolution with the extracted structure features, and generating a joint representation vector; and outputting multi-task prediction results based on the joint representation vector. Through the fusion of structure statistical features and semantic information, and the multi-task combination, precise recognition and efficient interception of malicious URLs containing out-of-vocabulary words can be realized.

Description

Technical Field

[0001] This invention belongs to the field of URL detection technology. It relates to a multi-task URL detection method and system that integrates structural and semantic features. Background Technology

[0002] URL detection, as a key component of the network security protection system, aims to identify potential phishing links, redirect traps, malicious download pages, and other risky entry points, preventing users from unknowingly accessing harmful content and thus avoiding sensitive information leakage, identity theft, or economic losses.

[0003] Currently, the mainstream methods for detecting malicious URLs mainly include three types: static matching mechanisms based on blacklists and whitelists, classification models based on traditional machine learning, and deep learning detection technologies that have emerged in recent years.

[0004] The introduction of machine learning methods has improved the intelligence level of detection. Researchers use algorithms such as support vector machines, random forests, and logistic regression, combined with manually extracted URL features (such as whether they contain sensitive keywords, symbol combinations, subdomain levels, etc.) to train classifiers for judgment. These methods alleviate the rigidity problem of blacklist and whitelist methods to some extent, but still rely on high-quality manual feature design. If the features have poor generality, they are difficult to adapt to the diversity of URL structures and semantic changes, and are particularly ineffective in dealing with dynamic attacks, malicious short links, and complex redirection strategies.

[0005] To better uncover the semantic features of URLs, deep learning-based feature extraction methods have been introduced into URL detection tasks. Convolutional Neural Networks (CNNs) excel in text pattern extraction, automatically mining local n-gram features and extracting latent patterns, significantly reducing reliance on manual feature engineering. However, existing methods often focus on character-level input or shallow structures, making it difficult to model the hierarchical structure and contextual dependencies in URLs. Especially when dealing with highly covert attack patterns such as splicing spoofing and symbol nesting, they suffer from weak expressive power and poor model generalization.

[0006] In recent years, pre-trained language models (such as BERT and GPT) have demonstrated extremely powerful feature extraction capabilities. Some works have attempted to use URL sequences as special language inputs, introducing Transformer structures for modeling in order to mine deep semantic features. Despite some progress, existing methods generally suffer from two problems: first, they ignore the inherent structural statistical information of URLs, such as path depth, symbol distribution, and subdomain features; second, pre-trained models typically rely on fixed vocabularies, making it difficult to effectively handle the large number of random characters, numbers, and mixed encoding patterns in URLs, i.e., the serious out-of-vocabulary (OOV) problem, which reduces the ability to identify mutated malicious URLs.

[0007] Furthermore, current mainstream methods mostly employ single-task learning frameworks, failing to fully exploit related auxiliary information, such as semantic clues like whether the URL is a short link, the type of the source platform, or the number of redirects. This not only limits the model's expressive power but also affects its ability to comprehensively identify and adapt to multi-dimensional attack patterns in real-world scenarios.

[0008] In summary, existing technologies still have the following core problems when facing complex and covert malicious URL detection tasks: (1) neglecting the modeling of URL structure information; (2) lacking effective solutions to the problem of out-of-vocabulary words; (3) having a single model training objective and making it difficult to improve generalization ability through multi-task collaboration. Summary of the Invention

[0009] The purpose of this invention is to provide a multi-task URL detection method and system that integrates structural and semantic features. By integrating structural statistical features and semantic information, and combining multiple tasks, it can achieve accurate identification and efficient interception of malicious URLs containing out-of-vocabulary words.

[0010] The technical solution to achieve the purpose of this invention is as follows:

[0011] A multi-task URL detection method that integrates structural and semantic features includes the following steps:

[0012] S01: Obtain word-level input sequences and extract structural features;

[0013] S02: Use the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features.

[0014] S03: Interact with the semantic features output by the dynamic convolution and the extracted structural features to generate a joint representation vector;

[0015] S04: Output multi-task prediction results based on joint representation vector.

[0016] In the preferred technical solution, in step S02, the word-level input sequence is connected to the dynamic convolutional attention module through the embedding layer, and the output of the dynamic convolutional attention module is aggregated by max pooling and average pooling to obtain the semantic feature vector.

[0017] In a preferred embodiment, the dynamic convolutional attention module employs multiple sets of basic convolutional kernels. By introducing an input-based attention weight mechanism, it achieves dynamic weighted combination of different convolutional kernels. The combined weights of the dynamic convolutional kernels are generated by a set of attention modules. The dynamic convolution process of the dynamic convolutional attention module is as follows:

[0018]

[0019]

[0020]

[0021] in, Represents the dynamic weight matrix. Represents the dynamic bias vector. Indicates the number of convolution kernels, Indicates the first The weight matrix of each convolutional kernel. Indicates the first The bias vector of each convolution kernel For the first Attention weights on each convolutional kernel For activation function, This represents the final output vector.

[0022] In a preferred embodiment, the attention module first processes the input features. Global average pooling is performed to extract global contextual information, followed by two layers of one-dimensional convolution and non-linear activation to output the result. attention weights And through softmax normalization, the attention weight generation process is as follows:

[0023]

[0024]

[0025]

[0026] in, This represents the result of global average pooling. It is global average pooling. This represents the hidden representation after convolution activation. This represents a 1x1 convolution. Indicates temperature parameter, This represents the final attention weight vector. yes The Each component.

[0027] In the preferred technical solution, the method further includes the following step before step S03:

[0028] The extracted structural features are input into a feature projection module containing a two-layer fully connected network and a ReLU activation network. First, the structural features are mapped from the original dimension to the intermediate hidden space. ReLU activation is used to enhance the non-linear expressive power. Then, they are projected to the same dimension as the semantic features output by the dynamic convolution.

[0029] In the preferred technical solution, in step S03, the semantic features and structural features are linearly transformed respectively, and then an outer product combination is performed in each dimension to explicitly model the second-order interaction relationship between semantics and structure, and generate a joint representation vector.

[0030] In the preferred technical solution, performing the outer product combination includes:

[0031] Perform 3×3 convolution and pooling operations on semantic features and structural features respectively to obtain new feature maps. and ;

[0032] In spatial location The above method fuses two features through matrix outer product, and its calculation method is as follows:

[0033]

[0034] in, For semantic features, For structural features, express In position Feature map, express In position Feature map, For position The bilinear combination feature at a given location is the result of the outer product of two feature maps.

[0035] In the preferred technical solution, step S04 further includes constructing four parallel classification branches based on the fusion features extracted by the shared encoder. Each task corresponds to an independent fully connected layer to output the prediction result of the corresponding task. The main task branch is used for malicious URL identification, generating a probability distribution through a softmax activation function. The first auxiliary task branch is used for short link identification. This branch uses an independent fully connected layer for prediction, generating a binary classification label by comparing whether the main domain of the URL belongs to a known short link service platform. Category 0 indicates that the URL is not a short link, and category 1 indicates that it belongs to a short link service. The second auxiliary task branch is used for source classification, and the output of this branch is a three-class softmax classification. The probability distribution is based on regular expression matching of domain keywords to generate three types of source tags: Category 0 represents URLs from search engines; Category 1 represents URLs from social media platforms; and Category 2 represents other or unknown sources. The third auxiliary task branch is used for jump depth prediction. The output of this branch is a three-class prediction result. Based on whether the URL contains the redirect= or url= parameter and whether it contains multiple http substrings, the jump depth is estimated and divided into three levels: Category 0 indicates no obvious jump, Category 1 indicates the presence of first-level jump features, and Category 2 indicates the possible presence of multi-level nested jumps.

[0036] This invention also discloses a multi-task URL detection system that integrates structural and semantic features, comprising:

[0037] The input processing module acquires word-level input sequences and extracts structural features;

[0038] The dynamic convolutional semantic encoding module uses the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features.

[0039] The bilinear fusion module interacts with the semantic features output by dynamic convolution and the extracted structural features to generate a joint representation vector;

[0040] The multi-task output module outputs multi-task prediction results based on the joint representation vector.

[0041] The present invention also discloses a computer storage medium storing a computer program, which, when executed, implements the above-mentioned multi-task URL detection method that integrates structure and semantic features.

[0042] Compared with the prior art, the significant advantages of this invention are:

[0043] 1. Design a token-level embedding module based on dynamic convolution, combined with a context pooling strategy, to accurately extract word-level semantic features of URLs;

[0044] 2. Construct a structural statistical feature encoder to capture structural elements such as path patterns, subdomain information, and short chain indicators from multiple dimensions;

[0045] 3. A bilinear fusion mechanism is proposed to effectively model the high-order interaction relationship between structure and semantics;

[0046] 4. Introduce a multi-task learning framework to jointly perform tasks such as maliciousness detection, short link identification, source classification, and jump depth prediction, thereby improving detection accuracy and adaptability. Attached Figure Description

[0047] Figure 1 This is a flowchart of the multi-task URL detection method that integrates structural and semantic features in this embodiment;

[0048] Figure 2 This is an overall framework diagram of the multi-task URL detection method that integrates structural and semantic features in this embodiment;

[0049] Figure 3 This is a structural diagram of the dynamic convolutional attention module in this embodiment;

[0050] Figure 4 This is a structural diagram of the bilinear fusion module in this embodiment. Detailed Implementation

[0051] Invention principle: A token-level embedding module based on dynamic convolution is designed, which, combined with a context pooling strategy, accurately extracts word-level semantic features of URLs; a bilinear fusion mechanism is proposed to effectively model the high-order interaction relationship between structure and semantics; a multi-task learning framework is introduced to jointly perform maliciousness discrimination, short link identification, source classification and jump depth prediction tasks, thereby improving detection accuracy and adaptability.

[0052] Example 1:

[0053] like Figure 1 As shown, a multi-task URL detection method that integrates structural and semantic features includes the following steps:

[0054] S01: Obtain word-level input sequences and extract structural features;

[0055] S02: Use the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features.

[0056] S03: Interact with the semantic features output by the dynamic convolution and the extracted structural features to generate a joint representation vector;

[0057] S04: Output multi-task prediction results based on joint representation vector.

[0058] In a preferred implementation, in step S02, the word-level input sequence is connected to the dynamic convolutional attention module through the embedding layer, and the output of the dynamic convolutional attention module is aggregated by max pooling and average pooling to obtain the semantic feature vector.

[0059] In a preferred implementation, the dynamic convolutional attention module employs multiple sets of basic convolutional kernels. By introducing an input-based attention weight mechanism, it achieves dynamic weighted combination of different convolutional kernels. The combined weights of the dynamic convolutional kernels are generated by a set of attention modules. The dynamic convolution process of the dynamic convolutional attention module is as follows:

[0060]

[0061]

[0062]

[0063] in, Represents the dynamic weight matrix. Represents the dynamic bias vector. Indicates the number of convolution kernels, Indicates the first The weight matrix of each convolutional kernel. Indicates the first The bias vector of each convolution kernel For the first Attention weights for each convolutional kernel, For activation function, This represents the final output vector.

[0064] In a better implementation, the attention module first processes the input features. Global average pooling is performed to extract global contextual information, followed by two layers of one-dimensional convolution and non-linear activation to output the result. attention weights And through softmax normalization, the attention weight generation process is as follows:

[0065]

[0066]

[0067] in, This represents the result of global average pooling. It is global average pooling. This represents the hidden representation after convolution activation. This represents a 1x1 convolution. Indicates temperature parameter, This represents the final attention weight vector. yes The One portion, Each component in This refers to the corresponding dynamic attention weights, which are used to perform weighted fusion of structural or semantic features.

[0068] A preferred implementation includes the following steps prior to step S03:

[0069] The extracted structural features are input into a feature projection module containing a two-layer fully connected network and a ReLU activation network. First, the structural features are mapped from the original dimension to the intermediate hidden space. ReLU activation is used to enhance the non-linear expressive power. Then, they are projected to the same dimension as the semantic features output by the dynamic convolution.

[0070] In a preferred implementation, step S03 involves performing linear transformations on the semantic features and structural features respectively, and then performing an outer product combination in each dimension to explicitly model the second-order interaction relationship between semantics and structure, thereby generating a joint representation vector.

[0071] A preferred implementation, performing outer product combinations includes:

[0072] Perform 3×3 convolution and pooling operations on semantic features and structural features respectively to obtain new feature maps. and ;

[0073] In spatial location The above method fuses two features through matrix outer product, and its calculation method is as follows:

[0074]

[0075] in, For semantic features, For structural features, express In position Feature map, express In position Feature map, For position The bilinear combination feature at a given location is the result of the outer product of two feature maps.

[0076] Another embodiment, a multi-task URL detection system that integrates structural and semantic features, includes:

[0077] The input processing module acquires word-level input sequences and extracts structural features;

[0078] The dynamic convolutional semantic encoding module uses the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features.

[0079] The bilinear fusion module interacts with the semantic features output by dynamic convolution and the extracted structural features to generate a joint representation vector;

[0080] The multi-task output module outputs multi-task prediction results based on the joint representation vector.

[0081] A preferred implementation of the detection system includes the following modules:

[0082] 1) Input processing module

[0083] Responsible for preprocessing the raw URL, including:

[0084] a) Text input. A word-level input sequence is generated based on symbol and word form segmentation;

[0085] b) Structural feature input. Extract structural statistical features, such as the number of subdomains, path depth, whether it is a short link, whether it contains an IP address, types of special characters, number of TLDs, etc., and construct a structural feature vector.

[0086] 2) Dynamic Convolutional Semantic Encoding Module

[0087] Dynamic convolution is used to model the features of word-level token sequences. This module combines multiple basic convolution kernels by input perceptual weights and dynamically adjusts the convolution results, thereby enhancing the model's ability to express diverse character combination patterns in URLs and obtaining context-sensitive semantic features.

[0088] 3) Structural Feature Projection Module

[0089] The extracted statistical structure feature vectors are input into a fully connected network for dimensionality upscaling, so that their dimensions are consistent with the dynamic convolutional semantic output, which facilitates subsequent fusion operations.

[0090] 4) Bilinear fusion module

[0091] A bilinear fusion mechanism is employed to deeply interact the semantic and structural features output by dynamic convolution. Specifically, the two types of features are linearly transformed separately, and then an outer product is performed in each dimension to explicitly model the second-order interaction between semantics and structure, generating a more discriminative joint representation vector.

[0092] 5) Multi-task output module

[0093] The model has four output branches at the end, corresponding to one main task (malicious URL identification) and three auxiliary tasks (short link identification, URL source classification, and redirection depth prediction). Each branch shares a unified fusion feature input and outputs the final result through an independent fully connected classifier.

[0094] The following details the specific implementation methods of each module, such as... Figure 2 As shown, it includes:

[0095] S1. Input Preprocessing. During the input stage, the model employs a BERT-based WordPiece segmentation strategy to parse the original URL into a sequence of tokens, fully preserving the sub-word structure and variation features within the URL. For example, the input "www.bank-login.cn / home" will be decomposed into ["www", ".", "bank", "-", "login", ".", "cn", " / ", "home"]. Compared to traditional character-level segmentation or symbol-based rule-based segmentation, this method can more accurately capture the semantic patterns and contextual structure of the URL. The method is compatible with various semantic encoding methods (such as BERT, CNN, and GRU).

[0096] Simultaneously, the system extracts a series of structural statistical features, totaling 13 dimensions, during the preprocessing stage and normalizes them. These features cover the URL length, the number of numeric characters, hyphens (-), @ symbols, periods (.), and the frequency of "www" occurrences; the number of directory levels and the length of the first path segment in the path; the length of the domain name itself and the number of subdomains; whether it belongs to a known short link service; whether it contains phishing sensitive keywords such as "login" or "paypal"; and the number of tags appearing in the authoritative top-level domain database in the domain name. Through these structural features, the system can capture the apparent characteristics and potential risks of URLs from multiple perspectives, providing comprehensive support for subsequent model identification.

[0097] S2, Dynamic Convolutional Semantic Modeling, constructed using Token-level context representation. For example... Figure 3 As shown, each token is first input into a dynamic convolutional attention module to extract contextual semantics, and then aggregated using max pooling and average pooling strategies to obtain the overall representation vector. The dynamic convolutional attention module employs multiple sets of basic convolutional kernels, and by introducing an input-based attention weight mechanism, it achieves dynamic weighted combination of different convolutional kernels. The combined weights of the dynamic convolutional kernels are generated by a set of attention modules, which first process the input features... Global average pooling is performed to extract global contextual information, followed by two layers of one-dimensional convolution and non-linear activation to output the result. attention weights And then normalized using softmax. The final dynamic convolution process can be described as follows:

[0098] (1)

[0099] (2)

[0100] (3)

[0101] in, Represents the dynamic weight matrix. Represents the dynamic bias vector. Indicates the number of convolution kernels, Indicates the first The weight matrix of each convolutional kernel. Indicates the first The bias vector of each convolution kernel For the first Attention weights for each convolutional kernel, For activation function, This represents the final output vector. The attention weight generation process for the dynamic convolution kernel is as follows:

[0102] (4)

[0103] (5)

[0104] (6)

[0105] in, This represents the result of global average pooling. It is global average pooling. This represents the hidden representation after convolution activation. This represents a 1x1 convolution. Indicates temperature parameter, This represents the final attention weight vector. Each component in This refers to the corresponding dynamic attention weights, which are used to perform weighted fusion of structural or semantic features.

[0106] Figure 2 In conv k This means that it refers to the k-th convolutional kernel. In other words, this structure has a total of k different convolutional branches, each of which uses an independent convolutional kernel to process the input features. In That is, each CONV k The convolution weights, These are the dynamic weights (attention weights) calculated by the attention module. In the experiment, K was set to 4.

[0107] The above design enables the dynamic convolutional layer to dynamically adjust the receptive field and feature transformation according to different inputs during each forward propagation, thereby enhancing the model's ability to model complex local patterns and potential dependencies.

[0108] S3. Upsizing Encoding of Structural Features. The structural statistical features extracted in S1 are input into a feature projection module containing a two-layer fully connected network. First, they are mapped from the original dimension to the intermediate hidden space, and ReLU activation is introduced to enhance the nonlinear expressive power. Then, they are projected to the same dimension as the token representation output by the dynamic convolution, ensuring consistent alignment of the feature space in the subsequent dual-modal fusion stage.

[0109] S4. Bilinear Fusion of Semantic and Structural Features. This invention designs a bilinear fusion module to model the high-order interaction between structural information and semantic features. For example... Figure 4 As shown, let the input features be... The word-level features are extracted from the dynamic convolutional semantic encoding branch. This is the representation of the structural features after projection. The bilinear fusion module first performs 3×3 convolution and pooling operations on each feature to obtain a new feature map. and Subsequently, in terms of spatial location Above, the bilinear fusion module fuses two features through matrix outer product, and its calculation method is as follows:

[0110] (7)

[0111] in, express In position Feature map, express In position Feature map, For position The bilinear combination feature at a given location is the outer product of two feature maps. Unlike conventional addition or concatenation operations, bilinear pooling introduces second-order information between features, enabling the modeling of pairing relationships between two types of features at each location, thereby capturing richer feature associations.

[0112] S5. The task output module employs a multi-task output construction. The model is designed with a multi-task output structure consisting of a main task and three auxiliary tasks. This design aims to guide the model to learn the potential threat features of URLs from different semantic levels, improving overall discriminative ability and generalization performance. The model output part constructs four parallel classification branches based on the fusion features extracted by the shared encoder. Each task corresponds to an independent fully connected layer to output the prediction result for that task. This task decoupling design effectively avoids parameter interference and gradient competition issues between multiple tasks, improving the stability of multi-task joint modeling.

[0113] Main task branch: Malicious URL identification (binary classification)

[0114] This task is the core output of the model, aiming to determine whether the input URL poses a potential malicious risk, labeled as "benign" or "malicious". This branch has a 2-dimensional output, generating a probability distribution through a softmax activation function to support practical deployments in security scenarios such as phishing detection and black hat SEO interception.

[0115] Auxiliary Task 1: Short Link Identification (Binary Classification)

[0116] Shortened links are often used to hide the true access path, possessing strong deceptive and attack stealth capabilities. This task generates binary labels by comparing whether the main domain of a URL belongs to a known short link service platform (such as bit.ly, t.co, tinyurl.com, etc.), where category 0 indicates that the URL is not a short link, and category 1 indicates that it belongs to a short link service. The model learns to identify the potential association between link shortening behavior and phishing attacks through this task; this branch uses an independent fully connected layer for prediction. In multi-task joint modeling, if the auxiliary task determines that the URL is a short link (i.e., outputting category 1), the main task will be more inclined to classify the link as malicious; conversely, when the task predicts it as a non-short link (category 0), the main task's tendency to classify it as malicious will decrease. This auxiliary task significantly improves the model's ability to identify URLs with structural camouflage characteristics.

[0117] Auxiliary Task 2: Source Classification (Three-category classification)

[0118] URLs from different source platforms exhibit significant differences in structural complexity, purpose, and risk distribution. This task uses regular expression matching based on domain keywords to automatically generate three source tags. Category 0 represents URLs from search engines, such as google.com or baidu.com; Category 1 represents URLs from social media platforms, such as twitter.com or facebook.com; and Category 2 represents other or unknown sources. The output of this task is a three-class softmax probability distribution, used to provide semantic priors and platform background knowledge for the main task. When the model identifies a URL as originating from social media (i.e., Category 1), the main task typically assigns a higher probability of malice, as phishing attacks are more frequent on social media platforms, and short links are more commonly used. In contrast, if a URL is judged to originate from a search engine (Category 0), the main task tends to consider it benign content. This auxiliary task enhances the model's contextual understanding and semantic reasoning capabilities.

[0119] Auxiliary Task 3: Jump Depth Prediction (Three-Level Classification)

[0120] Attackers often use multi-level redirects to hide the final target page or bypass security detection mechanisms. This task estimates the redirect depth based on structural signals such as whether the URL contains parameters like redirect= or url=, and whether it contains multiple http substrings, and classifies them into three levels. Category 0 indicates no obvious redirect, Category 1 indicates the presence of a single-level redirect, and Category 2 indicates the possibility of multi-level nested redirects. This auxiliary task outputs a three-class prediction result to supplement the main task's ability to perceive structural complexity and attack chain length. When the model outputs Category 2 in the redirect depth prediction, indicating that the URL has a high redirect level, the main task is more likely to identify it as a malicious URL; while if the prediction result is Category 0, the main task is more likely to consider the URL to have a simple structure and lower risk. By introducing this task, the model exhibits higher robustness when facing samples with hidden redirect paths.

[0121] S6. The joint optimization module employs multi-task joint training and optimization. It uses a weighted cross-entropy loss function for training, and its total loss function is as follows:

[0122] (8)

[0123] in, The loss due to the malicious intent assessment of the main task. , , The losses for the three auxiliary tasks—short link identification, source classification, and jump depth prediction—are respectively defined, with the weights of the loss terms for each task. This strategy can be adjusted according to the actual scenario. It can improve knowledge sharing between tasks and enhance the generalization ability of the main task.

[0124] S7. Model Inference and Output. The final fused representation, processed by Dropout and a fully connected classifier, outputs the prediction results for the main and auxiliary tasks, forming complete detection labels. All tasks share dynamic convolution and fusion encoders, effectively improving model training efficiency, representation depth, and deployment adaptability.

[0125] This method takes URL malice determination as its main task, while combining auxiliary tasks such as short link identification, source classification and redirection depth prediction to improve the robustness and practicality of the system while ensuring detection accuracy.

[0126] In another embodiment, a computer storage medium storing a computer program, which, when executed, is the multi-task URL detection method for fusing structure and semantic features as described in any of the preceding embodiments.

[0127] To verify the effectiveness of the model, this paper selects two publicly available URL datasets with classification labels for evaluation: Grambeddings and Kaggle_1. As shown in Table 1:

[0128] Table 1 Dataset

[0129]

[0130] The Grambeddings dataset consists of real phishing samples collected from well-known platforms such as PhishTank and OpenPhish between May 2019 and June 2021, containing approximately 800,000 URL samples, with benign and malicious URLs each accounting for about half. The Kaggle_1 dataset comes from the Kaggle platform and is a standard binary classification task dataset, containing 316,252 benign URLs and 316,251 malicious URLs.

[0131] The proposed model SSF-MURL achieves leading performance on both datasets, as shown in Table 2:

[0132] Table 2 Comparison of SSF-MURL with existing methods based on BERT or CNN

[0133]

[0134] In the Grambeddings dataset, the model achieves an accuracy of 97.94% and an F1 score of 97.93%; in the Kaggle_1 dataset, both accuracy and F1 score are 99.82%. In comparative experiments with mainstream models such as TextCNN, CNN-BiLSTM, PhishFinder, and PMANet, this method comprehensively outperforms other models in terms of accuracy, precision, recall, and F1 score, validating the effectiveness and versatility of the dual-modal fusion and multi-task modeling strategy in malicious URL detection, and demonstrating broad practical application prospects.

[0135] To further verify the contribution of each core module of the SSF-MURL model to the overall performance, ablation experiments were conducted on the GramBeddings dataset. The experiments examined the impact of dynamic feature convolution, structural feature branching, and multi-task loss on the detection capability of the main task, and the specific results are shown in Table 3.

[0136] Table 3 Ablation experiments on the SSF-MURL framework

[0137]

[0138] After removing the dynamic feature convolution (-dynamic feature convolution), the model accuracy dropped to 96.80%, and the F1 score decreased to 96.78%. Dynamic convolution can adaptively generate weights based on the input and has a stronger pattern adaptation capability. Its absence weakens the model's ability to distinguish diverse malicious URLs.

[0139] When structural features were removed (-structural features), the accuracy and F1 score dropped to 97.32% and 97.31%, respectively. Structural statistical features (such as the number of subdomains and path depth) provide additional discriminative information for the model, and their fusion with semantic representation helps improve detection accuracy. The absence of this branch makes it difficult for the model to capture key structural features hidden in the URL, resulting in a slight decline in performance.

[0140] After removing the multi-task loss (-multi-task loss), when training only with the main task, the accuracy and F1 score are 97.56% and 97.55%, respectively. Multi-task joint learning promotes knowledge sharing among different security sub-tasks and can improve the detection accuracy of the main task. Its removal restricts knowledge transfer between tasks, thus reducing the optimization effect of the main task.

[0141] The complete SSF-MURL model (FULL) achieved optimal performance across all metrics (97.94% accuracy, 97.93% F1 score), further validating the positive impact of the collaborative design of dynamic feature convolution, structural feature branching, and multi-task loss on improving malicious URL detection capabilities. The introduction of each module brings significant performance gains, and the combination of all three enables efficient and comprehensive malicious URL modeling and detection.

[0142] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A multi-task URL detection method that integrates structural and semantic features, characterized in that, Includes the following steps: S01: Obtain word-level input sequences and extract structural features; S02: Use the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features. S03: Interact with the semantic features output by the dynamic convolution and the extracted structural features to generate a joint representation vector; S04: Output multi-task prediction results based on joint representation vectors; training is performed using a weighted cross-entropy loss function, and its total loss function is as follows: ， in, The loss due to the malicious intent assessment of the main task. , , These correspond to the losses of the three auxiliary tasks respectively. , , , The weights represent the loss terms for each task; the final fusion represents the prediction results of the main task and auxiliary task output by the classifier.

2. The multi-task URL detection method that integrates structural and semantic features according to claim 1, characterized in that, In step S02, the word-level input sequence is connected to the dynamic convolutional attention module through the embedding layer. The output of the dynamic convolutional attention module is aggregated by max pooling and average pooling to obtain the semantic feature vector.

3. The multi-task URL detection method that integrates structural and semantic features according to claim 1, characterized in that, The dynamic convolutional attention module employs multiple sets of basic convolutional kernels. By introducing an input-based attention weight mechanism, it achieves dynamic weighted combination of different convolutional kernels. The combined weights of the dynamic convolutional kernels are generated by a set of attention modules. The dynamic convolution process of the dynamic convolutional attention module is as follows: ， ， ， in, Represents the dynamic weight matrix. Represents the dynamic bias vector. Indicates the number of convolution kernels. Indicates the first The weight matrix of each convolutional kernel. Indicates the first The bias vector of each convolution kernel For the first Attention weights on each convolutional kernel For activation function, This represents the final output vector.

4. The multi-task URL detection method that integrates structural and semantic features according to claim 3, characterized in that, The attention module first processes the input features. Global average pooling is performed to extract global contextual information, followed by two layers of one-dimensional convolution and non-linear activation to output the result. attention weights And through softmax normalization, the attention weight generation process is as follows: ， ， ， in, This represents the result of global average pooling. It is global average pooling. This represents the hidden representation after convolution activation. This represents a 1x1 convolution. Indicates temperature parameter, This represents the final attention weight vector. yes The Each component.

5. The multi-task URL detection method that integrates structural and semantic features according to claim 1, characterized in that, The steps preceding step S03 also include: The extracted structural features are input into a feature projection module containing a two-layer fully connected network and a ReLU activation network. First, the structural features are mapped from the original dimension to the intermediate hidden space. ReLU activation is used to enhance the non-linear expressive power. Then, they are projected to the same dimension as the semantic features output by the dynamic convolution.

6. The multi-task URL detection method that integrates structural and semantic features according to claim 1, characterized in that, In step S03, the semantic features and structural features are linearly transformed and then combined by outer product in each dimension to explicitly model the second-order interaction between semantics and structure, and generate a joint representation vector.

7. The multi-task URL detection method that integrates structural and semantic features according to claim 6, characterized in that, Performing outer product combinations includes: Perform 3×3 convolution and pooling operations on semantic features and structural features respectively to obtain new feature maps. and ; In spatial location The above method fuses two features through matrix outer product, and its calculation method is as follows: ， in, For semantic features, For structural features, express In position Feature map, express In position Feature map, For position The bilinear combination feature at the location.

8. The multi-task URL detection method that integrates structural and semantic features according to claim 1, characterized in that, Step S04 also includes constructing four parallel classification branches based on the fusion features extracted by the shared encoder, with each task corresponding to an independent fully connected branch to output the prediction results for the corresponding task. The main task branch is used for malicious URL identification, generating a probability distribution through a softmax activation function. The first auxiliary task branch is used for short link identification, which uses an independent fully connected layer for prediction. It generates binary labels by comparing whether the URL's main domain belongs to a known short link service platform, where category 0 indicates that the URL is not a short link, and category 1 indicates that it belongs to a short link service. The second auxiliary task branch is used for source classification, and its output is a three-class softmax probability distribution. It performs regular expression matching based on domain keywords to generate three types of source labels: category 0 represents that the URL comes from a search engine; category 1 represents that it comes from a social media platform. Category 2 indicates other or unknown sources; The third auxiliary task branch is used for jump depth prediction. The output of this branch is a three-class prediction result. Based on the structural signals of whether the URL contains the redirect= or url= parameter and whether it contains multiple http substrings, the jump depth is estimated and divided into three levels: category 0 indicates no obvious jump, category 1 indicates the presence of first-level jump features, and category 2 indicates the possible presence of multi-level nested jumps.

9. A multi-task URL detection system that integrates structural and semantic features, characterized in that, include: The input processing module acquires word-level input sequences and extracts structural features; The dynamic convolutional semantic encoding module uses the dynamic convolutional attention module to model the features of word-level input sequences. The dynamic convolutional attention module combines multiple basic convolutional kernels through input-aware weights, dynamically adjusts the convolution results, and obtains context-related semantic features. The bilinear fusion module interacts with the semantic features output by dynamic convolution and the extracted structural features to generate a joint representation vector; The multi-task output module outputs multi-task prediction results based on the joint representation vector; it is trained using a weighted cross-entropy loss function, and its total loss function is as follows: ， in, The loss due to the malicious intent assessment of the main task. , , These correspond to the losses of the three auxiliary tasks respectively. , , , The weights represent the loss terms for each task; the final fusion represents the prediction results of the main task and auxiliary task output by the classifier.

10. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the multi-task URL detection method that integrates structural and semantic features as described in any one of claims 1-8.

Images