Scholarlink

<p>In this study, we address the critical security challenge of detecting malicious URLs, which serve as primary cause for website phishing, malware attacks, and website defacement. Detection of malicious links has remained active research in Artificial Intelligence as machine learning (ML) models and deep learning (DL) are applied in this regard. The use of sequential models captures character-level patterns but remain vulnerable to novel adversarial manipulations. This study proposes to apply state of the art large language model which are dual-mechanism, RoBERTa-Large transformers that combine contextualized subword embeddings with lightweight metadata signals via attention layers. Fine-tuned on a balanced dataset encompassing benign, defacement, phishing, and malware URLs, the model achieves 98% overall accuracy substantially outperforming ML and DL models. To enhance interpretability, SHAP and LIME explainability analysis, confirming that features such as URL length, slash depth, and entropy drive predictions, while the transformer’s attention heads isolate subtle lexical anomalies. The empirical analysis-based findings demonstrate that integrating metadata attention with a masked language model yields state-of-the-art performance and transparent decision-making for real-world malicious URL detection.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Metadata driven malicious URL detection using RoBERTa large and multi source network threat intelligence

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年1月29日

查看全文
  • Lina Chen,
  • Liang Meng

摘要

In this study, we address the critical security challenge of detecting malicious URLs, which serve as primary cause for website phishing, malware attacks, and website defacement. Detection of malicious links has remained active research in Artificial Intelligence as machine learning (ML) models and deep learning (DL) are applied in this regard. The use of sequential models captures character-level patterns but remain vulnerable to novel adversarial manipulations. This study proposes to apply state of the art large language model which are dual-mechanism, RoBERTa-Large transformers that combine contextualized subword embeddings with lightweight metadata signals via attention layers. Fine-tuned on a balanced dataset encompassing benign, defacement, phishing, and malware URLs, the model achieves 98% overall accuracy substantially outperforming ML and DL models. To enhance interpretability, SHAP and LIME explainability analysis, confirming that features such as URL length, slash depth, and entropy drive predictions, while the transformer’s attention heads isolate subtle lexical anomalies. The empirical analysis-based findings demonstrate that integrating metadata attention with a masked language model yields state-of-the-art performance and transparent decision-making for real-world malicious URL detection.