Continuous Multi-Task Pre-training for Malicious URL Detection and Webpage Classification

TL;DR

This paper introduces urlBERT, a specialized Transformer-based pre-trained model for URLs, designed to improve malicious URL detection and webpage classification through multi-task learning and novel training strategies.

Contribution

The paper presents urlBERT, a domain-specific pre-trained URL encoder with multi-level pretraining tasks and a grouped sequential learning method for effective multi-task fine-tuning.

Findings

urlBERT outperforms standard models in downstream tasks.

Multi-task mode effectively handles multiple URL-related tasks.

Proposed training strategies improve stability and performance.

Abstract

Malicious URL detection and webpage classification are critical tasks in cybersecurity and information management. In recent years, extensive research has explored using BERT or similar language models to replace traditional machine learning methods for detecting malicious URLs and classifying webpages. While previous studies show promising results, they often apply existing language models to these tasks without accounting for the inherent differences in domain data (e.g., URLs being loosely structured and semantically sparse compared to text), leaving room for performance improvement. Furthermore, current approaches focus on single tasks and have not been tested in multi-task scenarios. To address these challenges, we propose urlBERT, a pre-trained URL encoder leveraging Transformer to encode foundational knowledge from billions of unlabeled URLs. To achieve it, we propose to use 5 unsupervised pretraining tasks to capture multi-level information of URL lexical, syntax, and semantics, and generate contrastive and adversarial representations. Furthermore, to avoid inter-pre-training competition and interference, we proposed a grouped sequential learning method to ensure effective training across multi-tasks. Finally, we leverage a two-stage fine-tuning approach to improve the training stability and efficiency of the task model. To assess the multitasking potential of urlBERT, we fine-tune the task model in both single-task and multi-task modes. The former creates a classification model for a single task, while the latter builds a classification model capable of handling multiple tasks. We evaluate urlBERT on three downstream tasks: phishing URL detection, advertising URL detection, and webpage classification. The results demonstrate that urlBERT outperforms standard pre-trained models, and its multi-task mode is capable of addressing the real-world demands of multitasking.