A novel approach for malicious URL detection using RoBERTa and sparse autoencoder

Detecting malicious URLs within requests is an effective method for blocking Web threats. Current methods for detecting malicious URLs mainly rely on supervised machine learning algorithms to construct classification models, which consequently demand high-quality training data. And these methods also have limitations in detecting malicious samples, resulting in a high false negative rate when encountering unknown anomalies. This paper proposes an anomaly detection method based on RoBERTa and sparse autoencoder for detecting malicious URLs. This method initially involves preprocessing the URL samples. Subsequently, RoBERTa is used to extract features from URLs and converts them into feature vectors. Sparse autoencoder is utilized to detect malicious samples ultimately. During the model training process, only benign samples are used as input. It enables sparse autoencoder to effectively reconstruct the characteristics of benign samples to identify malicious ones. This method was tested on the dataset composed of CSIC2010 and PRDREQ. The experimental results show that the detection model achieves an accuracy of 0.9921, a recall of 0.9863, and an F1 score of 0.9887, outperforming all baseline methods.