Metadata driven malicious URL detection using RoBERTa large and multi source network threat intelligence.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Natural Language Processing

Background:

• Malicious URLs are a primary vector for cyberattacks like phishing and malware distribution.
• Existing machine learning (ML) and deep learning (DL) models struggle with novel adversarial manipulations.
• Sequential models capture character-level patterns but lack robustness against sophisticated threats.

Purpose of the Study:

• To develop a robust and accurate method for detecting malicious URLs.
• To leverage state-of-the-art large language models for enhanced security.
• To improve the interpretability of malicious URL detection models.

Main Methods:

• Application of RoBERTa-Large transformers, a dual-mechanism large language model.
• Integration of contextualized subword embeddings with metadata signals via attention layers.
• Fine-tuning the model on a balanced dataset of benign, defacement, phishing, and malware URLs.

Main Results:

• Achieved 98% overall accuracy in malicious URL detection.
• Substantially outperformed existing ML and DL models.
• SHAP and LIME analysis confirmed key features (URL length, slash depth, entropy) and identified subtle lexical anomalies through attention heads.

Conclusions:

• Integrating metadata attention with masked language models offers state-of-the-art performance for malicious URL detection.
• The proposed method provides transparent decision-making for real-world applications.
• RoBERTa-Large transformers represent a significant advancement in cybersecurity threat detection.