Reproduce “IP-Augmented Multi-Modal Malicious URL Detection Via Token-Contrastive Representation Enhancement and Multi-Granularity Fusion” on OpenResearch

About this paper

Ye Tian, Yanqiu Yu, Liangliang Song, Zhiquan Liu, Yanbin Wang, Jianguo Sun

The CURL-IP framework introduces an IP-augmented multi-modal approach for malicious URL detection, integrating character-aware contextual representations with network-level IP features. This system achieves an F1-score of 0.9797 and an AUC of 0.9946 on a full dataset, demonstrating superior performance and identifying 100% of live phishing URLs in a practical validation.

Key insights

• Integrating character-aware contrastive learning into PLMs significantly improves their ability to detect subtle token-level variations and obfuscation techniques critical for URL analysis.
• Aggregating features across multiple Transformer layers effectively captures both local character patterns and global hierarchical contexts within URLs, enhancing structural understanding.
• Fusing URL content with auxiliary network-level IP information through a fine-grained, dynamic attention mechanism yields more robust and adaptable threat detection, especially against sophisticated evasion.

Summary by alphaXiv.