APEA：一种恶意URL新型识别方法

张慧菲; 杨秀璋; 彭国军

doi:10.11959/j.issn.2096-109x.2025066

您当前的位置：

首页 >

文章列表页 >

APEA：一种恶意URL新型识别方法

学术论文 | 更新时间：2026-01-28

- APEA：一种恶意URL新型识别方法
- APEA:a novel method for identifying malicious URL
- 网络与信息安全学报 2025年11卷第6期页码：77-91
- 作者机构：
  
  1.武汉大学国家网络安全学院，湖北武汉 430072
  2.贵州大学贵州省大数据产业发展应用研究院，贵州贵阳 550025
- 作者简介：
  
  [ "张慧菲（2000- ），女，重庆合川人，武汉大学硕士生，主要研究方向为系统安全和恶意代码分析。" ]
  [ "杨秀璋（1991- ），男，贵州施秉人，贵州大学副教授，主要研究方向为系统安全和恶意代码分析。" ]
  [ "彭国军（1979- ），男，湖北荆州人，武汉大学教授、博士生导师，主要研究方向为信息系统安全。" ]
- 基金信息：
  
  国家自然科学基金(62172308;62562012);贵州省科技计划项目（黔科合基础-zk［2025］面上686）;贵州省科技重大专项计划(黔科合重大专项字[2024]014)
- DOI：10.11959/j.issn.2096-109x.2025066
  中图分类号： TP393
- 收稿：2025-02-06，
  
  修回：2025-08-18，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
张慧菲, 杨秀璋, 彭国军. APEA：一种恶意URL新型识别方法[J]. 网络与信息安全学报, 2025, 11(6): 77-91.

ZHANG Huifei, YANG Xiuzhang, PENG Guojun. APEA:a novel method for identifying malicious URL[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 77-91.
张慧菲, 杨秀璋, 彭国军. APEA：一种恶意URL新型识别方法[J]. 网络与信息安全学报, 2025, 11(6): 77-91. DOI： 10.11959/j.issn.2096-109x.2025066.

ZHANG Huifei, YANG Xiuzhang, PENG Guojun. APEA:a novel method for identifying malicious URL[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 77-91. DOI： 10.11959/j.issn.2096-109x.2025066.

摘要

在数字化时代，随着网络攻击手段不断进化，恶意网页识别已成为网络安全领域的一大挑战。传统的卷积神经网络在恶意网页检测中取得了显著成果，但无法捕获长距离依赖关系且语义捕获能力有限。因此，设计一种新型深度学习模型自适应位置感知嵌入与注意力（adaptive positionally-aware embedding and attention

APEA），为恶意网页识别提出研究新思路。APEA模型采用比Transformer模型更细粒度的字符级信息，以增强模型对恶意统一资源定位符（uniform resource locator

URL）文本中细节特征的感知能力；与Transformer模型类似，将输入的嵌入信息与位置编码相结合，以显式注入顺序信息；新增了全局信息共享机制，有效融合局部和全局特征，以提升模型对复杂恶意URL模式的识别能力。设计的自适应动态权重机制，使模型能够根据不同输入灵活调整多头自注意力机制的各个头的权重，从而捕获更多特征。实验结果表明，相较于现有的基于机器学习和深度学习恶意URL检测方法，APEA模型在检测的准确率、精确率、召回率、

1分数上都表现更好。消融实验结果表明，全局信息共享机制和自适应调整的动态权重更新机制对模型性能的提升均有贡献，相比去掉这两个机制的模型，APEA模型各指标均有2.8%左右的提升。

Abstract

In the digital era

with the continuous evolution of cyberattack methods

the identification of malicious web pages has become a major challenge in the field of network security.Traditional convolutionalneural networks have achieved remarkable results in the detection of malicious web pages

but they are unable to capture long-distance dependencies and have limited semantic capture capabilities.Therefore

a novel deep learning modelnamed APEA was designed and implemented

offering a new research direction for the identification of malicious webpages.APEA model adopted character-level information with a fi

ner granularity than the Transformer to enhance the model's perception of detailed features in malicious URL texts.Similar to the Transformer

input embedding were combined with positional encoding to explicitly incorporate sequential information.Additionally

a global information sharing mechanism wasincorporated to effectively integrate local and global features

thereby improving the model's ability to recognize complex malicious URL patterns.An adaptive dynamic weight update mechanism was designed

enabling the model to flexibly adjust the weights of each head in the multi-head self-attention mechanism according to different input

thus capturing more features.Experimental results showed that compared with existing machine learning and deep learning-based malicious URL detection methods

APEA achieved better performance in terms of detection accuracy

precision

recall

and

1 score.Ablation experiment results indicated that both the global information sharing mechanism and the adaptive dynamic weight update mechanism contribute to the improvement of model performance.Compared with the model with these two mechanisms removed

the APEA model achieves an improvement of approximately 2.8% across all metrics..

关键词

Keywords

references

SALEM A H , AZZAM S M , EMAM O E , et al . Advancing cybersecurity: a comprehensive review of AI-driven detection techniques [J ] . Journal of Big Data , 2024 , 11 ( 1 ): 105 .

MANKAR N P , SAKUNDE P E , ZURANGE S , et al . Comparative evaluation of machine learning models for malicious URL detection [C ] // Proceedings of the 2024 MIT Art, Design and Technology School of Computing International Conference (MITADTSoCiCon) . Piscataway : IEEE Press , 2024 : 1 - 7 .

REYES-DORTA N , CABALLERO-GIL P , ROSA-REMEDIOS C . Detection of malicious URLs using machine learning [J ] . Wireless Networks , 2024 , 30 ( 9 ): 7543 - 7560 .

沙泓州 , 刘庆云 , 柳厅文 , 等 . 恶意网页识别研究综述 [J ] . 计算机学报 , 2016 , 39 ( 3 ): 529 - 542 .

SHA H Z , LIU Q Y , LIU T W , et al . Survey on malicious webpage detection research [J ] . Chinese Journal of Computers , 2016 , 39 ( 3 ): 529 - 542 .

杨胜杰 , 陈朝阳 , 徐逸 , 等 . 基于深度学习与特征融合的恶意网页识别方法研究 [J ] . 信息安全学报 , 2024 , 9 ( 3 ): 176 - 190 .

YANG S J , CHEN Z Y , XU Y , et al . Research on malicious web page identification method based on deep learning and feature fusion [J ] . Journal of Cyber Security , 2024 , 9 ( 3 ): 176 - 190 .

PATIL D R , PATIL J B . Malicious URLs detection using decision tree classifiers and majority voting technique [J ] . Cybernetics and Information Technologies , 2018 , 18 ( 1 ): 11 - 29 .

LE H , PHAM Q , SAHOO D , et al . URLNet: Learning a URL representation with deep learning for malicious URL detection [J ] . arXiv preprint arXiv: 1802.03162 , 2018 .

BOZKIR A S , DALGIC F C , AYDOS M . GramBeddings: a new neural network for URL based identification of phishing Web pages through N-gram embeddings [J ] . Computers & Security , 2023 , 124 : 102964 .

ASHISH V . Attention is all you need [C ] // Advances in neural information processing systems , 30 NeurIPS 2017 . LongBeach, CA, USA : Curran Associates , 2017 : 5998 - 6008 .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . PhishNet: predictive blacklisting to detect phishing attacks [C ] // 2010 Proceedings IEEE INFOCOM . Piscataway : IEEE Press , 2010 : 1 - 5 .

SHENG S , WARDMAN B , WARNER G , et al . An empirical analysis of phishing blacklists [C ] // Proceedings of the Sixth Conference on Email and Anti-Spam (CEAS 2009) . Mountain View, CA, USA : CEAS , 2009 : 1 - 9 .

ABAD S , GHOLAMY H , ASLANI M . Classification of malicious URLs using machine learning [J ] . Sensors , 2023 , 23 ( 18 ): 7760 .

JASWANTHI T , HARSHITHA T , TANYA S , et al . Malicious URL detection: comparative study of machine learning algorithms [C ] // Proceedings of the 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT) . Piscataway : IEEE Press , 2024 : 1 - 5 .

HAMZA A , HAMMAM F , ABOUZEID M , et al . Malicious URL and intrusion detection using machine learning [C ] // Proceedings of the 2024 International Conference on Information Networking (ICOIN) . Piscataway : IEEE Press , 2024 : 795 - 800 .

BANNUR S N , SAUL L K , SAVAGE S . Judging a site by its content: learning the textual, structural, and visual features of malicious web pages [C ] // Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence . New York : ACM , 2011 : 1 - 10 .

HUANG H J , QIAN L , WANG Y J . A SVM-based technique to detect phishing URLs [J ] . Information Technology Journal , 2012 , 11 ( 7 ): 921 - 925 .

AGGARWAL A , RAJADESINGAN A , KUMARAGURU P . PhishAri: Automatic realtime phishing detection on twitter [C ] // Proceedings of the 2012 eCrime Researchers Summit . Piscataway : IEEE Press , 2012 : 1 - 12 .

CUZZOCREA A , MARTINELLI F , MERCALDO F . A machine-learning framework for supporting intelligent web-phishing detection and analysis [C ] // Proceedings of the 23rd International Database Applications & Engineering Symposium on - IDEAS '19 . New York : ACM , 2019 : 1 - 3 .

张杰 , 彭国军 , 杨秀璋 . 基于动态API调用序列和机器学习的恶意逃避样本检测方法 [J ] . 山东大学学报(理学版) , 2022 , 57 ( 7 ): 85 - 93, 102 .

ZHANG J , PENG G J , YANG X Z . Malicious evasion sample detection based on dynamic API call sequence and machine learning [J ] . Journal of Shandong University (Natural Science) , 2022 , 57 ( 7 ): 85 - 93, 102 .

DARAGHMI E Y , QADAN S , DARAGHMI Y A , et al . From text to insight: an integrated CNN-BiLSTM-GRU model for Arabic cyberbullying detection [J ] . IEEE Access , 2024 , 12 : 103504 - 103519 .

ZHANG X , ZHAO J , LECUN Y . Character-level convolutional networks for text classification [C ] // Advances in Neural Information Processing Systems 28 (NIPS 2015) . Montreal, Canada : Curran Associates , 2015 : 649 - 657 .

AFZAL S , ASIM M , JAVED A R , et al . URLdeepDetect: a deep learning approach for detecting malicious URLs using semantic vector models [J ] . Journal of Network and Systems Management , 2021 , 29 ( 3 ): 21 .

YU B Y , TANG F , ERGU D J , et al . Efficient classification of malicious URLs: m-BERT: a modified BERT variant for enhanced semantic understanding [J ] . IEEE Access , 2024 , 12 : 13453 - 13468 .

KOROTEEV M V . BERT: a review of applications in natural language processing and understanding [EB ] . arXiv preprint , 2021 : arXiv: 2103.11943 .

白天翔 , 沈震 , 刘雅婷 , 等 . 平行机器: 一种智能机器的管理与控制框架 [J ] . 智能科学与技术学报 , 2019 , 1 ( 2 ): 181 - 191 .

BAI T X , SHEN Z , LIU Y T , et al . Parallel machine: a framework for the control and management for intelligent machines [J ] . Chinese Journal of Intelligent Science and Technology , 2019 , 1 ( 2 ): 181 - 191 .

MAMUN M S I , AHMAD RATHORE M , LASHKARI A H , et al . Detecting malicious URLs using lexical analysis [M ] . Network and System Security . Cham : Springer International Publishing , 2016 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于半监督学习的Tor匿名网络加密流量分类方法研究