Phishing URL detection using transformers

A method for detecting a malicious uniform resource locator (URL) the method comprising:

• tokenizing a URL into URL tokens;
• forming a token encoding from the URL tokens by using a Byte Pair Encoding (BPE) model;
• inputting the token encoding into a transformer model;
• in response to inputting the token encoding into the transformer model, receiving an embedding vector from the transformer model;
• calculating a decision statistic from the embedding vector;
• and
• based on the decision statistic indicating the URL is malicious, taking a remedial action that limits access to a resource associated with the URL.

A system comprising:

• one or more hardware processors;
• and
• one or more computer-readable media having executable instructions embodied thereon, which, when executed by the one or more processors, cause the one or more hardware processors to execute actions comprising:
• tokenizing a uniform resource locator (URL) into URL tokens;
• tokenizing metadata associated with the URL into metadata tokens;
• forming a token encoding from the URL tokens and the metadata tokens by generating a Byte Pair Encoding (BPE) that uses a URL specific vocabulary, the token encoding comprising a separator token between the URL tokens and the metadata tokens;
• inputting the token encoding into a transformer model;
• in response to inputting the token encoding into the transformer model, receiving an embedding vector from the transformer model;
• calculating a decision statistic from the embedding vector;
• and
• based on the decision statistic indicating the URL is malicious, taking a remedial action that limits access to a resource associated with the URL.