  The widespread use of the Internet has revolutionized information retrieval
methods. However, this transformation has also given rise to a significant
cybersecurity challenge: the rapid proliferation of malicious URLs, which serve
as entry points for a wide range of cyber threats. In this study, we present an
efficient pre-training model-based framework for malicious URL detection.
Leveraging the subword and character-aware pre-trained model, CharBERT, as our
foundation, we further develop three key modules: hierarchical feature
extraction, layer-aware attention, and spatial pyramid pooling. The
hierarchical feature extraction module follows the pyramid feature learning
principle, extracting multi-level URL embeddings from the different Transformer
layers of CharBERT. Subsequently, the layer-aware attention module autonomously
learns connections among features at various hierarchical levels and allocates
varying weight coefficients to each level of features. Finally, the spatial
pyramid pooling module performs multiscale downsampling on the weighted
multi-level feature pyramid, achieving the capture of local features as well as
the aggregation of global features. The proposed method has been extensively
validated on multiple public datasets, demonstrating a significant improvement
over prior works, with the maximum accuracy gap reaching 8.43% compared to the
previous state-of-the-art method. Additionally, we have assessed the model's
generalization and robustness in scenarios such as cross-dataset evaluation and
adversarial attacks. Finally, we conducted real-world case studies on the
active phishing URLs.
