Unstructured text classification
The technology described herein identifies malicious URLs using a classifier that is both accurate and fast. Aspects of the technology are particularly well adapted for use as a real-time URL security analysis tool because the technology is able to quickly process a URL and produce a warning when a malicious URL is identified. The rapid processing speed of the technology described herein is produced, in part, by use of only a single input signal, which is the URL itself. The high accuracy produced by the technology described herein is achieved by analyzing the unstructured text on both a character-by-character level and a word-by-word level. The technology described herein uses both character-level and word-level information from the incoming URL.
1. One or more computer storage media having computer-executable instructions embodied thereon that, when executed, by one or more processors, causes the one or more processors to perform a method for detecting a malicious URL, the method comprising:
receiving a URL;
forming, from the URL, a first contextual-word embedding that represents a first word identified in the URL and represents a context of the first word in the URL;
forming, from the URL, a second contextual-word embedding that represents a second word identified in the URL and represents a context of the second word in the URL;
processing the first contextual-word embedding in a first parallel component processing leg in a word-level path of the URL classifier, the first parallel component processing leg having a first filter length, a first set of filters learned during training, a first normalization operation, a first pooling operation, and a first activation operation;
processing the second contextual-word embedding in a second parallel component processing leg in a word-level path of the URL classifier, the second parallel component processing leg having a second filter length that is greater than the first filter length, a second set of filters learned during training, a second normalization operation, a second pooling operation, and a second activation operation;
generating a word-level output from the word-level path by concatenating a first output from the first activation operation and a second output from the second activation operation;
generating a decision input vector using the word-level output;
generating a decision statistic using the decision input vector;
determining the decision statistic indicates the URL is malicious; and
automatically blocking access to the URL in response to the decision statistic indicating the URL is malicious.
2. The media of claim 1 , further comprising:
forming a contextual-character embedding from the URL;
inputting the contextual-character embedding into a character-level path of the URL classifier, wherein an input layer of the character-level path comprises a plurality of parallel convolutional layers; and
generating a character-level output from the character-level path.
3. The media of claim 2 , wherein each of the plurality of parallel convolutional layers in the character-level path has an input filter of a different amount of characters.
4. The media of claim 1 , wherein an input layer of the word-level path comprises a plurality of parallel convolutional layers.
5. The media of claim 4 , wherein each of the plurality of parallel convolutional layers in the word-level path has an input filter for words comprising a different amount of characters.
6. The media of claim 1 , wherein the first word is identified by identifying a string of characters in the URL that match a word in a URL specific vocabulary.
7. The media of claim 6 , wherein the URL specific vocabulary is generated by decomposing a corpus of URLs into n-grams and then adding n-grams that occur above a threshold number of times within the corpus to the URL specific vocabulary.
8. A method for detecting a malicious URL, the method comprising:
receiving a URL;
forming a contextual-word embedding from the URL by identifying a string of characters in the URL that match a word in a URL specific vocabulary;
processing the contextual-word embedding in a word-level path of a URL classifier, wherein the word-level path comprises a first text processing block and a second text processing block arranged in series, wherein the first text processing block includes a first set of parallel convolutional layers, a first set of parallel pooling layers, a first set of parallel activation layers, and a first concatenation layer to generate a first matrix from an output of the first set of parallel activation layers, and wherein the second text processing block includes a second set of parallel convolutional layers, a second set of parallel pooling layers, and a second set of parallel activation layers;
generating a word-level output from the word-level path;
generating a decision input vector using the word-level output as an input;
generating a decision statistic using the decision input vector;
determining the decision statistic indicates a classification; and
automatically blocking access to the URL in response to the classification.
9. The method of claim 8 , wherein the URL specific vocabulary is generated by decomposing a corpus of URLs into n-grams and then adding n-grams that occur above a threshold number of times within the corpus to the URL specific vocabulary.
10. The method of claim 8 , wherein an input layer of the word-level path comprises a plurality of parallel convolutional layers.
11. The method of claim 10 , wherein each of the plurality of parallel convolutional layers in the word-level path has an input filter for words comprising a different amount of characters.
12. The method of claim 8 , wherein, excluding training data, the URL is the only input processed to generate the decision statistic.
13. The method of claim 8 , wherein the method further comprises:
forming a contextual-character embedding from the URL;
inputting the contextual-character embedding into a character-level path of the URL classifier;
generating a character-level output from the character-level path; and
wherein the character-level output is also used to form the decision input vector.
14. The method of claim 13 , wherein an input layer of the character-level path comprises a plurality of parallel convolutional layers, and wherein each of the plurality of parallel convolutional layers in the character-level path has an input filter of a different amount of characters.
15. The method of claim 14 , wherein the contextual-word embedding represents a first word identified in the URL and a context of the first word in the URL.
16. A method for detecting a malicious URL, the method comprising:
receiving an unstructured text;
forming a first contextual-character embedding of a first amount of characters from the unstructured text;
forming a second contextual-character embedding of a second amount of characters from the unstructured text, wherein the first amount is less than the second amount;
processing the first contextual-character embedding in a first parallel component processing leg within a character-level path of a classifier, wherein the first parallel component processing leg includes a first set of filters learned during training, a first normalization operation, a first pooling operation, and a first activation operation;
processing the second contextual-character embedding in a second parallel component processing leg within the character-level path of the classifier, wherein the second parallel component processing leg includes a second set of filters learned during training, a second normalization operation, a second pooling operation, and a second activation operation;
generating a first character-level output from the character-level path by concatenating a first output from the first activation operation with a second output from the second activation operation;
generating a decision input vector using the first character-level output as an input;
generating a decision statistic using the decision input vector;
determining the decision statistic indicates the unstructured text is classified as a security risk; and
automatically blocking access to the content associated with the unstructured text in response to the classification.
17. The method of claim 16 , wherein an input layer of the character-level path comprises a plurality of parallel convolutional layers.
18. The method of claim 16 , further comprising:
forming a contextual-word embedding from the unstructured text;
inputting the contextual-word embedding into a word-level path of the classifier;
generating a word-level output from the word-level path; and
wherein the word-level output is also used to form the decision input vector.
19. The method of claim 18 , wherein an input layer of the word-level path comprises a plurality of parallel convolutional layers, and wherein each of the plurality of parallel convolutional layers in the word-level path has an input filter for words comprising a different amount of characters.
20. The method of claim 16 , wherein, excluding training data, the unstructured text is the only input processed to generate the decision statistic.