# eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys

arXiv: https://arxiv.org/abs/1702.08568 · HTML: https://mlsanity.com/paper/1702.08568/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Feb 2017.

## Built on by (most cited first, 18 of 18)

- [Recent Trends in Named Entity Recognition (NER)](https://mlsanity.com/paper/2101.11420/) (2021)
- [Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representations](https://mlsanity.com/paper/2208.12248/) (2022)
- [Nebula: Self-Attention for Dynamic Malware Analysis](https://mlsanity.com/paper/2310.10664/) (2023)
- [Web Content Filtering through knowledge distillation of Large Language Models](https://mlsanity.com/paper/2305.05027/) (2023)
- [Transformers for End-to-End InfoSec Tasks: A Feasibility Study](https://mlsanity.com/paper/2212.02666/) (2022)
- [First Step Towards EXPLAINable DGA Multiclass Classification](https://mlsanity.com/paper/2106.12336/) (2021)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [CELEST: Federated Learning for Globally Coordinated Threat Detection](https://mlsanity.com/paper/2205.11459/) (2022)
- [False Sense of Security: Leveraging XAI to Analyze the Reasoning and True Performance of Context-less DGA Classifiers](https://mlsanity.com/paper/2307.04358/) (2023)
- [Learning Explainable Representations of Malware Behavior](https://mlsanity.com/paper/2106.12328/) (2021)
- [Classification of URL bitstreams using Bag of Bytes](https://mlsanity.com/paper/2111.06087/) (2021)
- [Confronting the Reproducibility Crisis: A Case Study of Challenges in Cybersecurity AI](https://mlsanity.com/paper/2405.18753/) (2024)
- [The More, the Better? A Study on Collaborative Machine Learning for DGA Detection](https://mlsanity.com/paper/2109.11830/) (2021)
- [A Transferable and Automatic Tuning of Deep Reinforcement Learning for Cost Effective Phishing Detection](https://mlsanity.com/paper/2209.09033/) (2022)
- [From Past to Present: A Survey of Malicious URL Detection Techniques, Datasets and Code Repositories](https://mlsanity.com/paper/2504.16449/) (2025)
- [On the Reliability and Stability of Selective Methods in Malware Classification Tasks](https://mlsanity.com/paper/2505.22843/) (2025)
- [Sharing FANCI Features: A Privacy Analysis of Feature Extraction for DGA Detection](https://mlsanity.com/paper/2110.05849/) (2021)
- [Iterative Definition Refinement for Zero-Shot Classification via LLM-Based Semantic Prototype Optimization](https://mlsanity.com/paper/2604.27335/) (2026)

## Abstract (arXiv)

For years security machine learning research has promised to obviate the need for signature based detection by automatically learning to detect indicators of attack. Unfortunately, this vision hasn't come to fruition: in fact, developing and maintaining today's security machine learning systems can require engineering resources that are comparable to that of signature-based detection systems, due in part to the need to develop and continuously tune the "features" these machine learning systems look at as attacks evolve. Deep learning, a subfield of machine learning, promises to change this by operating on raw input signals and automating the process of feature design and extraction. In this paper we propose the eXpose neural network, which uses a deep learning approach we have developed to take generic, raw short character strings as input (a common case for security inputs, which include artifacts like potentially malicious URLs, file paths, named pipes, named mutexes, and registry keys), and learns to simultaneously extract features and classify using character-level embeddings and convolutional neural network. In addition to completely automating the feature design and extraction process, eXpose outperforms manual feature extraction based baselines on all of the intrusion detection problems we tested it on, yielding a 5%-10% detection rate gain at 0.1% false positive rate compared to these baselines.