# PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention network

arXiv: https://arxiv.org/abs/2311.12372 · HTML: https://mlsanity.com/paper/2311.12372/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Nov 2023.

## Built on by (most cited first, 10 of 10)

- [Continuous Multi-Task Pre-training for Malicious URL Detection and Webpage Classification](https://mlsanity.com/paper/2402.11495/) (2024)
- [A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion](https://mlsanity.com/paper/2410.09401/) (2024)
- [From Past to Present: A Survey of Malicious URL Detection Techniques, Datasets and Code Repositories](https://mlsanity.com/paper/2504.16449/) (2025)
- [WebGuard++:Interpretable Malicious URL Detection via Bidirectional Fusion of HTML Subgraphs and Multi-Scale Convolutional BERT](https://mlsanity.com/paper/2506.19356/) (2025)
- [Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection](https://mlsanity.com/paper/2507.22447/) (2025)
- [TIPS: Threat Actor Informed Prioritization of Applications using SecEncoder](https://mlsanity.com/paper/2411.07519/) (2024)
- [Transformers in Protein: A Survey](https://mlsanity.com/paper/2505.20098/) (2025)
- [Proactively Detecting Threats: A Novel Approach Using LLMs](https://mlsanity.com/paper/2601.09029/) (2026)
- [Benchmarking Large Language Models for Zero-shot and Few-shot Phishing URL Detection](https://mlsanity.com/paper/2602.02641/) (2026)
- [GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks](https://mlsanity.com/paper/2606.05844/) (2026)

## Abstract (arXiv)

The proliferation of malicious URLs has made their detection crucial for enhancing network security. While pre-trained language models offer promise, existing methods struggle with domain-specific adaptability, character-level information, and local-global encoding integration. To address these challenges, we propose PMANet, a pre-trained Language Model-Guided multi-level feature attention network. PMANet employs a post-training process with three self-supervised objectives: masked language modeling, noisy language modeling, and domain discrimination, effectively capturing subword and character-level information. It also includes a hierarchical representation module and a dynamic layer-wise attention mechanism for extracting features from low to high levels. Additionally, spatial pyramid pooling integrates local and global features. Experiments on diverse scenarios, including small-scale data, class imbalance, and adversarial attacks, demonstrate PMANet's superiority over state-of-the-art models, achieving a 0.9941 AUC and correctly detecting all 20 malicious URLs in a case study. Code and data are available at https://github.com/Alixyvtte/Malicious-URL-Detection-PMANet.