# WebGuard++:Interpretable Malicious URL Detection via Bidirectional Fusion of HTML Subgraphs and Multi-Scale Convolutional BERT

arXiv: https://arxiv.org/abs/2506.19356 · HTML: https://mlsanity.com/paper/2506.19356/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 39 references that are in the map.
- First posted on arXiv 24 Jun 2025.

## Builds on (most cited first, 14 of 14)

- [Grounding DINO: Marrying DINO with Grounded Pre-Training for Open-Set Object Detection](https://mlsanity.com/paper/2303.05499/) (2023)
- [SPAN: Spatial Pyramid Attention Network forImage Manipulation Localization](https://mlsanity.com/paper/2009.00726/) (2020)
- [URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection](https://mlsanity.com/paper/1802.03162/) (2018)
- [KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection](https://mlsanity.com/paper/2403.02253/) (2024)
- [PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detection](https://mlsanity.com/paper/2408.10738/) (2024)
- [Malicious URL Detection using Machine Learning: A Survey](https://mlsanity.com/paper/1701.07179/) (2017)
- [PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention network](https://mlsanity.com/paper/2311.12372/) (2023)
- [Toward More Generalized Malicious URL Detection Models](https://mlsanity.com/paper/2202.10027/) (2022)
- [Multimodal Large Language Models for Phishing Webpage Detection and Identification](https://mlsanity.com/paper/2408.05941/) (2024)
- [TransURL: Improving malicious URL detection with multi-layer Transformer encoding and multi-scale pyramid features](https://mlsanity.com/paper/2312.00508/) (2023)
- [Reliability and Robustness analysis of Machine Learning based Phishing URL Detectors](https://mlsanity.com/paper/2005.08454/) (2020)
- [Semi-supervised Conditional GAN for Simultaneous Generation and Detection of Phishing URLs: A Game theoretic Perspective](https://mlsanity.com/paper/2108.01852/) (2021)
- [PhishGuard: A Convolutional Neural Network Based Model for Detecting Phishing URLs with Explainability Analysis](https://mlsanity.com/paper/2404.17960/) (2024)
- [Fed-urlBERT: Client-side Lightweight Federated Transformers for URL Threat Analysis](https://mlsanity.com/paper/2312.03636/) (2023)

## Built on by (most cited first, 1 of 1)

- [Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection](https://mlsanity.com/paper/2507.22447/) (2025)

## Abstract (arXiv)

URL+HTML feature fusion shows promise for robust malicious URL detection, since attacker artifacts persist in DOM structures. However, prior work suffers from four critical shortcomings: (1) incomplete URL modeling, failing to jointly capture lexical patterns and semantic context; (2) HTML graph sparsity, where threat-indicative nodes (e.g., obfuscated scripts) are isolated amid benign content, causing signal dilution during graph aggregation; (3) unidirectional analysis, ignoring URL-HTML feature bidirectional interaction; and (4) opaque decisions, lacking attribution to malicious DOM components. To address these challenges, we present WebGuard++, a detection framework with 4 novel components: 1) Cross-scale URL Encoder: Hierarchically learns local-to-global and coarse to fine URL features based on Transformer network with dynamic convolution. 2) Subgraph-aware HTML Encoder: Decomposes DOM graphs into interpretable substructures, amplifying sparse threat signals via Hierarchical feature fusion. 3) Bidirectional Coupling Module: Aligns URL and HTML embeddings through cross-modal contrastive learning, optimizing inter-modal consistency and intra-modal specificity. 4) Voting Module: Localizes malicious regions through consensus voting on malicious subgraph predictions. Experiments show WebGuard++ achieves significant improvements over state-of-the-art baselines, achieving 1.1x-7.9x higher TPR at fixed FPR of 0.001 and 0.0001 across both datasets.