We introduce a state-of-the-art approach for URL categorization that leverages the power of Large Language Models (LLMs) to address the primary objectives of web content filtering: safeguarding organizations from legal and ethical risks, limiting access to high-risk or suspicious websites, and fostering a secure and professional work environment. Our method utilizes LLMs to generate accurate classifications and then employs established knowledge distillation techniques to create smaller, more specialized student models tailored for web content filtering. Distillation results in a student model with a 9% accuracy rate improvement in classifying websites, sourced from customer telemetry data collected by a large security vendor, into 30 distinct content categories based on their URLs, surpassing the current state-of-the-art approach. Our student model matches the performance of the teacher LLM with 175 times less parameters, allowing the model to be used for in-line scanning of large volumes of URLs, and requires 3 orders of magnitude less manually labeled training data than the current state-of-the-art approach. Depending on the specific use case, the output generated by our approach can either be directly returned or employed as a pre-filter for more resource-intensive operations involving website images or HTML.
Web content filtering is crucial for maintaining network security and regulatory compliance in
organizations[
Traditional approaches to website categorization have relied upon creating and
maintaining domain-to-category mappings, which are lists of domains grouped by their
manually assigned categories [
Maintaining domain-to-category mapping lists and extending them with signatures remains
critical in the early stages of security pipelines [
In addition to acting as a pre-filter, domain-to-category mapping lists and label propagation
signatures are often used to create the training sets for machine learning models. However,
machine learning algorithms tend to memorize patterns rather than understand underlying
concepts [
For unknown or new domains, the model must infer a description from the URL. It is useful
to view URL classification, especially for web content filtering, as a natural language processing
task, considering URLs as semi-sentences. For a fair amount of our categories, the URL will
frequently have explicit words to advertise its content, specifically semantically related keywords
for the given category. For example, a site selling weapons will often contain keywords such
as “armaments” or “glock” or “gun”. The current state-of-the-art in URL detection and our
chosen baseline, URLTran [
Direct use of LLMs for URL content classification in production is prohibitive due to cost
considerations at scale [
The main contributions of this paper are as follows: • We demonstrate that when fine-tuned on data labeled with domain propagation signatures, large language models outperform standard deep learning models by 9% in terms of accuracy on the long tail categorization problem. • We demonstrate that we can fine-tune a large language model using 10000 samples to achieve better performance than the current state-of-the-art approach trained on 10 million samples. • We showcase the efective application of knowledge distillation from a fine-tuned LLM to boost the performance of a smaller, more computationally eficient model, specifically for web content filtering tasks. We attain performance levels comparable to the original LLM using a model that is 175 times smaller, decreasing from 770 million parameters to just 4 million. This reduction in size makes the model more suitable for production and enables practical deployment across various contexts, such as serving as a general pre-filter for all incoming network trafic in firewalls. • We propose a novel validation approach for the community to adopt, which more accurately assesses model performance in realistic scenarios where it works alongside a domain-to-category mapping list of ground truth labels, extended via domain label propagation signatures. In this setting, the model analysis focuses on labeling the long tail, focusing on a more relevant metric.
Our paper is structured as follows: In Section 1 we introduce the research problem and elucidate the motivation behind our proposed approach. In Section 2 we review relevant literature and prior work in the field. In Section 3, we provide a comprehensive description of our methodology, encompassing the dataset and experimental setups. In Section 4 we present our results, which include a comparison of our approach’s performance against the current state-of-the-art, an analysis of the benefits of LLMs in terms of accuracy and sample eficiency, as well as an exploration of deployment challenges and our proposed solution utilizing knowledge distillation for more compact and computationally eficient models. Lastly, In Section 5 we conclude the paper, outlining potential avenues for future research in this domain.
Previous work in this field has primarily focused on security classification rather than content classification and filtering. Since machine learning approaches to security classification can be readily reformulated from binary classification to multi-class classification through modification of the last layer in the neural network, approaches to security classification are relevant to the task of content classification. We will compare and build upon security publications as they are better studied.
Early work on URL-only classification for phishing detection using manually derived feature
sets employed both generic features and features meant to detect certain obfuscation techniques
such as obfuscation of the host with another domain [
The manual feature extraction approach is dificult to maintain as adversaries tend to adapt
obfuscation methods to avoid detection so models have shifted to a featureless approach based
on the raw string as input. Deep learning methods learn and then automatically extract the
feature set from the raw URL during training. The use of automatically extracted features does
not preclude the inclusion of manual features however as the optimal input combination of
manual and automatic features can be optimized with genetic algorithms [
Automatic feature extraction can be done on various levels of granularity starting at the
character level. Saxe et al. [
The application of word-level tokenization to URL classification was first proposed by Le
et al. [
In addition, to feature set selection, the choice of model architecture plays a large role in
the performance of a URL classification model. Transformers have achieved state-of-the-art
results in many natural language processing tasks making them a good candidate for URL
classification after fine-tuning or even custom pre-training [
Other architectures applied to URL classification include graphical networks [ 37, 38] and
GANs [39, 40]. AutoEncoders have proven useful against zero-day attacks [41]. In addition
to the URL and HTML sequences, but beyond the scope of this paper, images of the webpage
may be incorporated [42, 43]. The task of classification may be reformulated by approaching
detection from a reinforcement learning perspective [44] or from the perspective of thwarting
an adversarial opponent [
The current state-of-the-art for URL-only classification for phishing detection, URLTran [
3.1. Data In this section, we describe our methodology for collecting data and constructing training, validation, and test sets. We also explain our experimental setup and provide a detailed account of how we trained our model.
We obtained our dataset from a large security vendor’s customer telemetry data sourced from its firewall and endpoint products over a period spanning July 1, 2022 to December 23, 2022.
We track 30 categories in our dataset. These categories were defined by a team of expert analysts to be representative of the most common internet content categories as well as the most impactful, which we define as the potential to impact productivity, the degree of liability for the organization, and the degree of associated ethical concerns. The categories include: “Chat”, “Games”, “Shopping”, “Sports”, “News”, “Job Search”, “Search Engines”, “Alcohol”, “Gambling”, “Weapons”, “Porn”, “Banking”, “Business”, “Education”, “Entertainment”, “Food and Dining”, “Government”, “Health and Medicine”, “Motor Vehicles”, “Peer to Peer”, “Real Estate”, “Religion”, “Travel”, “Translators”, “Computer and Internet”, “Hunting and Fishing”, “Marijuana”, “Radio and Audio Hosting”, “Social Networking”, and “Video Hosting”. The majority of websites in our dataset belong to categories such as “Computer and Internet”, “Search Engines”, and “Business”, while niche categories such as “Hunting and Fishing” and “Marijuana” have fewer instances. Figure A5 shows the distribution of categories in our dataset. We define our categorization task as a closed-world problem, meaning every URL belongs to one of the 30 categories. It’s important to note that, due to limitations in the domain-to-category database, we only consider a single category per URL, even though some pages may realistically have multiple category labels.
To construct our training dataset which spans the period from July 1, 2022 to August 19, 2022, we uniformly sampled 10 million distinct URLs, out of the billions of URL lookups, that have been labeled using a domain-to-category mapping database with label propagation. Additionally, we sampled 10 million URLs from this period that did not correspond to a signature (unlabeled). The unlabeled URLs were set aside for training augmentation purposes.
We sampled an evaluation dataset spanning from August 19, 2022 to December 23, 2022 and divided it into two validation and test sets to assess our model’s performance in diferent scenarios. The validation sets were based on data first seen between August 19, 2022 and November 24, 2022 while the test sets included data first seen between November 24, 2022 and December 23, 2022.
We created a domain and time split to simulate a long tail deployment setting. We separated the data based on the first-seen time of the URL and the first-seen time of the URL’s domain. The ifrst-seen time of a domain refers to the earliest instance of a URL from that domain. Meaning, there is no domain overlap between the training, validation, and test sets. This approach allowed us to better approximate the unlabeled part of the telemetry.
To compare our results with the industry-standard evaluation methodology we also created a time split. This split was sampled from the same time span as the domain and time split but without the constraint of dividing based on the domain’s first-seen time.
For the domain and time split, the validation set was comprised of 79,313 unique URLs from 30,897 unique domains, with a maximum of 5 URLs per domain. The test set included 110,624 unique URLs from 43,996 domains. For the time split, we sampled 183,935 URLs from 62,961 domains.
To compare the various splits, we display the most common domains and their frequencies for the labeled training data, both test splits, and the unlabeled training data in Table 1. The labeled training set and the time split are dominated by common domains such as “google.com”. The domain and time split is most similar to the unlabeled long tail of the data where the desired value of machine learning resides.
To quantitatively assess the disparities between the domain distributions of the time split and the domain and time split, which more closely models the long tail, we employed the Kullback-Leibler (KL) divergence as a metric for measuring the dissimilarity between token distributions. The KL divergence values were calculated between each validation split and the training dataset as the reference. We tokenized all the URLs in the training dataset using BERT tokenization and then combined all of the tokens to define the distribution of the base training dataset. We tokenized all the URLs in both validation splits using BERT tokenization and each token sequence was converted into probability distributions by computing normalized histograms. The KL divergence between the token probability distribution of each URL and the reference distribution was then determined using the entropy function. Figure 2 illustrates that the token distribution of the domain and time split displays substantially higher KL divergence values from the reference compared to the time split. This observation highlights the distinct nature of the domain distributions in the two validation splits and the similarity between the unlabeled part of the customer telemetry and the domain and time split.
The primary objective of our experiments was to identify the best-performing model in terms of accuracy on our dataset, while using as few training labels and being as small as possible. To achieve this, we varied the training set size as a hyperparameter for each LLM, compact model, and the baseline. We explored training set sizes ranging from few-shot to large-scale learning, increasing the sample size from 10 samples per category to 5 million total samples, growing by an order of magnitude at each step. For a given sample step size , the exact samples per category were determined by the minimum of and the total labeled instances in that category.
Our next goal was to refine the top-performing large language model (LLM) configuration into a more compact student model. We achieved this by using labels generated by the bestperforming LLM to train smaller models.
We labeled 10 million unlabeled URLs from our dataset using the best-performing LLM, utilizing them as hard labels. This resulted in a total of 20 million training set with the 10 million signature-labeled base training set and an additional 10 million labels generated by the LLM. We then investigated the impact of combining these labels using various mixing ratios of labeled samples from the base training set and LLM-labeled samples. Each compact student model and baseline were trained on a variety of dataset configurations, each containing a total of 10 million samples.
We began with a 10-million base training set, incorporating LLM-generated labels at 0.0, 0.25, 0.50, 0.75, and 1.0 ratios. The 0.0 ratio used only the base training set, while the 0.25 ratio included 7.5 million base URLs and 2.5 million LLM-generated. At 0.5, the sources were evenly split with 5 million each. The 0.75 ratio contained 2.5 million base and 7.5 million LLM URLs, and the 1.0 ratio relied solely on LLM-generated labels. By varying the mixing ratios, we were able to assess the efectiveness of our knowledge distillation process and compare the contributions of LLM-generated labels to simply using signature-generated labels.
We trained and compared the performance of five models: BERT-based URLTran as the
baseline[
For all models, we pre-processed the data by splitting at the first occurrence of the “?” character
and removing the query parameters. The query is assumed to be noisy and without any
meaningful information. All URLs were truncated to a fixed length of 128 characters as we have
seen no improvement in further increasing the size. The base pre-trained models and tokenizers
for all T5 Large, BERT, and BERTiny configurations were the HuggingFace defaults [
For all reported T5 configurations, we fine-tuned all weights of a pre-trained T5 Large model
using the Adafactor optimizer [
T5 and GPT-3 are generative models that can utilize semantic relationships between class labels and keywords in a URL for making predictions. Consequently, we employed literal class labels as our prediction target. When reporting aggregate metrics, out-of-vocabulary (OOV) predictions are not considered as a separate class, and they were considered as misclassfication for every class. Additionally, any unlabeled data for which LLM generates an OOV prediction is excluded from the distillation process.
For GPT3 the temperature was set to 0 to ensure deterministic results upon inference. The logit bias for tokens associated with the class labels were set to 100 to ensure exclusive selection of expected tokens. Finally, the stop token was set to the stop sequence seen during training.
For the student models, we trained a 1D convolutional eXpose model and fine-tuned all weights of a pre-trained BERTiny model. We fine-tuned all weights of a pre-trained BERT model to reproduce the architecture of URLTran as our baseline. No custom vocabulary was created for the BERT-based models. Hyperparameter configurations for T5, BERTiny, BERT, and eXpose may be found in Tables A7, A4, A5, and A6 respectively.
In this section, we present the key findings and results of our two sets of experiments. We report the results in terms of accuracy, with additional metrics for both experiments provided in the Appendix.
The performance of various models as a function of the log of the training sample counts is displayed in Figure 3. The top-scoring configuration for each model is detailed in Table 2. On the domain and time split, the best performing model, T5 Large, achieves 46.3% accuracy after being fine-tuned on 10,000 samples. GPT-3 Babbage attains 44.4% accuracy after fine-tuning on 10,000 samples. Both LLMs surpass the best baseline configuration, which achieves 38.3% accuracy. BERTiny and eXpose achieve 35.7% and 30.2% accuracy, respectively, when trained on 5 million samples.
On the time split, eXpose achieves 92.8% accuracy when trained on 5 million samples. BERTiny, ifne-tuned on 5 million samples, attains 97.6% accuracy. The best configurations for the baseline, GPT-3 Babbage, and T5 Large achieve 97.1%, 98.14%, and 97.5% accuracy, respectively. Additional metrics for the time split are reported in Table A10, and for the domain and time split in Table A9 for all experiments.
On the domain and time split, the best performance was achieved with T5 on 10,000 training samples, so we selected it as our teacher model. For the domain and time split, we found the best ratio to be 1.0, where every training sample had 10 million previously unlabeled URLs labeled by T5. Training eXpose on all of them increases the accuracy from 31.5% to 45%. Fine-tuning BERTiny on all 10 million LLM labels, compared to the 10 million base training set, improves the accuracy from 37.5% to 46.2%. Finally, fine-tuning URLTran on all 10 million LLM labels, compared to the 10 million base training set, raises the accuracy from 41.6% to 46.8%.
For the traditional time split, the augmentation at a ratio of 0.75 also increased the performance, albeit marginally.
The performance of the students and the baseline trained via knowledge distillation is shown in the augmentation plot of Figure 3 as a function of the LLM label ratio in the training data. The top-scoring distillation configuration for each student model is detailed in Table 2. 4.1. Discussion A comparison of the models’ performance on the two evaluation splits reveals that results on the time split, the traditional validation approach, are overly optimistic. Small models such as BERTiny, trained merely on signature-driven data, exhibit performance comparable to T5 and GPT-3. The disparity in model performance between the domain and time split versus the time split, particularly for small models, underscores that signature-sourced data is repetitive and can be memorized with just a few million parameters. Time split validation measures a model’s ability to match the signature distribution while in a production setting the primary concern within the context of the overall pipeline is a model’s capacity to generalize to new data from the long tail that falls outside the coverage of signatures.
When considering the domain and time split—which aligns more closely with real-world performance on unlabeled data—small models no longer match the performance of LLMs, as seen in Figure 3. Beyond 10,000 samples, LLMs show minimal to no performance gains when scaling up further. Conversely, the performance of small models and the baseline has not yet converged at 5 million training samples. This demonstrates the sample-eficiency of LLMs in the domain of website content categorization.
LLMs outperform student models in terms of performance, but they still fall short of perfection when applied to domain and test splits. This discrepancy can be attributed to two main factors. First, due to dataset limitations, web content classification is framed as a single-label classification problem. Table 3 displays a set of LLM misclassifications on domain and time split, highlighting that a URL could potentially belong to multiple categories. In the first three samples, the analyst opted for the more generic label, while the model choose the more generic labels in the following three samples. Both predicted and true labels could be considered correct in all six cases, suggesting that the true performance is likely better than the metrics indicate because of the single-label limitation. This trade-of between equally correct specific and general labels becomes evident when examining the confusion matrix, displayed in Figure A4 in the Appendix, for a T5 Large model’s performance on the domain and time split. As we can see on the confusion matrix, the LLM tends to generate class labels that are more specific than manual labels.
The second factor occurs when a URL lacks keywords or context related to its category, as demonstrated by the last six entries in Table 3. For the middle two URLs, the model was misled by a prominent keyword in the URL, which was unrelated to its content. The final four URLs contain no apparent signal. Consequently, the large-scale pre-training of LLMs struggles to efectively transfer knowledge to a URL from the long tail. This means that if a URL lacks clear or strong indicators of its category, the LLM may not accurately classify it, leading to misclassifications.
Our results reveal that mixing in the LLM-generated labels significantly enhances the performance of student models BERTiny and eXpose as we can see on Figure 3. Through this simple form of augmentation, we nearly matched the 46.3% accuracy of T5 Large, the best-performing LLM, with a transformer model that has a parameter count several orders of magnitude smaller (0.57% of the teacher) and could reasonably be deployed in-line in production.
In conclusion, our paper contributes to the field of web content classification with the development of lightweight models distilled from fine-tuned LLMs. We have demonstrated that LLMs, when fine-tuned on data labeled with domain propagation signatures, significantly outperform the current state-of-the-art approach on the long tail categorization problem. Our teacherstudent training approach enables the distillation of LLMs into models 175 times smaller without sacrificing accuracy, thus making deployment practical in a wide variety of new contexts. The amount of manual labels required to finetune the teacher LLM is orders of magnitude smaller than what is required for convergence of the current state-of-the-art approach. Furthermore, we have proposed a new validation approach that better measures model performance in more realistic scenarios, which should be adapted by the community to improve generalization capabilities to unseen data.
Expanding beyond web content classification, the cybersecurity field could greatly benefit from proven methods of distilling large language models (LLMs) into more compact versions. This approach is particularly valuable when dealing with large data volumes and expensive training samples, especially when the model is applied to out-of-distribution cases. For addressing web content classification tasks specifically, we suggest future work should focus on augmenting the training data and feature space with HTML and image data, utilizing GPT-4 as a teacher, allowing URLs to have more than one label, and re-working signatures for the assignment of general categories. [28] A. Joulin, E. Grave, P. Bojanowski, M. Douze, H. Jégou, T. Mikolov, Fasttext.zip: Compressing text classification models, arXiv preprint arXiv:1612.03651 (2016). [29] S.-J. Bu, H.-J. Kim, Learning disentangled representation of web address via convolutionalrecurrent triplet network for classifying phishing urls, in: 2021 International Conference on Electronics, Information, and Communication (ICEIC), IEEE, 2021, pp. 1–4. [30] E. M. Rudd, A. Abdallah, Training transformers for information security tasks: A case study on malicious url prediction, arXiv preprint arXiv:2011.03040 (2020). [31] E. M. Rudd, M. S. Rahman, P. Tully, Transformers for end-to-end infosec tasks: A feasibility study, in: Proceedings of the 1st Workshop on Robust Malware Analysis, 2022, pp. 21–31. [32] W. Chang, F. Du, Y. Wang, Research on malicious url detection technology based on bert model, in: 2021 IEEE 9th International Conference on Information, Communication and Networks (ICICN), IEEE, 2021, pp. 340–345. [33] H. Shirazia, K. Haynesb, I. Raya, Towards performance of nlp transformers on url-based phishing detection for mobile devices, Journal of Ubiquitous Systems and Pervasive Networks, Volume 17,No. 1(2022) pp. 35-42 (2022). [34] Q. Hu, H. Zhou, Q. Liu, Phishing website detection based on multi-feature stacking, in: 2021 2nd International Conference on Artificial Intelligence and Computer Engineering (ICAICE), IEEE, 2021, pp. 716–720. [35] C. Wang, Y. Chen, Tcurl: Exploring hybrid transformer and convolutional neural network on phishing url detection, Knowledge-Based Systems (2022) 109955. [36] S. Venugopal, S. Y. Panale, M. Agarwal, R. Kashyap, U. Ananthanagu, Detection of malicious urls through an ensemble of machine learning techniques, in: 2021 IEEE Asia-Pacific Conference on Computer Science and Data Engineering (CSDE), IEEE, 2021, pp. 1–6. [37] S. Ariyadasa, S. Fernando, S. Fernando, Combining long-term recurrent convolutional and graph convolutional networks to detect phishing sites using url and html, IEEE Access 10 (2022) 82355–82375. [38] T. Bilot, G. Geis, B. Hammi, Phishgnn: A phishing website detection framework using graph neural networks, Conference: SECRYPT 2022At: Lisbon (2022). [39] S. A. Kamran, S. Sengupta, A. Tavakkoli, Semi-supervised conditional gan for simultaneous generation and detection of phishing urls: A game theoretic perspective, arXiv preprint arXiv:2108.01852 (2021). [40] J. Geng, S. Li, Z. Liu, Z. Cheng, L. Fan, Efective malicious url detection by using generative adversarial networks, in: International Conference on Web Engineering, Springer, 2022, pp. 341–356. [41] S.-J. Bu, S.-B. Cho, Deep character-level anomaly detection based on a convolutional autoencoder for zero-day phishing url detection, Electronics 10 (2021) 1492. [42] J. Yuan, G. Chen, S. Tian, X. Pei, Malicious url detection based on a parallel neural joint model, IEEE Access 9 (2021) 9464–9472. [43] R. Liu, Y. Lin, X. Yang, S. H. Ng, D. M. Divakaran, J. S. Dong, Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach, in: 30th {USENIX} Security Symposium ({USENIX} Security 21), 2022, p. 1. [44] O. Lavie, A. Shabtai, G. Katz, A transferable and automatic tuning of deep reinforcement learning for cost efective phishing detection, arXiv preprint arXiv:2209.09033 (2022). [45] Z. Peng, Y. He, Z. Sun, J. Ni, B. Niu, X. Deng, Crafting text adversarial examples to attack the
vocab_size 76 filter_size 128 dropout 0.05 learning rate 1e-3 batch size 49160 optimizer Adam maximum training epochs 20 scale_parameter relative_step warmup_init