Attacker-aware contrastive learning for robust malicious URL classification

Uniform Resource Locators (URLs) are frequently exploited as entry points for cyberattacks such as phishing, malware distribution, and website defacement. Detecting malicious URLs directly from their lexical structure, without page retrieval, is essential for low-latency defense but remains challenging due to adversarial obfuscations (e.g., homoglyphs, zero-width insertions, subdomain stuffing) and severe class imbalance in real-world corpora. To address these issues, we propose an attacker-aware lexical classification pipeline that combines structure-preserving tokenization, a library of attacker-style augmentations, supervised contrastive (SupCon) pretraining, and class-weighted focal loss fine-tuning. The Transformer encoder serves as the feature extraction model, while a lightweight MLP head performs classification. Empirical evaluations performed on the large Kaggle malicious phishing dataset show that the proposed methodology achieves the accuracy of 99.57% and the macro-F1 score of 99.38% on a hold-out test set, and thus consistently outperforms previously established state-of-the-art baselines. Notably, minority classes, which includes malware, achieves an accuracy and macro-G1 score greater than 99% in all aspects of measurement, highlighting the resentment of the method to adversarial string perturbations. The framework developed is computationally efficient, content agnostic and capable of deployment in a real-time operational scenario that provides a pragmatic defence mechanism against modern cyber threats.