Lightweight Malicious URL Detection via Multi-Granularity Knowledge Distillation

Abstract

Malicious URL detection serves as a critical component in safeguarding cyberspace security. Although deep learning models have achieved remarkable performance in identifying complex malicious patterns, their large parameter size and high computational overhead have become bottlenecks restricting their real-time deployment in resource-constrained environments such as gateways and mobile terminals. To address this challenge, this paper proposes Purl-Distill, a lightweight malicious URL detection framework based on multi-granularity knowledge distillation. Different from traditional compression methods that only focus on output alignment, Purl-Distill introduces a multi-granularity alignment mechanism. First, by constructing a multi-layer feature mapping space, it deeply transfers the hierarchical representations of the teacher model from low-level character morphology to high-level semantic logic. Second, a temperature-scaled logits distribution alignment strategy and a joint loss function are designed to accurately capture the decision boundary features of the teacher model. Experimental results demonstrate that on multiple public benchmark datasets, Purl-Distill achieves an order-of-magnitude reduction in model parameters and storage space while maintaining detection accuracy comparable to state-of-the-art (SOTA) teacher models. This work provides an efficient engineering solution for high-performance network security protection in resource-constrained scenarios.