DeepTrace was the starting point of this research direction: a hybrid architecture combining a fine-tuned transformer-based URL encoder with handcrafted lexical features and a learned signal derived from a separately trained gradient-boosted tree ensemble. Evaluated across six progressively more complex configurations, the fully combined approach achieved the strongest result of any configuration tested, with accuracy and F1 above 98%. DeepTrace also underlies SafeBrowse, an applied browser-safety concept built around this detection approach (see Projects).
Detecting malicious URLs directly from the URL string offers a lightweight alternative to approaches that require downloading and analyzing full webpage content. Prior work has typically treated handcrafted lexical features and learned transformer-based representations as separate, competing strategies, DeepTrace asks whether combining them, and further enriching the result with structural information from a separately trained ensemble model, produces a meaningfully stronger detector than either approach alone.
The architecture works in stages: a transformer encoder produces a contextual embedding for each URL; a lightweight feature extractor produces a complementary set of handcrafted structural signals; these are combined and passed through a separately trained tree ensemble, not to use its predictions directly, but to extract which internal decision path each tree routes the input through, as an additional learned signal; this signal is combined back with the original representation and classified by a final ensemble model.
A systematic evaluation compared six configurations of increasing complexity, from a standalone transformer model through to the fully assembled pipeline, with each added component producing a measurable improvement. A follow-up analysis at the level of individual predictions, rather than aggregate scores alone, confirmed that the fully combined approach corrected substantially more errors made by simpler configurations than the reverse, reinforcing that the improvement reflects a genuine, broad effect rather than an artifact of how the metrics were averaged.
DeepTrace was later revisited and substantially extended: subsequent work identified methodological considerations around evaluation design (see the Research Story above) that led to a more rigorous successor framework, built on the same core idea of combining complementary URL representations.
Full methodology, results, and the underlying paper are not disclosed here, as this research is intended for conference submission and/or currently under review.