Uttam Nepal

Research

Robust, generalisable machine learning for cyber threat detection.

The research story

A malicious URL is usually the first thing standing between someone and an attack, a single click before any page has even loaded. That's what drew me to this problem in the first place. If the URL alone carries enough signal to warn someone in time, that seemed worth getting right. DeepTrace was my first real attempt: a hybrid architecture combining a fine-tuned language model with handcrafted lexical features and a signal borrowed from the internal structure of a tree ensemble. It performed well, and for a while I thought that was the end of the story.

It wasn't. Going back over that early work, I found methodological issues I hadn't caught the first time around: non-disjoint train/test splitting and evaluation leakage that made the results look stronger than they really were. Not a comfortable thing to notice in your own work. But instead of quietly moving past it, I treated it as the actual starting point and rebuilt the evaluation from scratch. That correction is what led to SafeBrowse, a broader browser-safety concept built around the same idea, and eventually to TURL-MV, a corrected and much more extended multi-view framework for detecting malicious URLs.

Once the evaluation was actually trustworthy, a different question mattered more than raw accuracy: would any of this hold up outside the exact dataset it was built on? That question has shaped most of what I've worked on since. I've spent time testing whether performance that looks strong on one dataset survives contact with a completely different, independently collected one, and checking whether a model might be quietly leaning on something superficial, like a URL's scheme or some coincidental pattern in how a dataset was put together, instead of anything that actually points to malicious intent. That turned into several threads of work running in parallel. Some of it is submitted for peer review now, some of it is still in progress.

One preliminary study from this line of work, comparing several URL representations through multi-view fusion, has since been accepted as a poster at ADMA 2026. That was a genuinely nice milestone after a lot of quiet, unglamorous evaluation work. If there's one idea tying the whole direction together, it's that no single representation dominates. A method that looks strongest on one dataset often isn't the one that transfers best to another, and counterfactual testing keeps showing that strong aggregate numbers can hide a model leaning on signals that have nothing to do with actual malicious intent. That's the thread I'm still pulling on.

Full methodology and results for work that is still ongoing or submitted are not disclosed here, as this research is intended for conference submission. Details will be shared as each piece moves toward publication.

Research outputs

DeepTrace architecture diagram
Ongoing

DeepTrace

DeepTrace was the starting point of this research direction: a hybrid architecture combining a fine-tuned transformer-based URL encoder with handcrafted lexical features and a learned signal derived from a separately trained gradient-boosted tree ensemble. Evaluated across six progressively more complex configurations, the fully combined approach achieved the strongest result of any configuration tested, with accuracy and F1 above 98%. DeepTrace also underlies SafeBrowse, an applied browser-safety concept built around this detection approach (see Projects).

Full methodology not disclosed, since this is expected for conference submission.

Multi-View Representation Fusion for Malicious URL Classification architecture diagram
Accepted for presentation

Multi-View Representation Fusion for Malicious URL Classification

Working title, simplified until fully published. The description below accurately reflects the actual research.

ADMA 2026, poster paper, Hong Kong SAR, 13–15 November 2026

This research compares multiple complementary representations, handcrafted lexical/structural features, text-based (TF-IDF) representations, and transformer-based (BERT) embeddings, for classifying malicious URLs, evaluated under a registrable-domain-disjoint protocol that prevents URLs from the same domain appearing across training and test partitions. A meta-level fusion approach that combines these representations achieved the strongest result among all approaches compared, with an F1 score above 0.91.

Full methodology not disclosed, since this is expected for conference submission.

One-Class Regularization for Cross-Source Malicious URL Detection architecture diagram
Ongoing

One-Class Regularization for Cross-Source Malicious URL Detection

Working title, simplified until fully published. The description below accurately reflects the actual research.

This work extends a multi-view URL representation approach by introducing a support-aware (one-class) regularization term during training, testing whether shaping the learned representation around the geometry of malicious examples can improve detection, particularly at the low false-positive-rate operating points that matter most for real deployment. Evaluated across two independent public URL datasets, the approach shows a modest but consistent shift in error patterns compared to a matched control, and reveals a strongly asymmetric transfer pattern between the two datasets.

Full methodology not disclosed, since this is expected for conference submission.

Transformer Contribution to URL-Only Threat Detection Under Host-Disjoint Evaluation architecture diagram
Ongoing

Transformer Contribution to URL-Only Threat Detection Under Host-Disjoint Evaluation

Working title, simplified until fully published. The description below accurately reflects the actual research.

This study takes a more skeptical, targeted look at a question often assumed rather than tested: under a strict evaluation protocol that prevents related URLs from the same host appearing in both training and test data, does adding a compact transformer-based encoder actually improve malicious URL detection over well-tuned classical models? A strong classical approach remained the best overall performer at standard decision thresholds, while the transformer-based approach's clearest advantage appeared specifically at very strict false-positive-rate operating points.

Full methodology not disclosed, since this is expected for conference submission.

Shortcut Dependence and Structural Invariance in Cross-Domain URL Classification architecture diagram
Ongoing

Shortcut Dependence and Structural Invariance in Cross-Domain URL Classification

Working title, simplified until fully published. The description below accurately reflects the actual research.

This study tests whether a URL classifier that performs well across domains might still be quietly relying on a superficial cue rather than genuine malicious signal. Using a controlled test that changes only a URL's HTTP/HTTPS scheme while leaving everything else unchanged, the work finds that a substantial share of predictions flip class purely from this single, superficial change. Only directly removing the scheme information from the model's input eliminated the sensitivity entirely, but at a measurable cost to overall performance.

Full methodology not disclosed, since this is expected for conference submission.

Cross-Dataset Generalization and Behavioral Diagnosis for Malicious URL Detection architecture diagram
Ongoing

Cross-Dataset Generalization and Behavioral Diagnosis for Malicious URL Detection

Working title, simplified until fully published. The description below accurately reflects the actual research.

This study finds that strong performance within a single dataset does not reliably predict how well a malicious URL detector generalizes to an independently collected dataset, even for a well-designed fused model combining transformer-based and structural representations. A structural signal that was predictive of malicious intent in one dataset showed the opposite association in the other, and increasing how much a transformer model was adapted to its source data improved in-dataset performance while measurably harming its ability to transfer.

Full methodology not disclosed, since this is expected for conference submission.

Get in touch