Behavior-Enhanced Representation Learning for User Behavior Analysis

The Uniform Resource Locator (URL) is a primary vector for numerous security threats, including phishing, malware propagation, and spam attacks, making URL-based analysis a critical task in security systems. However, existing research often focuses on static lexical features of individual URLs, overlooking deeper semantic, structural, and behavioral signals that can indicate malicious intent or evasive patterns. In this paper, we propose Behavior-Enhanced Semantic URL Embedding, a novel framework that integrates semantic, structural, and contextual information to improve the detection of security threats embedded in URLs. Our model is composed of three core modules: a semantic understanding module to extract token-level and contextual semantics, a topology structure learning module to capture hierarchical and sequential patterns of URL components, and a downstream multi-task adaptation module that fine-tunes embeddings with supervised contrastive learning for various security detection tasks. We evaluate our method across five public datasets covering key security applications such as malicious URL detection, phishing website identification, and spam filtering, consistently achieving superior performance over existing baselines. Additionally, we demonstrate the extensibility of our approach to related security tasks, showcasing its potential integration into real-world threat detection and security monitoring systems.