# eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys

**Authors:** Joshua Saxe, Konstantin Berlin  
**arXiv:** [1702.08568](https://arxiv.org/abs/1702.08568)  
**Date:** 2017-02-27  
**Summary page:** https://www.summarizepaper.com/en/paper/1702.08568v1/

## Key points

- Existing security machine learning systems have limitations in detecting indicators of attack
- Current systems require significant engineering resources for development and maintenance
- The eXpose neural network proposes a deep learning approach to overcome these challenges
- eXpose operates on raw input signals such as malicious URLs, file paths, registry keys, etc.
- It automates feature design and extraction using character-level embeddings and convolutional neural networks
- In experiments, eXpose outperforms manual feature extraction baselines on intrusion detection problems
- It achieves a 5%-10% gain in detection rate at a 0.1% false positive rate compared to baselines
- eXpose completely automates the feature design and extraction process
- The paper presents a promising solution to enhance security machine learning systems using deep learning techniques
- eXpose demonstrates superior performance in detecting indicators of attack while eliminating the need for manual feature extraction and continuous tuning

## Summary

The paper titled "eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys" by Joshua Saxe and Konstantin Berlin addresses the limitations of existing security machine learning systems in detecting indicators of attack. While these systems were expected to eliminate the need for signature-based detection, they have not been able to fulfill this promise. The development and maintenance of current security machine learning systems require significant engineering resources, comparable to those needed for signature-based detection systems. To overcome these challenges, the authors propose a deep learning approach called eXpose neural network. This network operates on raw input signals, such as potentially malicious URLs, file paths, named pipes, named mutexes, and registry keys. It automates the process of feature design and extraction by using character-level embeddings and convolutional neural networks. In their experiments, the authors found that eXpose outperforms manual feature extraction based baselines on all tested intrusion detection problems. It achieves a 5%-10% gain in detection rate at a 0.1% false positive rate compared to these baselines. Additionally, eXpose completely automates the feature design and extraction process. Overall, this paper presents a promising solution to enhance security machine learning systems by leveraging deep learning techniques which eliminates the need for manual feature extraction and continuous tuning as attacks evolve. The eXpose neural network demonstrates superior performance in detecting indicators of attack while eliminating the need for manual feature extraction and continuous tuning as attacks evolve.