Access Classifying Device Using Redirect Tree Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious website discrimination techniques based on content or URL information are vulnerable to attacker evasion, and require multiple access attempts, limiting their effectiveness in detecting malicious websites during a single access.
Innovation Solution
An access classifying device and method that generates trees representing server accesses, calculates the similarity between these trees based on matching partial trees, and classifies accesses accordingly to detect malicious websites without relying on content or URL information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malicious website discrimination is performed using content or URL information, then discrimination can be made, but attackers can easily evade detection by changing content tendencies
Solution Approach 1:
The patent introduces an intermediary approach by using redirect information as a mediator between the user terminal and the final website content. Instead of directly analyzing vulnerable content or URLs that attackers can modify, the system analyzes the redirect chain - an intermediate layer that reveals malicious intent without being directly manipulable by content-changing attacks. The redirect information serves as a stable intermediary that maintains detection reliability even when final content varies.
2Measurement precision
If multiple access attempts are required for discrimination, then more accurate detection can be made, but the application range is limited to websites requiring multiple accesses
Solution Approach 1:
The patent applies preliminary action by extracting and analyzing redirect information during the first access attempt itself, before multiple accesses are needed. By capturing redirect chains, iframe relationships, and access sequences in the initial request-response cycle, the system performs the necessary analysis up front. This allows accurate detection to be achieved without requiring subsequent access attempts, thereby maintaining high detection accuracy while expanding applicability to single-access scenarios.
3Reliability
If content analysis is performed, then discrimination can be made, but attackers can change content to avoid detection
Solution Approach 1:
The patent inverts the traditional analysis approach by not examining the vulnerable content or URLs directly (the conventional way), but instead examining the redirect information and access patterns that lead to these targets (the inverted way). This inversion means analyzing the attacker's actions - the redirect chains and access sequences they create - rather than analyzing the potentially manipulated content itself. This provides resistance to content changes because the detection focuses on the structural patterns of access rather than the variable content.
Data Source
AI summary
An access classifying device includes a tree building unit, a similarity-degree calculating unit, and a classifying unit. The tree building unit generates multiple trees, in which a first server and multiple second servers are nodes and commands for automatically transferring the sequence of accesses from the above-described first server to the above-described second servers are edges. The similarity-degree calculating unit calculates the degree of similarity between the above-described trees in accordance with the degree of matching between partial trees included in each of the above-described trees generated. The classifying unit classifies the above-described access in accordance with the above-described degree of similarity calculated.