Access Log URL Mismatch Detection for Website Content Falsification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to promptly detect falsification of legitimate website content by malicious third parties, leading to delayed recognition of harmful sites and potential user harm.
Innovation Solution
An information processing device that collects and analyzes access logs from client terminals, collates them with a database of malicious URLs, and detects content falsification by identifying mismatches between access source and connection destination URLs, with additional verification steps to confirm falsification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection techniques are used to collect malicious URLs, then known malicious URLs can be detected, but falsified legitimate website content cannot be detected early
Solution Approach 1:
The system performs preliminary actions by collecting access logs and analyzing URL redirection patterns before a watering hole attack can cause harm. By monitoring the relationship between entrance URLs and access destination URLs in advance, the system establishes a baseline for detecting falsifications early, rather than waiting for malware execution or user complaints.
Solution Approach 2:
The system introduces an intermediary monitoring device that sits between users and the web server, observing access logs and analyzing URL redirection patterns. This intermediary detects falsifications by identifying mismatches between entrance URLs and actual connection destinations, enabling early detection without requiring direct user involvement or waiting for malware activation.
2Reliability
If comprehensive access log analysis is performed to detect falsification, then early detection can be achieved, but system complexity increases
Solution Approach 1:
The system extracts only the critical elements needed for detection: entrance URLs, access destination URLs, and their relationships from access logs. By focusing on these specific extracted features rather than analyzing entire log files comprehensively, the system achieves effective falsification detection with reduced computational complexity and resource requirements.
Solution Approach 2:
The system changes the monitoring parameter from analyzing malware execution or user behavior to monitoring URL redirection patterns and the relationship between entrance URLs and connection destinations. This parameter change simplifies the detection mechanism while maintaining high reliability in detecting falsified legitimate website content.
3Speed
If real-time monitoring of all URL access is implemented, then immediate detection of falsification is possible, but processing load increases
Solution Approach 1:
The system performs partial monitoring by focusing only on specific patterns in access logs - namely, the relationship between entrance URLs and access destination URLs. Rather than analyzing every aspect of each access log entry in real-time, the system selectively monitors for URL redirection anomalies, reducing processing load while maintaining detection speed.
Solution Approach 2:
The system skips detailed analysis of normal, benign access patterns and rushes through to identify only anomalous redirection patterns that indicate falsification. By filtering out routine traffic and focusing computational resources on suspicious patterns, the system achieves fast detection with lower overall processing load.
Data Source
Figure 1
Figure 2(A)
Figure 2(B)
AI summary
An information processing device 10 comprising: an access log collection unit 14 that collects access logs when a client terminal 11 requests a content from a web server 12; a database 16 in which a malicious URL is registered in advance; and a falsification detection unit 19 that collates a connection destination URL with the database 16 and detects falsification of the content if the connection destination URL corresponding to a connection destination of the client terminal 11 matches the malicious URL.