Malicious Website Blacklist Management via Redirect Code Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious websites can evade detection by using cloaking techniques, leading to false negatives where existing systems unregister legitimate malicious websites from blacklists, potentially allowing active threats to remain undetected.
Innovation Solution
A monitoring device with an inspection unit that checks for redirect codes in compromised websites, adding new malicious websites to the blacklist and unregistering those no longer present, using a malicious website existence confirmation table to manage blacklist entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If URLs are unregistered from blacklist by aging method, then blacklist size is reduced and processing time is decreased, but malicious websites that actually exist may be unregistered
Solution Approach 1:
The inspection unit performs preliminary inspection of compromised websites to detect redirect codes before aging-based unregistration occurs. By proactively checking for the presence of malicious redirect codes and updating the blacklist accordingly, the system ensures that actively malicious URLs are not removed due to aging, while still maintaining the benefit of periodic updates.
2Measurement precision
If inspection system accesses malicious website multiple times, then accurate detection is achieved, but cloaking techniques prevent subsequent access
Solution Approach 1:
The inspection process is segmented into multiple independent inspection units or instances that access the malicious website at different times. Each inspection unit performs its check independently, and the results are aggregated. This segmentation allows the system to overcome cloaking techniques that block repeated access by a single entity, as different inspection units can bypass the IP-based blocking mechanism.
3Reliability
If blacklist contains many entries, then comprehensive coverage is achieved, but processing volume increases
Solution Approach 1:
The system implements periodic inspection and dynamic updating of the blacklist based on detected redirect codes. Rather than maintaining a static, comprehensive blacklist that grows indefinitely, the inspection unit periodically checks compromised websites and updates the blacklist to reflect current threats. This periodic action maintains comprehensive coverage of active threats while preventing the blacklist from accumulating obsolete entries that would increase processing volume.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A monitoring device (30) inspects a redirect code inserted into content (11) of a compromised website (10), and, in accordance with a result thereof, when information of a new malicious website is described in the redirect code, the monitoring device (30) acquires information of the malicious website and registers the information on a blacklist (40). In addition, the monitoring device (30) unregisters information of the malicious website that is no longer described in the redirect code in the content (11) from the blacklist (40).