Dynamic URL Blocking via Age Threshold and Correlation Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Companies face challenges in protecting their data networks from cyberattacks originating from newly-registered URLs, as existing security measures often take too long to identify and block malicious URLs, leading to exposure and potential harm to assets, reputation, and individuals.
Innovation Solution
A method that monitors network requests, blocks resources based on an age factor, and adjusts blocking criteria based on correlation outcomes between precautionary and threat events, reducing false positives by dynamically optimizing the blockage conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security firms monitor and update blacklists of malicious URLs, then security protection is improved, but there is a delay of 30 days or more in identifying newly-registered malicious URLs
Solution Approach 1:
The system proactively blocks newly-registered URLs before they can be used for malicious purposes. By implementing an age-based blocking mechanism that prevents access to domains registered within a specified time period (e.g., less than 30 days), the system performs security protection in advance, eliminating the need to wait for malicious URLs to be identified and added to blacklists by security firms.
Solution Approach 2:
The blocking criteria are dynamically adjusted based on the age of URLs and correlation outcomes. The system modifies blocking parameters in real-time, increasing or decreasing the age threshold based on whether blocked URLs are later confirmed as malicious or benign, allowing the system to adapt its security measures as new information becomes available.
2Reliability
If newly-registered URLs are blocked to prevent cyberattacks, then security is improved, but legitimate new resources may be incorrectly blocked
Solution Approach 1:
The system implements a feedback mechanism where correlation outcomes from comparing blocked URLs against security firm blacklists are used to adjust future blocking decisions. When a blocked URL is confirmed as malicious, the system learns from this positive outcome; when a blocked URL is found to be legitimate (absent from blacklists), the system adjusts its criteria to reduce false positives, thereby maintaining both security and access to legitimate resources.
Solution Approach 2:
The system changes blocking parameters dynamically based on correlation outcomes. The age threshold and other blocking variables are adjusted upward or downward depending on whether the correlation between precautionary blocking and confirmed threats meets target factors, allowing the system to optimize its blocking criteria to minimize both security gaps and false positives.
3Measurement precision
If the blacklist is updated frequently to catch new threats, then detection accuracy is improved, but system complexity and resource consumption increase
Solution Approach 1:
Instead of continuously monitoring and updating blacklists with all newly-registered URLs, the system applies partial action by focusing only on the most critical parameter - the age of the URL. By blocking based on a simple age threshold (e.g., URLs registered within the last 30 days), the system achieves effective detection without the complexity of analyzing multiple parameters or maintaining comprehensive real-time blacklist updates.
Data Source
AI summary
A method, device and assembly are disclosed herein. Each of the method, device and assembly, in an embodiment, is operable to perform multiple steps for protecting a network, including adding resources to a blocklist if the resources satisfy a blockage condition. After a maturation period expires, the steps include determining whether the blocked resource is listed on a blacklist. The addition to the blocklist corresponds to a precautionary event, and the presence on the blacklist corresponds to a threat event. The steps include determining a correlation of the precautionary events to the threat events, and changing or adjusting the blockage condition as a result of the correlation outcome differing from a correlation target factor by a designated amount.