Harmful URL Detection with Whitelist Filtering and AI Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing URL detection methods are limited by the rapid counterfeiting of URLs and the inefficiency of large-scale lists, making it difficult to effectively block harmful URLs.

Innovation Solution

A method involving comparing an access target URL with a whitelist, checking for previously accessed pages, analyzing response codes, and using artificial intelligence models to extract features and classify URLs as malicious or normal, including HTML syntax and sentiment analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If large-scale whitelist and blacklist lists are used for URL detection, then detection coverage is improved, but detection efficiency deteriorates due to the rapid counterfeiting rate of URLs

Engineering Contradiction:
Improvedetection coverageVSAvoiddetection efficiency
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent segments the URL detection process into multiple stages: first checking against whitelist/blacklist databases, then applying AI-based analysis only to suspicious URLs. This segmentation allows the system to maintain high detection coverage through comprehensive lists while improving efficiency by limiting expensive AI computations to only necessary cases.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary filtering using lightweight whitelist/blacklist comparisons before applying more resource-intensive AI analysis. This preliminary action eliminates obviously safe or malicious URLs early in the process, reducing the burden on subsequent detection stages and improving overall system efficiency.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If AI-based analysis is applied to all URLs, then detection accuracy is improved, but processing time and computational resources increase

Engineering Contradiction:
Improvedetection accuracyVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies AI-based analysis partially, only to URLs that pass through the initial whitelist/blacklist filtering and are deemed suspicious. This partial application of AI analysis maintains high detection accuracy for problematic URLs while avoiding the excessive processing time that would result from analyzing every URL with AI.

Inventive Principle:
Principle #16Partial or excessive action

Solution Approach 2:

The patent applies different detection qualities to different URL categories: simple database matching for obvious cases and sophisticated AI analysis for ambiguous cases. This local differentiation of detection quality ensures high accuracy where needed while minimizing processing time for straightforward cases.

Inventive Principle:
Principle #3Local quality

3Reliability

If comprehensive AI model training with various web data is performed, then harmful URL detection capability is improved, but system complexity increases

Engineering Contradiction:
Improveharmful URL detection capabilityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the detection system into distinct modules: database lookup components, AI analysis components, and decision-making logic. This segmentation allows comprehensive AI training for high detection capability while managing system complexity through modular architecture where each component has a specific, well-defined function.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS12388787B2Harmful URL detection method
Publication Date: 2025.08.12 PILLSANG CO LTD
  • US12388787B2 patent drawing
  • US12388787B2 patent drawing
  • US12388787B2 patent drawing

AI summary

A harmful URL detection method is proposed. The method includes requesting entry to a web page to which access is sought from a user terminal, comparing an access target URL corresponding to the entry-requested web page with a pre-stored whitelist, excluding the access target URL from a detection target when an identical domain exists as a result of the comparison with the whitelist, checking whether the access target URL refers to a previously accessed web page when the identical domain does not exist, excluding the access target URL from the detection target in a case of the previously accessed web page, checking a response code for the access target URL in a case of a web page not previously accessed, and excluding the access target URL from the detection target when the access target URL is abnormal in communication according to the checking of the response code.