Malicious HTTP Redirection Detection via Browsing Activity Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for detecting malicious HTTP redirections are susceptible to cloaking and anti-emulation mechanisms, making it difficult to immediately detect malicious servers as they employ multiple domain names and web servers to obscure their presence through HTTP redirections.
Innovation Solution
A method and system that utilize a supervised machine learning-based approach to analyze HTTP flows by constructing browsing activity trees, extracting statistical features such as domain tallies, redirection counts, and inter-URL duration distributions, and classifying sequences as malicious or benign using a J48 decision tree model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attackers employ multiple domain names and web servers with HTTP redirections to obscure their presence, then the malicious status of infected hosts is hidden, but the detection difficulty increases
Solution Approach 1:
The patent segments the HTTP flow analysis into distinct components: extracting URL sequences from HTTP requests, identifying redirection patterns, and analyzing the structure of browsing activity trees. This segmentation allows the system to detect malicious redirections by examining individual segments (URL sequences, redirection chains) rather than being overwhelmed by the complete obfuscated flow.
Solution Approach 2:
The patent performs preliminary analysis by constructing browsing activity trees and extracting URL sequences before final classification. This preliminary action prepares the data in advance, organizing HTTP flows into structured representations that make subsequent malicious redirection detection more efficient and accurate.
2Measurement precision
If attackers use cloaking techniques to decide which clients to attack based on client characteristics, then the attack targeting precision is improved, but the detection complexity increases
Solution Approach 1:
The patent adds a new dimension to detection by analyzing the structural properties of browsing activity trees and URL sequences, rather than only examining traditional security features. By introducing tree-based representation and statistical analysis of URL sequences, the system can detect cloaking techniques without proportionally increasing complexity.
Solution Approach 2:
The patent employs a classification system that provides feedback by comparing extracted URL sequences and browsing activity tree structures against known patterns. This feedback mechanism allows the system to adaptively identify malicious redirections while maintaining manageable complexity through pattern recognition rather than exhaustive analysis.
3Loss of information
If multiple HTTP redirections are performed through intermediate websites, then the obfuscation effectiveness is improved, but the analysis time increases
Solution Approach 1:
The patent extracts URL sequences from HTTP requests and identifies redirection patterns by taking out key elements (URLs, redirection indicators) from the complete HTTP flow. This extraction focuses analysis on critical components rather than processing entire HTTP streams, reducing analysis time while maintaining obfuscation detection effectiveness.
Solution Approach 2:
The patent applies partial action by analyzing only the necessary portions of HTTP flows - specifically URL sequences and redirection chains - rather than examining every aspect of the complete browsing activity. This selective analysis reduces processing time while still effectively detecting malicious redirection patterns.
Data Source
AI summary
A method for detecting malicious HTTP redirections. The method includes obtaining, based on a single client IP address, HTTP flows triggered by visiting a website, extracting a sequence of URLs where a downstream URL is extracted from a child HTTP request that is triggered by a parent HTTP request containing an immediate upstream URL, analyzing the URL sequence to generate a statistical feature, and classifying, based on the statistical feature, the HTTP flows as containing at least one malicious HTTP redirection triggered by visiting the website.