Instant Messaging Screener for URL Reputation Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are vulnerable to instant messenger attacks, which can spread malicious code and phishing attempts, as they lack effective mechanisms to intercept and evaluate the safety of URLs within instant messages in real-time.
Innovation Solution
An apparatus and method that includes an instant messaging screener configured to intercept and parse instant messages for URLs, check them against a URL ratings database for reputation, and perform protective actions if the URLs are identified as having a bad reputation, while also monitoring outgoing messages to prevent propagation of malicious URLs to contact lists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an instant messaging screener is implemented to intercept and check URLs in real-time, then security protection against IM attacks is improved, but system complexity and processing time increase
Solution Approach 1:
An instant messaging screener component is introduced as an intermediary between the instant messaging application and the network. This screener intercepts outgoing IM messages, extracts URLs, checks them against a URL ratings database, and blocks messages containing malicious URLs before they are transmitted, thereby preventing propagation of IM attacks without requiring changes to the core IM application
Solution Approach 2:
The system performs preliminary security checks on outgoing instant messages by checking URLs against a URL ratings database before the messages are transmitted. This proactive approach identifies and blocks malicious content in advance, preventing security incidents rather than responding to them after occurrence
2Measurement precision
If real-time URL checking is performed against a URL ratings database, then detection precision of malicious URLs is improved, but processing speed decreases
Solution Approach 1:
URL ratings are pre-computed and stored in a database before they are needed for screening. The URL ratings database contains pre-evaluated reputation scores for numerous URLs, allowing the screener to perform rapid lookups without performing complex analysis in real-time, thus maintaining both high detection precision and processing speed
3Reliability
If monitoring of outgoing messages is implemented to prevent propagation, then security protection is improved, but loss of time in message transmission increases
Solution Approach 1:
The screening process extracts only the URL components from outgoing instant messages for security checking, rather than analyzing the entire message content. This selective extraction minimizes processing overhead and maintains fast message transmission while still effectively identifying and blocking malicious content
Solution Approach 2:
The system implements efficient URL checking by skipping unnecessary processing steps and directly querying pre-computed URL ratings. Messages with clean URLs are rapidly transmitted without delay, while only suspicious messages undergo additional scrutiny, thus minimizing overall transmission time loss
Data Source
AI summary
In one embodiment, an instant messaging screener is configured to (a) intercept an instant message destined to a user account, (b) parse the instant message to identify any universal resource locators (URLs) in the instant message, (c) check any URLs identified in the instant message against a URL ratings database to generate reputation data; and (d) perform a protective action if the reputation data indicates a bad reputation. In another embodiment, the instant messaging screener is configured to (a) monitor outgoing instant messages to identify any universal resource locators (URLs) therein which are associated with bad reputation web sites, (b) track historical results of said monitoring, and (c) determining whether said identified instant are being sent to all members, or a substantial portion of the members, of a contact list for a user account. Other embodiments, aspects and features are also disclosed.