In-Process URL Condemnation Through Rendering Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing URL monitoring tools take time to analyze URLs and fail to detect security risks hidden in the header or JavaScript of a webpage, as they rely on static pipeline approaches that only condemn URLs after full rendering, missing potential threats during the rendering process.
Innovation Solution
A URL Collider system that intercepts and analyzes URL-linked pages in-process, using a headless browser to identify microfeatures and event sequences, applying detection rules to determine if a URL is malicious before full rendering, with a judge module making real-time condemnation decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a static pipeline approach is used to analyze URLs after full page rendering, then the analysis is thorough and complete, but the detection time is delayed and threats may disappear before detection
Solution Approach 1:
The patent applies preliminary action by monitoring and analyzing URL rendering events as they occur during the page loading process, rather than waiting for complete rendering. The system captures suspicious events, microfeatures, and behavioral patterns in real-time during the rendering phase, enabling early detection of malicious URLs before the full page is rendered and potential threats disappear.
2Loss of information
If the URL analysis waits for full page rendering, then all content is available for analysis, but security risks in headers and JavaScript during rendering are missed
Solution Approach 1:
The patent introduces an intermediary monitoring system that observes the URL rendering process independently. This intermediary captures events, microfeatures, and behavioral patterns during rendering, including those in headers and JavaScript that occur before full page rendering. It then analyzes this intermediate data to detect security risks that would be missed by traditional post-rendering analysis.
3Reliability
If traditional URL sandboxing is used, then URLs are analyzed in a safe environment, but the process takes several minutes per URL reducing productivity
Solution Approach 1:
The patent applies partial action by performing URL analysis incrementally during the rendering process rather than waiting for complete rendering. The system analyzes available data, events, and microfeatures as they become available during rendering, making condemnation decisions based on partial information when sufficient evidence is present, thereby reducing the time required per URL while maintaining detection accuracy.
4Reliability
If the system analyzes all URLs completely before condemnation, then false positives are reduced, but system load increases and response time decreases
Solution Approach 1:
The patent applies preliminary action by performing initial analysis of URL rendering events, microfeatures, and behavioral patterns during the rendering process. The system makes preliminary condemnation decisions based on this intermediate analysis when sufficient evidence of malicious behavior is detected, reducing the need for complete analysis of all URLs and thereby reducing system processing load while maintaining reliable detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A universal resource locator (URL) collider processes (201) a click event referencing a URL and directs (205) a browser to a page at the URL. While the page is being rendered by the browser with page data from a web server, the URL collider intercepts (205) the page data including events associated with rendering the page, determines (210) microfeatures of the page such as Document Object Model objects and any URLs referenced by the page, applies (215) detection rules, tags (220) as evidence any detected bad microfeature, bad URL, or suspicious sequence of events, and stores (220) the evidence in an evidence database. Based on the evidence, a judge module dynamically determines (230) whether to condemn the URL before or just in time as the page at the URL is fully rendered by the browser. If so, the browser is directed (225) to a safe location or a notification page.