Internet Address Access Control Using Expected URL Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying malicious internet addresses, such as rule-based approaches and AI/ML models, are limited in their ability to adapt to evolving threats, require significant resources, and have low precision in detecting uncommon addresses, leading to potential security vulnerabilities.
Innovation Solution
A foundation model is used to identify expected internet addresses based on browsing history, generating alerts for addresses outside the predicted classifications, utilizing a list of accessed addresses to prevent access to potentially malicious sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based approaches and AI/ML models are used to identify malicious internet addresses, then security detection capability is improved, but measurement precision deteriorates due to low precision in detecting uncommon addresses
Solution Approach 1:
Instead of trying to directly identify malicious addresses through complex rule-based or AI/ML models, the patent inverts the approach by predicting legitimate/expected addresses based on browsing history and sequences. Addresses that deviate from predicted patterns are flagged as potentially malicious, thereby improving precision in detecting uncommon malicious addresses while maintaining security detection capability
Solution Approach 2:
The system performs preliminary prediction of expected internet addresses based on historical browsing data and access sequences before evaluating the current requested address. This preliminary action establishes a baseline of legitimate behavior, enabling more precise detection of anomalous malicious addresses by comparing against predicted expectations
2Reliability
If rule-based approaches and AI/ML models are used to identify malicious internet addresses, then security detection capability is improved, but device complexity increases due to significant resource requirements
Solution Approach 1:
The patent replaces complex, resource-intensive AI/ML models and extensive rule-based systems with a simpler predictive approach that leverages existing browsing history and access sequences. This disposable-like simplicity uses lightweight pattern matching against predicted addresses rather than maintaining complex security databases or training sophisticated models, thereby reducing device complexity while preserving security detection capability
Solution Approach 2:
The system uses the entity's own browsing history and access patterns to generate predictions, eliminating the need for external complex AI/ML infrastructure or extensive security rule databases. The entity's historical data serves itself to establish baseline expectations, reducing external resource requirements while maintaining effective security detection
3Measurement precision
If foundation model is used to predict expected internet addresses based on browsing history, then measurement precision is improved with high precision identification, but device complexity increases due to computational requirements
Solution Approach 1:
The system applies foundation model prediction selectively to generate expected address patterns based on relevant browsing history, rather than attempting to analyze all possible addresses or use overly complex models. This partial action approach focuses computational resources on generating predictions for the specific entity's browsing patterns, achieving high identification precision for relevant addresses while limiting excessive computational requirements through targeted rather than comprehensive analysis
Data Source
AI summary
A method, system, and computer-readable storage media for identifying expected internet addresses and generating alerts. A list of internet addresses representing a history of internet addresses accessed by an entity is obtained. The list of internet addresses is processed using a foundation model to generate one or more predicted classifications of internet addresses. Further, a requested internet address is received from the entity. If the requested internet address is within the one or more predicted classifications of internet addresses, access to the requested internet address is allowed. If the requested internet address is outside of the one or more predicted classifications of internet addresses, an alert is transmitted to one or more monitoring entities.