Link Reputation Server for Cloaked Redirect Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing site crawler and web rating security applications are ineffective in detecting malicious activities, particularly in cases where content is password-protected or uses cloaked redirects and shortened URLs, allowing hackers to circumvent security measures.
Innovation Solution
A system and method that involves a reputation server querying a database to determine the reputation of a link by analyzing its redirects, associating the reputation of the final destination with the original link, and updating reputation information based on the lowest reputation score or average scores of redirects, to identify potential malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If site crawlers are used to gather website information, then website reputation can be determined, but malicious activities using password-protected content and cloaked redirects cannot be detected
Solution Approach 1:
The system performs preliminary actions by proactively following redirects and evaluating destination URLs before users interact with potentially malicious links. The reputation server pre-evaluates links by tracking redirect chains and determining the reputation of final destinations, so that when users encounter these links, the security assessment is already complete and ready to prevent malicious activity.
Solution Approach 2:
The patent introduces a reputation server as an intermediary between the user and the web content. This intermediary component receives link evaluation requests, follows redirect chains, determines the reputation of destination URLs, and returns safety assessments. The reputation server acts as a mediator that bridges the gap between simple site crawling and comprehensive link safety evaluation, enabling detection of cloaked malicious content without requiring users to directly access potentially harmful sites.
2Loss of information
If traditional site crawling is used, then content can be gathered, but links and their destinations remain unknown to users
Solution Approach 1:
The system implements feedback by continuously monitoring and evaluating link destinations, then using this information to improve future link assessments. The reputation server tracks redirect chains, evaluates destination reputations, and feeds this information back into the evaluation system. This feedback mechanism ensures that link destination information is transparent to users while the system learns and adapts to new malicious patterns, maintaining both information transparency and manageable complexity.
3Object-affected harmful factors
If hackers use cloaked redirects and shortened URLs, then malicious payload can be hidden, but security applications cannot detect the true destination
Solution Approach 1:
The reputation server performs preliminary evaluation by following redirect chains and evaluating destination URLs before users interact with potentially malicious links. This preliminary action exposes hidden malicious payloads by proactively navigating through cloaked redirects and shortened URLs to identify the true destination, allowing security assessment to occur before the user is exposed to the threat.
Solution Approach 2:
The patent introduces a reputation server as an intermediary that specializes in unraveling cloaked redirects. This intermediary component receives link evaluation requests, follows redirect chains, determines the reputation of final destinations, and returns safety assessments. The reputation server acts as a mediator that bridges the gap between simple site crawling and comprehensive link safety evaluation, enabling detection of cloaked malicious content without requiring users to directly access potentially harmful sites.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for protecting against unknown malicious activities by determining a reputation of a link are disclosed. A reputation server queries a database including reputation information associated with a plurality of links to retrieve a reputation of a redirected link. The reputation information may indicate whether the links are associated with a malicious activity. The reputation of the redirected link may be associated with the original link to create a reputation of the original link.