Malicious Locator Classification via Machine Learning Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for classifying malicious locators are retrospective and not well-suited to address new threats, as they rely on pattern-matching rules and are ineffective against automatically generated URLs that appear benign but direct users to malicious resources.
Innovation Solution
A method and system that access and extract features from locators, label them based on source, and use a classification module to determine the source of new locators, including assigning membership probabilities and weights to classify locators as malicious or non-malicious, and identify the URL-generation kit responsible.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern-matching rules are used to classify malicious locators, then classification of known threats is enabled, but the method is retrospective and ineffective against new threats
Solution Approach 1:
The system performs preliminary classification of locators by extracting features and comparing them against a database of known locator patterns and characteristics before they are executed. This advance analysis enables the system to identify and block malicious locators proactively, rather than reacting retrospectively after execution. The classification module pre-evaluates locator safety based on extracted features such as URL structure, domain reputation, and payload characteristics.
Solution Approach 2:
The patent replaces traditional mechanical pattern-matching rules with a machine learning-based classification system. Instead of relying on static regex patterns and keyword matching, the system uses trained classification models that can generalize to new threats. The machine learning model learns from historical data and automatically adapts to new attack patterns, substituting rigid mechanical rule-based systems with flexible intelligent classification.
2Measurement precision
If manually crafted pattern-matching rules are created to identify malware classes, then specific malware families can be identified, but the process is time-consuming and not suitable for rapidly evolving threats
Solution Approach 1:
The classification system performs self-service by automatically extracting features from locators and training its own classification models without requiring manual rule creation. The system autonomously learns from labeled training data, automatically updating its classification capabilities as new threats emerge. This self-training mechanism eliminates the need for security researchers to manually craft and maintain pattern-matching rules for every new malware family.
Solution Approach 2:
The system changes from static pattern-matching parameters to dynamic learned parameters. Instead of using fixed regex patterns and keyword lists that require manual updates, the classification model uses learned parameters from training data that automatically adapt to new threat patterns. The system transforms the classification approach from parameter-based rule matching to parameter-learning through machine training, enabling rapid adaptation to evolving threats.
Data Source
AI summary
A method and system for classifying malicious locators where a processor is trained on a set of known malicious locators using a non-supervised learning procedure. Once trained, the processor may classify new locators as being generated by a particular generation kit.