Malicious Shortened URL Identification via Sender Control Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
URL shortening complicates the evaluation of links by computer security mechanisms, such as web reputation systems and anti-advanced persistent threat modules, which rely on full URLs to determine malicious web content.
Innovation Solution
A system that collects online messages, extracts sender identifiers and URLs, identifies sender-controlled components, forms groups of these components and senders using approximate bipartite cliques, and designates shortened URLs associated with malicious groups as malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Length of moving object
If URL shortening is used to reduce character length, then URL brevity and ease of sharing are improved, but the ability of security mechanisms to evaluate links deteriorates
Solution Approach 1:
The system performs preliminary actions by collecting online messages, extracting sender identifiers and URLs, identifying sender-controlled components, and forming groups of these components and senders before the actual security evaluation is needed. This pre-processing enables security mechanisms to have prepared data for evaluating shortened URLs when they are encountered.
Solution Approach 2:
The patent introduces an intermediary system that acts as a bridge between shortened URLs and full URL evaluation. The system extracts sender-controlled components from shortened URLs and uses these as intermediaries to determine the origin and safety of the shortened link, enabling security evaluation without requiring the full URL to be visible.
2Length of moving object
If shortened URLs are used instead of full URLs, then message compactness is improved, but the precision of security mechanism analysis deteriorates
Solution Approach 1:
The system extracts sender-controlled components from shortened URLs, separating the identifiable sender information from the obscured destination. By taking out and analyzing the sender-controlled portions, the system can evaluate the safety of shortened URLs based on the sender's reputation and behavior patterns without needing the full URL.
Solution Approach 2:
The patent shifts the security analysis from the URL dimension to the sender dimension. Instead of analyzing the URL structure itself, the system evaluates senders based on their historical behavior, the groups they belong to, and their control over multiple URLs. This dimensional shift enables precise security analysis despite URL shortening.
3Measurement precision
If sender-controlled components are grouped using approximate bipartite cliques, then identification accuracy of malicious URLs is improved, but computational complexity increases
Solution Approach 1:
The system applies approximate bipartite clique formation rather than requiring complete and exact clique identification. By accepting approximate matches and using threshold-based grouping, the system achieves sufficient identification accuracy without the excessive computational complexity of finding all possible exact cliques in the data.
Data Source
AI summary
Malicious shortened uniform resource locators are identified by collecting online messages in a computer. Senders and uniform resource locators are extracted from the collected online messages. Sender controlled components are identified in the uniform resource locators. Groups of sender controlled components and senders are formed. Shortened uniform resource locators associated with sender controlled components that are members of malicious groups are identified as malicious.