Malicious Website Discovery via Third-Party Analytics Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying malicious websites is challenging due to their large number and the difficulty in distinguishing between legitimate and malicious websites, especially as some websites can change from non-malicious to malicious over time, posing a risk to user devices and data privacy.
Innovation Solution
The method employs web analytics identifiers to identify malicious websites by associating known malicious websites with their analytics identifiers, which are then used to detect and block associated domains in network traffic, utilizing a domain filter and search engines to crawl and index source code for matching identifiers, thereby expanding the detection of malicious websites beyond initially identified ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional website identification methods are used, then the detection process is simple, but the ability to identify malicious websites is insufficient due to their large number and constant changes
Solution Approach 1:
The patent uses third-party analytics identifiers as intermediary elements to connect known malicious websites with potentially malicious ones. Instead of directly analyzing each website's content, the system uses these identifiers as mediators to infer malicious intent, thereby improving detection accuracy without proportionally increasing system complexity
Solution Approach 2:
The system makes analytics identifiers serve multiple functions: they are used for legitimate website analytics, for identifying malicious websites, and for blocking malicious traffic. This multi-functionality allows the system to leverage existing identifiers rather than creating new detection mechanisms, improving precision without adding significant complexity
2Measurement precision
If analytics identifiers are used to identify malicious websites, then the identification capability is enhanced, but false positives may occur due to legitimate websites sharing the same identifiers
Solution Approach 1:
The system performs preliminary actions by maintaining whitelists of known legitimate websites and inactive domains before conducting the actual malicious website detection. This preliminary filtering removes false positives from the detection results, ensuring that only truly malicious websites are identified while preserving detection capability
Solution Approach 2:
The system uses feedback mechanisms where detection results are continuously refined by comparing against whitelists and inactive domain lists. This feedback loop allows the system to learn from false positives and improve its accuracy over time, maintaining both detection capability and reliability
3Measurement precision
If comprehensive website scanning is performed to identify all malicious websites, then the detection coverage is improved, but the time and computational resources required increase significantly
Solution Approach 1:
The system extracts only the essential identifying feature (analytics identifier) from websites rather than analyzing complete website content. This extraction approach allows for rapid comparison and identification of malicious websites based on shared identifiers, significantly reducing detection time while maintaining comprehensive coverage
Solution Approach 2:
The detection process is segmented into distinct stages: extracting analytics identifiers from known malicious websites, searching for websites sharing those identifiers, and then verifying results against whitelists. This segmentation allows each stage to be optimized independently, improving overall efficiency while maintaining detection coverage
Data Source
AI summary
An author of a malicious websites campaign (scam or phishing) likely uses a legitimate third-party service to facilitate the malicious campaign. An example includes legitimate CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) services to conceal the malicious campaign from automated security scanners. A security service/platform can employ a detection pipeline that leverages use of CAPTCHA keys across websites of a malicious websites campaign. Websites that use CAPTCHA keys found in known malicious websites can at least be identified as suspect and communicated to firewalls.