Malicious Website Discovery via Analytics Identifier Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying malicious websites is challenging due to their large number and the ability of some websites to change their malicious intent, posing a risk to user devices and personal information.
Innovation Solution
A method using web analytics identifiers to discover malicious websites by obtaining information about known malicious websites, identifying associated analytics identifiers, and querying search engines to find additional websites sharing these identifiers, with domain filters blocking malicious traffic and notifications to users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional methods are used to identify malicious websites individually, then detection precision may be maintained, but productivity decreases due to the large number of websites
Solution Approach 1:
The patent combines multiple malicious websites that share common analytics identifiers into groups. By identifying that multiple websites use the same analytics identifier (e.g., Google Analytics tracking ID), the system infers they may be operated by the same entity and potentially share malicious characteristics. This grouping approach allows simultaneous identification of multiple malicious websites through a single identifier, dramatically increasing productivity without sacrificing detection precision.
2Productivity
If analytics identifiers are used to group websites, then productivity increases by identifying multiple malicious websites at once, but device complexity increases due to additional filtering and verification steps
Solution Approach 1:
The patent segments the malicious website identification process into distinct modular components: (1) analytics identifier extraction from known malicious websites, (2) search engine querying using these identifiers, (3) domain filter implementation for blocking, and (4) verification mechanisms to reduce false positives. This segmentation allows each component to be independently optimized and maintained, managing system complexity while maintaining high productivity.
Solution Approach 2:
The patent introduces a domain filter as an intermediary component between website identification and user protection. The domain filter acts as a mediator that receives analytics identifiers, performs verification, and then blocks or allows traffic accordingly. This intermediary layer simplifies the overall system architecture by centralizing the complex filtering logic in a dedicated component rather than distributing it across multiple systems.
3Reliability
If all websites with matching analytics identifiers are blocked, then user protection is enhanced, but false positives increase potentially blocking legitimate websites
Solution Approach 1:
The patent implements preliminary verification and whitelist mechanisms before final blocking decisions. Known legitimate websites are pre-identified and added to whitelists, and the system performs verification checks on suspicious websites before adding them to blocklists. This preliminary anti-action approach prevents false positives by establishing protective measures in advance that distinguish legitimate from malicious websites.
Solution Approach 2:
The patent incorporates feedback mechanisms where user reports, verification results, and analytics data are continuously analyzed to refine the malicious website identification process. When legitimate websites are incorrectly identified, feedback loops allow for correction and adjustment of the identification criteria. This feedback-driven approach continuously improves reliability while reducing false positives over time.
Data Source
AI summary
The technology presented herein enables malicious websites to be discovered based on web analytics identifiers associated therewith. In a particular embodiment, a method provides obtaining information about one or more first websites that are known to be malicious. The method further provides identifying one or more first analytics identifiers that are each associated with at least one of the first websites and identifying one or more second websites that are each associated with at least one of the first analytics identifiers.