Malware Detection via Referrer Context Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious software infections in computer terminals often generate false positives, leading to inefficient alert analysis and delayed responses, as they fail to distinguish between direct and indirect access to malicious resources.
Innovation Solution
A method that analyzes network requests by verifying if the referenced resource was previously accessed from the terminal, using a Bloom filter to record legitimate requests and their timestamps, thereby differentiating between direct infections and indirect access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the monitoring system analyzes all requests to malicious URLs, then infection detection coverage is improved, but false positive rate increases
Solution Approach 1:
The patent segments the analysis process into two distinct paths: one for direct requests to malicious URLs (potential infections) and another for indirect requests via redirects (potential false positives). By examining the request path and referrer information, the system divides traffic analysis into segments that can be evaluated differently, allowing comprehensive detection while reducing false alarms.
Solution Approach 2:
The system performs preliminary analysis of the request path, referrer headers, and redirect chains before generating infection alerts. By examining these preliminary indicators, the system can pre-filter requests that are likely to be false positives (such as those resulting from legitimate redirects) before they reach the alert generation stage, thus maintaining detection coverage while reducing false positives.
2Reliability
If the monitoring system generates alerts for all malicious URL accesses, then detection sensitivity is improved, but administrator workload increases
Solution Approach 1:
The patent applies partial action by selectively generating alerts only for requests that meet specific criteria indicating actual infection risk (direct requests to malicious URLs without legitimate referrer context). Requests that appear to be indirect accesses through redirects are analyzed with less intensity and often excluded from alert generation, reducing administrator workload while maintaining sensitivity to genuine threats.
Solution Approach 2:
The system implements feedback mechanisms where alert patterns and false positive rates are continuously monitored and used to refine the filtering criteria. By analyzing feedback from previous alert evaluations, the system adjusts its sensitivity and filtering rules to reduce administrator workload while maintaining high detection sensitivity for actual infections.
3Object-affected harmful factors
If the monitoring system blocks all requests to blacklisted URLs, then infection prevention is improved, but legitimate traffic disruption increases
Solution Approach 1:
The patent applies local quality by implementing different blocking strategies for different types of requests. Direct requests to malicious URLs are blocked with high confidence to prevent infections, while indirect requests that may result from legitimate redirects are allowed to pass through with lower blocking confidence or are exempted from blocking entirely. This localized differentiation prevents infections while minimizing disruption to legitimate traffic.
Solution Approach 2:
The system performs preliminary anti-action by analyzing the request context (referrer headers, redirect chains, user agent information) before blocking decisions are made. By examining these preliminary indicators, the system can identify and protect legitimate traffic patterns (such as redirects from trusted websites) while maintaining strong blocking against direct malicious requests, thus preventing infections without disrupting legitimate user activity.
Data Source
Figure 1~2b
Figure 3a~4
AI summary
The invention relates to a method for aiding the detection of infection of a terminal by malware, comprising: - reception (EO) originating from the terminal of a current request asking for access to a resource of a network, - detection (E1) that the resource requested is malevolent, - when the current request comprises (E5) a reference to an initial resource, verification (E7) that access to the initial resource has been requested from the terminal in at least one earlier request, said initial resource having been detected legitimate during the processing of the earlier request, said current request being then considered to be an attempt to infect the terminal.