Malware Detection via Hierarchical URL Cache Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in balancing accuracy and efficiency, often resulting in high resource consumption and false positives, as they struggle to keep pace with rapidly evolving malware websites.
Innovation Solution
A method and system that utilize a multilevel cache to analyze network requests by parsing URLs, evaluating fully qualified domain names and parent hostnames for suspiciousness, and flagging machines with a likelihood of infection based on cache presence and scoring mechanisms, reducing false positives and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware detection systems check network requests against websites known to distribute malware, then detection accuracy is improved, but the system cannot keep pace with rapidly generated new malware websites
Solution Approach 1:
The system segments the URL analysis into multiple hierarchical levels: first checking the complete URL against a cache of known malicious URLs, then extracting and checking the fully qualified domain name (FQDN) against a separate cache, and finally evaluating the parent hostname if previous checks fail. This segmentation allows the system to handle both known malicious sites and newly generated malware websites efficiently.
Solution Approach 2:
The system performs preliminary actions by maintaining pre-populated caches of suspicious URLs and domain names before actual malware detection is needed. These caches are built in advance through monitoring and analysis, enabling rapid comparison against incoming network requests without requiring real-time computation for each check.
2Reliability
If malware detection methods consume system resources such as memory, communication bandwidth, and processing bandwidth to increase detection accuracy, then detection capability is improved, but resource consumption increases
Solution Approach 1:
The system applies partial action by not performing complete analysis on every URL. Instead, it uses a hierarchical approach where most URLs are quickly resolved through cache lookups of complete URLs or FQDNs. Only when these fail does the system perform the more resource-intensive parent hostname evaluation, applying excessive action only where necessary to maintain detection accuracy while minimizing overall resource consumption.
Solution Approach 2:
The system uses caching to store copies of previously analyzed suspicious URLs and domain names. These cached copies allow rapid comparison against new network requests without repeating the full analysis process, significantly reducing processing bandwidth and memory usage for detecting patterns in malware website generation.
3Reliability
If malware detection systems use comprehensive analysis methods, then detection accuracy is improved, but the rate of false positives increases
Solution Approach 1:
The system segments the detection process into hierarchical levels with increasing stringency. The first level checks complete URLs against a cache, the second level checks extracted FQDNs, and the third level evaluates parent hostnames. This segmentation allows the system to achieve high detection accuracy through multiple checks while reducing false positives by requiring evidence at multiple levels before flagging a URL as malicious.
Data Source
Figure 1~2
Figure 3A~3C
Figure 4A
AI summary
A method to identify machines infected by malware is provided. The method includes determining whether a universal resource locator in a network request is present in a first cache and determining whether a fully qualified domain name from the uniform resource locator is present in a second cache. The method includes evaluating a parent hostname as to suspiciousness. The method includes indicating the computing device has a likelihood of infection, responsive to one of: the universal resource locator being present in the first cache with a first indication of suspiciousness, the fully qualified domain name being present in the second cache with a second indication of suspiciousness, or the evaluating the parent hostname having a third indication of suspiciousness, wherein at least one method operation is performed by the processor. A system and computer readable media are provided.