Neutralizing Malicious Locators via Non-Browser Request Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The prevalence of malicious locators on the internet poses a threat as criminal enterprises attempt to install malware by directing users to harmful resources, necessitating methods to neutralize these locators and prevent malicious content from being served to users.
Innovation Solution
A method and system that identify potentially malicious network-accessible resources through an interface, request content using programs configured to be perceived as non-browser programs, and iterate these requests to neutralize the locators, potentially using commands like curl or wget, and issue alerts if the locators do not provide content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If browser programs are used to access locators, then user-friendly content delivery is maintained, but malicious locators can serve harmful content to users
Solution Approach 1:
The system performs preliminary actions by sending test requests using non-browser programs before allowing browser access. This proactive approach neutralizes malicious locators by triggering shutdown mechanisms in advance, preventing harmful content from being served to actual users.
Solution Approach 2:
Non-browser programs serve as intermediaries between the safety system and malicious locators. These programs send requests that trigger shutdown responses without exposing actual users to harmful content, acting as a buffer that protects the end-user system.
2Reliability
If non-browser programs are used to request content, then malicious locators are neutralized, but the system may affect legitimate resources
Solution Approach 1:
The system applies different request types to different locators based on their characteristics. Browser requests are used for legitimate resources that need to remain accessible, while non-browser requests are targeted at suspected malicious locators. This localized approach ensures that neutralization actions only affect malicious resources.
Solution Approach 2:
The system uses non-browser programs for initial testing of potentially malicious locators, which may trigger shutdown responses. This partial action is sufficient to neutralize threats without requiring complete system-wide changes. The excessive action of triggering shutdowns is acceptable when targeting malicious resources.
3Measurement precision
If multiple requests are sent to locators, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system sends periodic test requests to locators using non-browser programs at intervals. This periodic action allows for accurate detection of malicious resources that may have delayed shutdown mechanisms, while the time intervals are optimized to balance detection accuracy with processing efficiency.
Data Source
AI summary
Methods and systems for neutralizing malicious locators. Threat actors may shut down their web pages or applications (i.e., resources) that serve malicious content upon receiving request(s) configured to be perceived by the resource as non-browser requests. Therefore, initiating (large-scale) non-browser requests, or requests that are at least perceived as non-browser requests, may effectively act to inhibit, or even nullify, intended attack vectors.