Malicious URL Redirect Chain Detection via Suspicion Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to effectively detect and handle malicious URL redirects, which can evade detection by relying on long chains of redirects and changing destination addresses.
Innovation Solution
A method is introduced to identify malicious redirects by calculating a suspicion score based on the subject redirection domain's web address and its occurrence rate in redirect chains leading to malicious landing domains, and blocking loading if the score exceeds a threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklists and detection mechanisms are used to block malicious websites, then known malicious sites can be prevented from being accessed, but malicious content can still reach users through long chains of redirects that evade detection
Solution Approach 1:
The system proactively resolves all redirect chains in advance before allowing user access. By automatically following redirect links and analyzing the final destination domains, the system identifies malicious sites before users can be redirected to them, preventing the evasion technique from working
Solution Approach 2:
The patent introduces an intermediary detection layer that sits between the user's browser and the redirect chain. This intermediary service automatically resolves redirects and provides safety verification, acting as a mediator that blocks malicious destinations without requiring changes to the user's browsing behavior
2Ease of operation
If redirect chains are allowed to function normally, then legitimate web navigation is maintained, but malicious redirects can pass through undetected
Solution Approach 1:
The system creates a copy of the redirect chain resolution process that runs automatically in the background. By duplicating the navigation path and analyzing it separately, the system can identify malicious destinations without interfering with the user's actual browsing experience
Solution Approach 2:
The patent replaces the manual user navigation process with an automated mechanical system that resolves redirect chains programmatically. This substitution allows for systematic analysis of each redirect step, identifying patterns and characteristics of malicious redirects that would be impossible to detect through manual browsing
3Speed
If traditional blacklist-based detection is used, then detection speed is fast for known sites, but detection accuracy drops for new malicious sites using redirect chains
Solution Approach 1:
The system performs preliminary resolution of redirect chains before user access, automatically following all redirect links and analyzing final destinations in advance. This proactive approach maintains fast detection by pre-processing redirect paths and identifying malicious patterns before they reach users
Solution Approach 2:
The patent implements a feedback mechanism where detected malicious redirect chains are added to the blacklist, and the system continuously learns from new patterns. By analyzing resolved redirect destinations and feeding this information back into the detection system, the accuracy improves over time while maintaining fast detection speeds through cached results
Data Source
AI summary
Malicious redirects in a redirect chain as a result of loading a web address are detected and blocked. A suspicion score is determined for a subject redirection domain based at least in part on the subject redirection domain's web address, and a rate of occurrence of the subject redirection domain in redirect chains leading to a malicious landing domain is calculated. Loading the subject redirection domain is blocked if the suspicion score exceeds a suspicion threshold or the rate of occurrence of the subject redirection domain exceeds a rate of occurrence threshold.