Referer Verification for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies for detecting malicious code in web traffic face challenges in performance degradation due to resource consumption on personal computers and require significant time to detect or block suspected malicious code, especially as recent malicious code mimics normal behavior and performs network communication, while existing solutions fail to verify normal applications effectively.
Innovation Solution
A referer verification method and apparatus that determines the presence of a referer in HTTP packets, extracts URLs, performs CAPTCHA verification, and anticipates caching to verify HTTP traffic, allowing for rapid identification and blocking of malicious code without requiring additional signature inputs or protocol analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If host-based malicious code detection is used, then detection precision is improved, but PC resource consumption increases causing performance degradation
Solution Approach 1:
The patent introduces a network-based intermediary system that acts as a mediator between the user's PC and the malicious code. Instead of running detection software directly on the user's PC (host-based), the verification apparatus is deployed on network infrastructure (ISP server or separate verification server). This intermediary system performs referer verification, URL extraction, and CAPTCHA verification remotely, thereby maintaining high detection precision while eliminating the resource consumption burden from the user's PC.
2Reliability
If signature-based anti-virus products are used, then malicious code detection capability is improved, but detection time increases
Solution Approach 1:
The patent implements preliminary verification actions by checking the referer information and extracting URLs before the actual web content is fully loaded or executed. The system performs referer verification and URL extraction in advance, maintaining a cache of verified URLs. When a user requests a web page, the system has already prepared verification data, allowing for rapid CAPTCHA verification without requiring time-consuming signature scanning of the entire web content. This preliminary action significantly reduces detection time while maintaining reliability.
3Use of energy by moving object
If network-based malicious code detection is used, then resource consumption is reduced, but detection precision deteriorates due to limited observable information
Solution Approach 1:
The patent implements a universal verification mechanism that handles multiple types of web traffic and malicious code patterns through a single referer verification framework. The system extracts URLs from referer information and performs verification applicable to various protocols (HTTP, HTTPS) and malicious code types (drive-by downloads, phishing, malware distribution). This multi-functional approach allows network-based detection to achieve precision comparable to host-based methods by verifying the legitimacy of referer URLs across different scenarios without requiring resource-intensive local analysis.
4Productivity
If authentication code execution verification is used, then malicious code traffic blocking is improved, but normal applications are not verified causing false positives
Solution Approach 1:
The patent applies local quality by performing selective verification based on the specific characteristics of each HTTP request. Instead of uniformly verifying all traffic or excluding certain types, the system analyzes the referer information locally for each request and applies verification only where needed. The URL extraction and verification process examines specific patterns in referer URLs to distinguish between legitimate web browsing (normal applications) and malicious traffic. This localized, context-aware verification maintains high blocking efficiency while reducing false positives by accurately identifying normal applications.
Data Source
AI summary
A referer verification apparatus and method for controlling web traffic having malicious code are provided. In the referer verification method, whether a referer is present in a Hypertext Transfer Protocol (HTTP) packet is determined. If it is determined that the referer is present in the HTTP packet, Uniform Resource Locators (URLs) are extracted from a referer web page corresponding to the referer. The referer is verified based on a URL corresponding to a referer verification request received from a server and the extracted URLs. A Completely Automated Public Test to tell Computers and Humans Apart (CAPTCHA) verification procedure conducted by a user is performed based on results of the verification of the referer.