URL Abnormality Localization via Multiple-Instance Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing URL detection systems fail to accurately identify abnormal fields within URLs, leading to incomplete threat detection and security vulnerabilities, as they primarily focus on determining the entire URL's abnormality rather than pinpointing specific suspicious components.
Innovation Solution
A method and device utilizing multiple-instance learning-based URL abnormality locating, which performs field segmentation on URLs to create multiple-instance bags, trains a model to predict abnormal instances, and locates the corresponding abnormal fields, enabling more precise analysis and security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional URL detection systems are used to determine entire URL abnormality, then the detection process is simple, but the measurement precision of abnormal field identification is insufficient
Solution Approach 1:
The patent segments a URL into multiple fields (e.g., protocol, domain, path, query parameters) and processes each field independently through the detection model. This allows the system to identify which specific field contains the abnormality rather than treating the entire URL as a single unit, thereby improving measurement precision while managing complexity through modular field-based processing
Solution Approach 2:
The patent transitions from a single-dimension approach (entire URL classification) to a multi-dimensional approach by evaluating each URL field separately across multiple dimensions (protocol layer, domain layer, path layer, parameter layer). This dimensional expansion enables precise localization of abnormalities to specific fields while maintaining systematic detection through structured multi-layer analysis
2Measurement precision
If field segmentation and multiple-instance learning are applied to locate abnormal fields, then the detection precision is improved, but the computational complexity increases
Solution Approach 1:
The detection model processes each URL field as a separate instance within a bag structure, applying multiple-instance learning to determine which specific field contains the abnormality. This segmentation approach improves localization accuracy by evaluating fields independently while the bag-level classification manages overall complexity through hierarchical processing
Solution Approach 2:
The patent introduces a bag-level intermediary layer that aggregates results from individual field predictions. The multiple-instance learning model acts as an intermediary between raw field-level features and final abnormality localization, managing computational complexity by first predicting bag-level abnormality and then identifying the specific abnormal field through structured inference
3Loss of information
If the entire URL is treated as a single detection unit, then the processing is straightforward, but the loss of information about specific abnormal fields occurs
Solution Approach 1:
The patent segments the URL into distinct fields (protocol, domain, path, query parameters) and processes each segment separately through the detection model. This preserves detailed information about which specific field contains the abnormality, preventing information loss while maintaining operational simplicity through standardized field-based processing pipelines
Solution Approach 2:
The detection system applies local quality analysis by evaluating each URL field with appropriate field-specific features and prediction thresholds. Instead of uniform processing, each field receives tailored analysis (e.g., domain validation rules, path pattern matching, parameter format checking), preserving local abnormality information while maintaining overall process simplicity through consistent field-level methodology
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Embodiments of the present specification provide a URL abnormality locating method. A URL is expressed by a bag including a plurality of instances, and an abnormal instance is predicted by using a URL abnormality locating model, so as to locate an abnormal field in the URL. By multiple-instance learning-based URL abnormality locating, an undiscovered potential threat in data can be well predicted.