Malicious URL Candidate Extraction via Access Log Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malicious URL examination systems are limited in the number of URLs they can examine, failing to reflect organizational characteristics, which can lead to missed malicious URLs in targeted attacks.
Innovation Solution
A system that accumulates access logs from managed networks, excludes known malicious websites, and creates a list of website candidates by prioritizing those with fewer access instances, outputting a list of potentially malicious URLs that may be used in targeted attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a malicious URL examination system examines all malicious URL candidates, then detection accuracy improves, but the system becomes overwhelmed by the large volume of URLs and cannot process them all
Solution Approach 1:
The patent segments the malicious URL candidate list into multiple groups based on access frequency statistics. By dividing the large volume of URLs into high-frequency, medium-frequency, and low-frequency groups, the system can process and examine URLs in manageable segments rather than attempting to examine all URLs simultaneously, thus resolving the contradiction between detection accuracy and processing capacity
Solution Approach 2:
The patent extracts and prioritizes high-risk URLs from the overall candidate list by identifying those with low access frequencies that match organizational characteristics. This extraction of critical URLs allows the examination system to focus resources on the most suspicious candidates, maintaining high detection accuracy while working within processing capacity constraints
2Ease of manufacture
If a conventional malicious URL candidate list is generated based only on publicly available malicious URL lists, then the list creation process is simple, but organizational characteristics are not reflected and targeted attacks are missed
Solution Approach 1:
The patent performs preliminary analysis of organizational access patterns and characteristics before generating the malicious URL candidate list. By pre-collecting and analyzing access logs to understand organizational behavior, the system can then generate more reliable and organization-specific candidate lists that are tailored to detect targeted attacks, rather than simply relying on generic public lists
Solution Approach 2:
The patent applies local quality by customizing the malicious URL candidate list generation process to reflect specific organizational characteristics. Instead of using a uniform approach for all organizations, the system adapts the candidate selection criteria to match each organization's access patterns, making the detection process more reliable for each specific context while maintaining overall system simplicity
Data Source
AI summary
A malicious URL candidate extraction device extracts, from an access log including URLs accessed from a managed network, a known malicious URL excluded access log obtained by excluding an access log to known malicious URLs. The malicious URL candidate extraction device creates a minor URL list obtained by preferentially extracting, from URLs indicated in the known malicious URL excluded access log, URLs having a small number of times of access from the managed network. The malicious URL candidate extraction device also creates a popular URL excluded list obtained by preferentially excluding URLs having a large number of times of access from the managed network during a predetermined period of time. The malicious URL candidate extraction device outputs these lists as a malicious URL candidate list.