URL Classification Model Using Feature Enrichment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in efficiently and automatically identifying malicious URLs, especially in scenarios with limited context, leading to costly and time-consuming manual reviews.
Innovation Solution
A computing platform that uses machine learning to classify URLs by executing feature enrichment actions, such as crawling to extract metadata, and inputting data points into a URL classification model to generate a maliciousness score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual review is performed for accurate classification of malicious URLs, then classification accuracy is improved, but time consumption and cost increase
Solution Approach 1:
The patent introduces an automated analysis system as an intermediary between URL detection and manual review. This system extracts features from URLs (such as domain information, path structure, query parameters) and uses machine learning models to classify them as malicious or benign, serving as a mediator that handles most classifications automatically while allowing manual review only for uncertain cases
Solution Approach 2:
The system enables self-service classification by training machine learning models on historical URL data and malicious patterns. Once trained, the model autonomously classifies new URLs without human intervention for clear-cut cases, with the capability to learn and improve from feedback, making the classification process self-sufficient for the majority of URLs
2Productivity
If automated analysis techniques are integrated to reduce manual review, then productivity is improved, but computing resource consumption increases
Solution Approach 1:
The system applies partial automation by using machine learning classification only for URLs that require analysis, rather than processing all URLs uniformly. It implements a tiered approach where simple URLs are quickly filtered, and only suspicious or uncertain URLs undergo full machine learning analysis, reducing overall computing resource consumption while maintaining high productivity
Solution Approach 2:
The system dynamically adjusts analysis parameters such as feature extraction depth, model complexity, and processing intensity based on URL characteristics and system load conditions. This allows the system to optimize computing resource usage by using simpler analysis for low-risk URLs and more comprehensive analysis only when necessary
3Measurement precision
If comprehensive feature extraction is performed on URLs, then classification accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent segments the URL analysis process into distinct modules: feature extraction module that identifies relevant URL components, preprocessing module that cleans and standardizes data, classification module that applies machine learning models, and post-processing module that handles results. This segmentation allows each module to focus on specific tasks, improving accuracy while managing complexity through modular design
Data Source
AI summary
Aspects of the disclosure relate to URL classification. A computing platform may receive, from an enterprise user device, a request to evaluate a URL. The computing platform may execute one or more feature enrichment actions on the URL to identify one or more data points corresponding to the URL, which may include crawling the URL to extract metadata for the URL. The computing platform may input, into a URL classification model, the one or more data points corresponding to the URL, which may cause the URL classification model to output a maliciousness score indicative of a degree to which the URL is malicious. The computing platform may send, to the enterprise user device, a malicious score notification and one or more commands directing the enterprise user device to display the malicious score notification, which may cause the enterprise user device to display the malicious score notification.