URL Classification System for Malicious Site Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Identifying and protecting users from malicious websites in vast networks, such as those based on the TCP/IP protocol suite, is challenging due to the difficulty in distinguishing between legitimate and malicious universal resource locators (URLs).

Innovation Solution

A system that collects click stream data to classify URLs based on traffic patterns, prioritizes them for analysis, and uses a crawler to determine malicious content, with identified malicious URLs being stored in a database to block or warn users, integrating with email filters to prevent access to harmful sites.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all URLs are analyzed equally for malicious content, then comprehensive detection is achieved, but processing time and system resources are excessively consumed

Engineering Contradiction:

Improvemalicious URL detection completenessVSAvoidURL analysis processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary classification of URLs based on traffic patterns before conducting full malicious content analysis. By pre-processing URLs and categorizing them into risk levels using click stream data, the system identifies high-priority URLs that require immediate analysis while filtering out low-risk URLs, thereby reducing overall processing time without compromising detection completeness

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The URL analysis process is segmented into multiple stages: initial traffic pattern classification, priority assignment, and detailed malicious content analysis. This segmentation allows the system to process URLs in batches based on their risk profiles, analyzing high-priority URLs more thoroughly while applying lighter analysis to low-priority URLs, thus optimizing resource allocation and processing time

Inventive Principle:

Principle #1Segmentation

2Productivity

If traffic pattern classification is used to prioritize URLs, then processing efficiency is improved, but system complexity increases

Engineering Contradiction:

ImproveURL analysis throughputVSAvoidclassification system complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The traffic pattern classification system serves multiple functions simultaneously: it categorizes URLs by risk level, assigns processing priorities, and provides input for resource allocation decisions. This multi-functionality reduces the need for separate systems for each task, thereby improving productivity without proportionally increasing system complexity

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The classification system acts as an intermediary layer between URL collection and detailed analysis. It processes traffic patterns to generate priority scores that guide the analysis workflow, serving as a mediator that simplifies the coordination between different system components while enabling efficient URL processing

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9038181B2Prioritizing malicious website detection

Publication Date: 2015.05.19 AT&T INTELLECTUAL PROPERTY I L P

AI summary

A computer implemented method includes identifying a universal resource locator and characterizing a traffic pattern associated with the universal resource locator. The traffic pattern can include referrer information, referring information, advertising network relationship information, and any combination thereof. The method can further include classifying the universal resource locator into a risk category based on the traffic pattern.