URL Classification via OCR and User Action Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional signature-based detection solutions are ineffective in identifying and protecting against unique and polymorphic phishing threats, as they fail to consider the human factor and social engineering attacks, allowing attackers to exploit these weaknesses.
Innovation Solution
A method and device for classifying Uniform Resource Locators (URLs) based on website content using Optical Character Recognition (OCR) and machine learning, simulating user actions to determine access classifications and prevent phishing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional signature-based detection solutions are used, then implementation is simple and fast, but detection accuracy against polymorphic phishing threats deteriorates
Solution Approach 1:
The system performs preliminary classification of URLs into categories (phishing, adult, organization-specific restriction, etc.) before detailed analysis. This preliminary categorization using machine learning models enables faster routing and handling of different URL types, improving overall detection productivity while maintaining accuracy through specialized analysis pipelines for each category.
Solution Approach 2:
The system changes the detection parameters from static signature matching to dynamic machine learning-based classification. By using multiple classification models that analyze different parameters (URL structure, website content, user behavior patterns), the system achieves high detection accuracy against polymorphic threats while maintaining efficient processing through optimized model inference.
2Measurement precision
If machine learning-based classification is implemented, then phishing detection accuracy improves, but device complexity increases
Solution Approach 1:
The system segments the URL classification task into multiple specialized machine learning models, each handling specific URL categories (phishing, adult content, organization-specific restrictions). This segmentation allows each model to be optimized for its specific category, improving overall accuracy while managing complexity through modular architecture where each segment can be independently trained and maintained.
Solution Approach 2:
The system introduces intermediary classification layers that bridge the gap between simple signature-based detection and complex AI analysis. These intermediary models perform initial classification to route URLs to appropriate analysis pipelines, reducing the complexity burden on any single component while maintaining high overall detection accuracy through coordinated multi-stage processing.
3Measurement precision
If multiple classification models are used, then classification accuracy improves, but processing time increases
Solution Approach 1:
The system performs preliminary classification using lightweight models or feature-based filtering before applying heavier machine learning models. This preliminary action quickly eliminates obvious cases and routes only ambiguous URLs to more complex classification models, thereby maintaining high classification accuracy while significantly reducing average processing time through selective application of computational resources.
Solution Approach 2:
The system applies partial classification action by using different levels of model complexity for different URL types. For clearly identifiable URLs, simple rule-based or lightweight model classification suffices. For ambiguous cases, the system applies more extensive multi-model classification. This partial application of excessive computational action ensures high accuracy for difficult cases without unnecessarily processing all URLs with maximum computational intensity.
Data Source
AI summary
A method and device for classifying uniform resource locators based on content in corresponding websites includes extracting, by a network device, a plurality of website contents from a website associated with a URL based on Optical Character Recognition (OCR). Each of the plurality of website contents are classified into a plurality of webpage categories based on machine learning. User actions for the plurality of website contents are simulated based on a webpage category associated with each of the plurality of website contents. An access classification is determined for the URL based on results of simulating the user actions and machine learning.