URL Classifier Feature Fusion for Resource-Efficient Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently identifying malicious URLs with limited computing resources, particularly in balancing network security and resource consumption during URL analysis.
Innovation Solution
A computing platform that parses and tokenizes URLs to identify human-engineered and deep learned features, using a concatenated vector representation to classify URLs through a neural network, and sets cybersecurity flags based on classification scores to manage resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive URL analysis techniques are integrated into automated security processes, then detection accuracy improves, but computing resource consumption increases
Solution Approach 1:
The URL analysis system is divided into multiple independent modules: URL parsing module, feature extraction module, machine learning classification module, and visual comparison module. Each module processes specific aspects of URL analysis independently, allowing the system to achieve comprehensive detection accuracy while managing computing resources through modular operation rather than monolithic processing
Solution Approach 2:
The system performs preliminary URL parsing and feature extraction before classification. By pre-processing URLs to extract structural features, domain information, and visual characteristics in advance, the system reduces the computational burden during the actual classification phase, maintaining high detection accuracy while optimizing resource usage during runtime
2Measurement precision
If advanced machine learning techniques are used for URL classification, then detection accuracy improves, but processing speed decreases
Solution Approach 1:
The classification process is segmented into feature extraction (using traditional methods) and classification (using machine learning models). By separating these tasks, the system can use computationally efficient feature extraction to prepare data, then apply ML models only to the extracted features, maintaining accuracy while improving overall processing throughput compared to applying ML to raw URLs
Solution Approach 2:
The patent introduces visual comparison as an intermediary step between URL analysis and final classification. By converting URLs to visual representations and comparing these visuals, the system adds another layer of accurate detection that works complementarily with traditional ML classification, enhancing overall accuracy without requiring ML models to process every aspect alone
3Reliability
If multiple analysis methods are combined for URL detection, then detection reliability improves, but system complexity increases
Solution Approach 1:
The system merges multiple analysis methods (URL parsing, feature extraction, machine learning classification, and visual comparison) into a unified detection framework. These diverse methods are combined to analyze URLs from multiple angles simultaneously, improving detection reliability by cross-validating results across different analysis approaches rather than relying on a single method
Solution Approach 2:
The complex multi-method analysis system is organized into distinct functional modules that operate semi-independently. Each module (parsing, feature extraction, classification, visual comparison) handles specific tasks with well-defined interfaces, making the overall complex system more manageable and maintainable through modular architecture rather than a monolithic complex system
Data Source
AI summary
Aspects of the disclosure relate to detecting and identifying malicious sites using machine learning. A computing platform may receive a uniform resource locator (URL). The computing platform may parse and/or tokenize the URL to reduce the URL into a plurality of components. The computing platform may identify human-engineered features of the URL. The computing platform may compute a vector representation of the URL to identify deep learned features of the URL. The computing platform may concatenate the human-engineered features of the URL to the deep learned features of the URL, resulting in a concatenated vector representation. By inputting the concatenated vector representation of the URL to a URL classifier, the computing platform may compute a phish classification score. In response to determining that the phish classification score exceeds a first phish classification threshold, the computing platform may cause a cybersecurity server to perform a first action.