Malicious URL Detection via Image Snapshot Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing URL detection engines struggle to efficiently and accurately identify malicious URLs, particularly those that evade detection by converting text to images, encrypting plaintext, hiding text in streaming media, or adding irrelevant text, limiting their effectiveness in identifying non-text content and encrypted or interfered-with web pages.
Innovation Solution
A method and device that analyze a URL's page content to determine if it is non-text, taking a snapshot of the page image for image detection or processing text content, using image and text analysis techniques to identify malicious attributes, including machine learning methods like Bayes classifiers and keyword filtering, to determine if the URL is malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If text content is converted into an image to evade detection, then the malicious page can avoid identification by text-based detection engines, but the detection accuracy for malicious URLs deteriorates because existing engines cannot effectively identify image-based content
Solution Approach 1:
The patent introduces an image recognition module as an intermediary between the URL detection system and image-based malicious pages. This module converts image content into recognizable text or features that can be analyzed by the detection engine, thereby bridging the gap between text-based detection and image-based evasion techniques.
Solution Approach 2:
The patent replaces traditional text-based analysis mechanisms with image recognition and processing capabilities. By substituting the mechanical text parsing system with optical character recognition (OCR) and image feature extraction, the system can detect malicious content that has been converted to image format.
2Object-affected harmful factors
If plaintext is encrypted and hidden to fight against detection, then malicious content can evade identification modules, but the ability to identify encrypted malicious pages deteriorates
Solution Approach 1:
The patent implements preliminary decryption and analysis actions before the main detection process. The system proactively identifies encrypted content, performs decryption using various algorithms, and analyzes the decrypted content for malicious attributes, thus preparing the data in advance for effective detection.
Solution Approach 2:
The patent changes the parameter of content representation from encrypted form to decrypted form. By applying decryption transformations to convert encrypted content back to its original state, the system restores the detectable characteristics of malicious content that were hidden through encryption.
3Object-affected harmful factors
If text information is hidden in streaming media to evade detection, then existing detection technology cannot identify the malicious content, but the detection capability for streaming media-based malicious pages deteriorates
Solution Approach 1:
The patent extracts text information from streaming media containers. The system identifies and separates hidden text content from the streaming media format, isolating the malicious text for analysis while removing it from its protective streaming media wrapper.
4Object-affected harmful factors
If a large amount of normal text is added to interfere with detection, then malicious pages can evade identification, but the efficiency and accuracy of detection deteriorates due to interference
Solution Approach 1:
The patent segments the page content into different regions and types, analyzing each segment independently. By dividing the content into text regions, image regions, and other elements, the system can focus detection resources on suspicious segments while ignoring benign content, thus improving efficiency despite the presence of interfering normal text.
Solution Approach 2:
The patent applies partial analysis by focusing detection efforts on specific high-risk areas of the page rather than uniformly analyzing all content. The system identifies and prioritizes certain regions for detailed analysis, performing excessive scrutiny on suspicious areas while using lighter analysis on obvious benign content.
Data Source
AI summary
Examples of the present disclosure provide a method and device for detecting a malicious URL, the method includes: a URL detection request is received, contents of a page addressed by a URL in the URL detection request are analyzed, and it is determined that whether the page is a non-text page; when the page is a non-text page, a page image of the page, which is displayed in a browser and addressed by the URL in the URL detection request, is obtained, image detection is performed on the page image, and a page attribute of the URL in the URL detection request is obtained, whether the URL is a malicious URL is determined based on the page attribute of the URL in the URL detection request.