URL Matching via Partial String Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current URL filtering methods are inefficient in detecting partially modified malicious URLs and require extensive matching processes, leading to erroneous detection and slowed performance, especially when filtering multiple communication destination URLs.
Innovation Solution
A URL matching apparatus that divides URLs into partial character strings and stores them as an associative array, allowing for fast search and matching by generating and storing partial character strings from both reference and matched URLs, enabling efficient detection even with partial changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL filtering is performed by matching against large number of blacklist URLs to detect partially modified malicious URLs, then detection capability is improved, but matching processing time increases significantly
Solution Approach 1:
The patent divides URLs into multiple segments (scheme, domain, path, query parameters) and creates a segmented index structure. This allows the filtering system to compare only corresponding segments rather than performing full URL matching against all blacklist entries, significantly reducing processing time while maintaining detection capability for partially modified URLs.
Solution Approach 2:
The patent performs preliminary processing by pre-segmenting and indexing the blacklist URLs before actual filtering operations. The segmented index is built in advance, allowing the system to quickly retrieve and compare relevant segments during filtering without performing complete URL matching, thus reducing real-time processing time.
2Productivity
If exact matching is used for URL filtering, then processing speed is improved, but detection of partially modified malicious URLs deteriorates
Solution Approach 1:
The patent implements partial matching by comparing corresponding segments of URLs rather than requiring complete URL matches. The segmented index allows the system to perform matching on subsets of URL components (e.g., domain and path segments), enabling detection of partially modified malicious URLs while maintaining faster processing than full URL comparison.
3Measurement precision
If full URL matching is performed to ensure accurate detection, then measurement precision is improved, but processing time increases
Solution Approach 1:
The patent segments URLs into comparable components and indexes them separately. This segmentation allows the system to achieve accurate matching by comparing corresponding segments (scheme with scheme, domain with domain, path with path) rather than performing computationally expensive full string matching, thus maintaining precision while reducing processing time.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A URL matching apparatus generates partial character string information storing therein, as keys of an associative array, partial character strings obtained by connecting stepwise in order from a character string of an upper layer of a hierarchical structure of one or more reference URLs. The URL matching apparatus generates partial character strings obtained by connecting stepwise in order from a character string of an upper layer of a hierarchical structure, also for a URL to be matched, and for each of these partial character strings of the URL to be matched, searches the partial character string information with that partial character string being a key. Thereby, even if a URL is partially changed, matching is able to be performed at high speed.