URL Pattern Analysis for Web Threat Infection Chain Detection
Solution Overview
Problem
Current web threat filters are ineffective in detecting sophisticated web threats that utilize infection chains and FastFlux techniques, as they rely on outdated IP-based or URL-based block lists and struggle to identify compromised legitimate websites and constantly changing DNS domain names.
Innovation Solution
The method involves analyzing URL browsing histories to identify URL patterns and build models that detect web threat infection chains using unsupervised machine learning, correlating with web threat information, and deploying a suffix automata to automatically identify and block suspicious chains without relying on direct FastFlux network detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional IP-based or URL-based block lists are used to filter web threats, then the filtering service can operate with simple mechanisms, but the detection effectiveness deteriorates against sophisticated web threats using infection chains and FastFlux techniques
Solution Approach 1:
The patent transitions from static block lists to dynamic behavior analysis. The system monitors URL browsing chains in real-time, adapting to changing threat patterns by learning from user behavior and structural similarities in URL requests. This dynamic approach enables detection of sophisticated infection chains and FastFlux techniques that constantly change their IP addresses and domain names.
Solution Approach 2:
The patent replaces the mechanical system of maintaining and querying block lists with a machine learning-based detection system. The system uses unsupervised machine learning to automatically identify infection chains by analyzing patterns in URL browsing behavior, substituting manual rule-based filtering with automated behavioral analysis that can adapt to new threats without requiring explicit rules.
2Reliability
If web threat filters rely on known malicious website addresses in block lists, then the filtering database remains manageable, but the ability to detect compromised legitimate websites and constantly changing DNS domain names deteriorates
Solution Approach 1:
The patent extracts the essential characteristics of malicious behavior from known infection chains and applies these extracted patterns to detect unknown threats. By identifying structural similarities in URL request patterns and browsing chain structures, the system can detect compromised legitimate websites and FastFlux domains without needing to know their specific addresses in advance, thus avoiding the need to store large volumes of threat intelligence data.
3Measurement precision
If the system analyzes URL browsing histories to identify infection chains using machine learning, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by focusing analysis on specific patterns and structures in URL browsing chains that are most indicative of infection threats. Rather than analyzing all possible attributes of every URL request, the system identifies and monitors key structural features such as chain length, pattern repetition, and temporal sequences, achieving high detection accuracy with reduced processing overhead.
Data Source
AI summary
Uniform resource locator (URL) patterns are found in browsing histories of client computers. The URL patterns are employed to find URL browsing chains for particular client computers. A URL browsing chain includes URL requests that match URL patterns arranged in sequential order by time stamp. The URL browsing chains may be normalized and then evaluated for web threat infection chains. URL browsing chains that are deemed to be web threat infection chains are built into a model. The model may be deployed locally in a client computer or in a remotely located server computer to detect web threat infection chains.