URL Pattern Detection for Cloaked and Short-Lived Malicious Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for detecting malicious URLs are ineffective against cloaking and short-lived URLs, leading to undetected access to malicious content, and manual signature-based detection is inefficient.
Innovation Solution
A pattern-based detection system that generates and utilizes generalized representations of URL substrings, forming patterns from known benign and malicious URLs, which are stored in repositories for efficient detection of unknown URLs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual signature-based detection methods are used, then detection accuracy for known malicious URLs is improved, but system efficiency and automation are worsened
Solution Approach 1:
The system automatically generates URL patterns from collected malicious and benign URLs without manual intervention. The pattern generation process is self-service, where the system extracts features, creates patterns, and updates the pattern library autonomously, eliminating the need for manual signature creation while maintaining high detection accuracy
Solution Approach 2:
The system performs preliminary actions by proactively collecting URLs, generating patterns in advance, and maintaining an updated pattern library before detection is needed. This preliminary pattern generation enables rapid automated detection without sacrificing accuracy that would otherwise require manual signature-based approaches
2Ease of manufacture
If conventional detection systems are used, then simplicity of implementation is improved, but ability to detect cloaked and short-lived URLs is worsened
Solution Approach 1:
The system changes detection parameters by using generalized URL patterns that focus on structural and semantic features rather than exact string matches. This parameter change enables detection of cloaked URLs that use obfuscation techniques, as the pattern matching is insensitive to superficial variations while maintaining implementation simplicity through automated pattern generation
Solution Approach 2:
The system segments URLs into meaningful components and generates patterns based on these segments rather than treating URLs as indivisible strings. This segmentation approach allows detection of malicious patterns even when URLs are cloaked or modified, while keeping the implementation straightforward through systematic pattern generation from segmented URL features
3Adaptability or versatility
If generalized pattern representations are used, then detection of varied malicious URLs is improved, but complexity of pattern generation is worsened
Solution Approach 1:
The system performs self-service by automatically executing the entire pattern generation process including URL collection, feature extraction, pattern creation, and library updates without manual intervention. This automation handles the inherent complexity of generating generalized patterns while providing broad detection coverage across varied malicious URLs
Solution Approach 2:
The system performs preliminary pattern generation actions by proactively creating generalized patterns from collected URLs and storing them in a pattern library before detection operations. This preliminary action prepares the system to handle diverse malicious URLs with varied structures, reducing the apparent complexity during actual detection by having patterns pre-generated and organized
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To perform pattern-based detection of malicious URLs, patterns are first generated from known URLs to build a pattern repository. The patterns are generated by obtaining one or more URLs from a URL repository, wherein each URL of the one or more URLs is known to be malicious or benign; generating a representative pattern for each URL of the one or more URLs; and inserting one or more of the generated representative patterns in a pattern repository, wherein generating the representative pattern for each URL comprises: parsing the URL into a plurality of substrings; and generating a plurality of tokens by: tagging each substring of the plurality of substrings with a tag indicative of a type associated with the substring; and, for one or more substrings of the plurality of substrings, determining a generalized representation of the substring and replacing a text of the substring with the generalized representation.