URL Segment Transition Modeling for Dynamic Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems struggle to effectively identify dynamically generated URLs that evade block lists or reputation-based filters, as they rely on historical observations and fail to predict segment-segment transitions in URLs.
Innovation Solution
A machine learning model is trained with a list of established URLs to predict segment-segment transitions in new candidate URLs, using time-series predictions to assess the risk probability of URLs based on their segment sequences, distinguishing between legitimate and dynamically generated URLs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security systems use block lists or reputation-based filters, then they can block known malicious URLs, but they fail to identify dynamically generated URLs that evade these lists
Solution Approach 1:
The patent segments URLs into multiple components (protocol, domain, path, query parameters, etc.) and analyzes each segment independently using machine learning models. This segmentation allows the system to evaluate the risk probability of each component and combine them to determine overall URL risk, enabling detection of dynamically generated URLs that evade traditional block lists by analyzing structural patterns rather than relying on pre-defined signatures.
2Measurement precision
If security systems rely on historical observations of URLs, then they can identify previously seen malicious patterns, but they cannot predict segment-segment transitions in new candidate URLs
Solution Approach 1:
The patent performs preliminary training of machine learning models using historical URL data and segment transition patterns before deployment. The models are pre-trained to recognize legitimate segment-segment transitions and flag anomalies. When a new URL is evaluated, the pre-trained model can immediately assess risk probability without requiring real-time historical observations, enabling fast detection of dynamically generated URLs while maintaining high accuracy.
3Device complexity
If conventional systems use simple block lists, then they are easy to implement and maintain, but they lack the sophistication to analyze URL segment patterns and transitions
Solution Approach 1:
The patent introduces machine learning models as intermediary components between the input URL and the risk assessment output. These models act as mediators that analyze URL segment patterns, predict segment-segment transitions, and generate risk probability scores. This intermediary layer adds sophisticated analysis capability without requiring complete redesign of the security system architecture, allowing integration of advanced pattern recognition while maintaining relatively simple system structure.
Data Source
AI summary
Systems, methods, and apparatuses enable a machine learning model to determine a risk probability of a URL. A query configurator receives a URL in a query and normalizes the URL. The normalized URL is segmented into a plurality of segments. The plurality of segments is serially provided to the machine learning model trained to provide an indication of risk associated with the URL. The indication of risk associated with the URL can be a probability value based on one or more risk probabilities determined for segment-segment transitions of the URL. A security service compares the probability value of the URL to a threshold value and performs a security action based on a result of comparing the probability value to the threshold value.