URL Segmentation and Hashing for Suspect Destination Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content filtering methods are ineffective in identifying network addresses associated with suspect destinations due to the dynamic nature of Uniform Resource Locators (URLs), as they rely on exact string comparisons that are rendered obsolete by frequent changes in the server portion of the URL path.
Innovation Solution
A method and system that segment URLs into component parts, classify and hash them, and compare these hash values with a database of known suspect URLs, allowing for flexible and inexact matches, including out-of-order matches, to determine the extent of similarity and trigger corrective actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If exact URL string comparison is used for content filtering, then implementation simplicity is maintained, but identification accuracy deteriorates due to frequent URL changes
Solution Approach 1:
The patent segments a URL into multiple component parts (protocol, domain, path, query parameters, etc.) and compares each segment independently. This allows the system to identify suspect destinations even when the complete URL string has changed, as long as key segments remain similar. The segmentation resolves the contradiction by maintaining implementation simplicity through modular comparison while improving identification accuracy by tolerating variations in non-critical segments.
2Adaptability or versatility
If frequent URL changes are accommodated, then adaptability to dynamic content is improved, but reliability of content filtering deteriorates due to false positives
Solution Approach 1:
The patent applies different comparison criteria to different segments of the URL based on their importance. Critical segments (such as domain name, path structure) are compared with stricter matching, while less critical segments allow for more variation. This local quality approach enables the system to adapt to URL changes in non-essential parts while maintaining reliable identification through strict comparison of essential parts, thus resolving the contradiction between adaptability and reliability.
Data Source
AI summary
A method and system for identifying network addresses associated with suspect network destinations is described. One embodiment receives a target Uniform Resource Locator (URL) to be analyzed; segments the target URL into a set of component parts; classifies each component part in the set of component parts as a primary domain, a subdomain, or a page; hashes each component part in the set of component parts to produce a hash value for that component part; compares the hash values of the set of component parts from the target URL with hash values stored in a database, the hash values stored in the database having been obtained by segmenting, classifying, and hashing, in the same manner as the target URL, each of a set of URLs known to be associated with suspect network destinations; computing a score that indicates the extent to which the hash values of the set of component parts from the target URL match hash values stored in the database; and taking corrective action, when the score satisfies a predetermined criterion. In one embodiment, taking correction action includes notifying a user that the target URL is believed to be associated with a suspect network destination. In another embodiment, taking corrective action includes blocking a network connection between a computer and the network destination associated with the target URL.