URL Selection Method for Malicious URL Detection

The patent extracts only the necessary subset of malicious URLs from the complete set found by analysis techniques. The URL list generation unit selectively imports URLs into the security appliance based on priority rankings and upper limit values, rather than importing all detected URLs. This extraction approach maintains detection accuracy by including the most critical URLs while respecting processing performance constraints.

The patent changes the parameter of URL quantity from 'all detected URLs' to 'optimized subset of URLs'. By introducing priority values and upper limit values as controlling parameters, the system transforms the URL list from a complete but unmanageable set into a optimized subset that balances detection accuracy with processing performance capabilities.

The patent segments the URL extraction process into two distinct steps: first extracting URLs up to technique-specific upper limit values, then performing secondary extraction to fill remaining capacity. This segmentation allows each analysis technique to contribute its findings while maintaining overall diversity, as the secondary extraction step ensures that capacity is fully utilized across multiple techniques rather than being dominated by a single high-priority technique.

The patent applies partial action by extracting only the necessary portion of URLs from each technique (up to upper limit values) rather than using all URLs from all techniques equally. The secondary extraction step then supplements this partial extraction to reach the optimal total number, ensuring both priority-based selection and diverse technique utilization without excessive processing.