Web Resource Classification via Browser and Search Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively identify and mitigate malicious web resources that cause user electronic devices to execute malicious activities, as they rely on outdated virus lists and do not account for the misalignment between frequent access attempts and general popularity of web resources.
Innovation Solution
A method and server system that analyze browsing logs to identify suspicious access attempts, particularly those with a 'first launch parameter,' and cross-reference them with search engine logs to determine if the web resources are malicious by assessing their popularity and organic traffic, adding them to a blacklist for future blocking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing anti-virus methods use outdated virus lists to block malicious software, then the system is simple to operate, but it fails to effectively identify and mitigate new malicious web resources
Solution Approach 1:
The system performs preliminary analysis of web resources by examining browser launch parameters and search engine logs before actual malicious activity occurs. It proactively identifies suspicious patterns (high first-launch access rates combined with low search popularity) and classifies resources as malicious in advance, enabling preventive blocking before users are harmed.
Solution Approach 2:
The patent introduces an intermediary classification server that sits between users and the internet. This server receives browsing data, analyzes it against established criteria (first-launch parameter + search popularity threshold), and returns classification decisions. This intermediary layer handles the complexity of pattern recognition while keeping end-user systems simple.
2Measurement precision
If the system analyzes all browser logs to identify malicious resources, then the identification accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
Instead of uniformly analyzing all log entries with equal intensity, the system applies different analysis depths based on local characteristics. It first filters for entries with high first-launch parameters (indicating potential malware), then only performs deep search log analysis on those suspicious candidates. This localized quality approach maintains high detection accuracy while significantly reducing overall processing time.
Solution Approach 2:
The system performs partial analysis by focusing only on specific log patterns that indicate malicious behavior (first-launch parameter + low search popularity). Rather than exhaustively analyzing every possible browsing scenario, it applies analysis only where the pattern matches known malicious characteristics, achieving sufficient accuracy without excessive computational effort.
3Object-affected harmful factors
If the system blocks all web resources with high first-launch access rates, then malicious resources are caught, but legitimate resources with similar access patterns are also blocked
Solution Approach 1:
Instead of blocking resources based solely on high access rates (which would over-block legitimate content), the system inverts the logic by looking for the combination of high first-launch access rates PLUS low search engine popularity. This inverted criteria (high access + low popularity = suspicious) maintains adaptability by allowing legitimate resources with high traffic to pass through, while catching malware that exploits first-launch behavior.
Data Source
AI summary
There is disclosed a method and a system for classifying a web resource. The method comprises retrieving data associated with a plurality of browser logs of browser applications. The browser logs include information about past browsing activities: an identifier of a given web resource associated with an access attempt, an indication of a parent process that initiated the access attempt, and a first launch parameter. In response to (i) the first launch parameter being indicative of the access attempt being executed as part of the first launch of the browser application and (ii) the parent process not being listed in a parent process white list, analyzing the plurality of past search session log of a search engine server to determine a historical search parameter associated with the given web resource. Based on the analysis of the historical search parameter, adding the given web resource to a blacklist of web resources.