Uniform resource locator security analysis using malice patterns

US11379577B2 · kind B2 · utility

Assignee

• MICROSOFT TECHNOLOGY LICENSING, LLC · US

Inventors

• Amar Patel · Woodinville, US
• Ravi Shahani · Redmond, US
• Revanth Rameshkumar · Redmond, US
• Ethan Jacob Holland · Rockville, US
• Douglas J. Hines · Kenmore, US
• Abhijeet Surendra HATEKAR · Kirkland, US

Key dates

• Filing date: Sep 26, 2019
• Grant date: Jul 5, 2022
• Expiry date: Sep 2, 2040

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F2221/2119
• WIPO field: Computer technology
• WIPO sector: Electrical engineering

Abstract

Cybersecurity enhancements help avoid malicious Uniform Resource Locators (URLs). Embodiments may reduce or eliminate reliance on subjective analysis or detonation virtual machines. URL substrings are automatically analyzed for maliciousness using malice patterns. Patterns may test counts, lengths, rarity, encodings, and other inherent aspects of URLs. URLs may be analyzed individually, or in groups to detect shared portions, or both. URL analysis may use or avoid machine learning, and may use or avoid lookups. Malice patterns may be used individually or in combinations to detect malicious URLs. Analysis results may enhance security through blocking use of suspect URLs, flagging them for further analysis, or allowing their validated use, for instance. Analysis results may also be fed back to further train a machine learning model or a statistical model.