Network attack prevention systems and methods

Patent metadata

Field	Value
Publication number	US-12309172-B2
Application number	US-202217691930-A
Country	US
Kind code	B2
Filing date	Mar 10, 2022
Priority date	Mar 10, 2022
Publication date	May 20, 2025
Grant date	May 20, 2025

Abstract

A system and method for preventing access to potentially malicious network destinations. The method includes determining a plurality of network destinations and indicators of the plurality of network destinations including an indicator of a first network destination. A plurality of feature vectors are generated based on the plurality of network destinations including a first feature vector based on the first network destination. Access by a user via a computing device to a second network destination is detected. A second feature vector is generated, and an indicator is determined based on the second network destination. The second feature vector is compared to the plurality of feature vectors. The access by the user to the second network destination is blocked based on the indicator of the first network destination, the indicator of the second network destination, and the comparison of the second feature vector to the plurality of feature vectors.

First claim

What is claimed is:

1. A method comprising:
determining a plurality of network destinations comprising a first network destination, the plurality of network destinations comprising a plurality of webpages and the first network destination comprising a first webpage;
determining a plurality of indicators of the plurality of network destinations comprising at least one indicator of the first network destination, the plurality of indicators comprising a plurality of Uniform Resource Locators (“URLs”) of the plurality of webpages and a plurality of certificates of the plurality of webpages, and the at least one indicator of the first network destination comprising a Uniform Resource Locator (“URL”) of the first webpage and a certificate of the first webpage;
capturing a plurality of images of the plurality of webpages, comprising capturing a first image of the first webpage;
generating a plurality of feature vectors based on the plurality of images comprising a first feature vector based on the first image;
training a particular model based on the plurality of feature vectors and the plurality of indicators;
monitoring network browsing of a particular user on a particular computing device;
further training the particular model to generate an updated model based on the network browsing of the particular user on the particular computing device;
detecting an access by the particular user via the particular computing device to a second network destination, the second network destination comprising a second webpage;
capturing a second image of the second webpage;
generating a second feature vector based on the second image;
determining at least one indicator of the second network destination, the at least one indicator of the second network destination comprising a URL of the second webpage and a certificate of the second webpage;
applying the updated model to the second feature vector and the at least one indicator of the second network destination; and
blocking the access by the particular user via the particular computing device to the second network destination based on the applying of the updated model.

2. The method of claim 1 , further comprising
determining the plurality of network destinations comprising the first network destination based on the network browsing of the particular user.

3. The method of claim 1 , further comprising:
determining a match between the second feature vector and the first feature vector based on a comparison of the second feature vector to the plurality of feature vectors comprising the first feature vector; and
blocking the access by the particular user via the particular computing device to the second network destination further based on the determination of the match.

4. The method of claim 1 , further comprising:
training a classifier based on the first feature vector and the at least one indicator of the first network destination;
applying the classifier to the at least one indicator of the second network destination; and
blocking the access by the particular user via the particular computing device to the second network destination based on the applying of the classifier.

5. The method of claim 1 , wherein:
the at least one indicator of the first network destination further comprises metadata of the first webpage; and
the at least one indicator of the second network destination further comprises metadata of the second webpage.

6. The method of claim 1 , further comprising:
monitoring network browsing of a plurality of users on a plurality of computing devices; and
determining the plurality of network destinations comprising the first network destination based on the network browsing of the plurality of users.

7. The method of claim 1 , further comprising:
monitoring network browsing of a plurality of users on a plurality of computing devices;
and
determining the plurality of network destinations comprising the first network destination further based on the network browsing of the plurality of users.

8. The method of claim 1 , further comprising inputting the plurality of feature vectors and the plurality of indicators to a convolutional neural network (“CNN”) to train the particular model.

9. The method of claim 1 , further comprising:
monitoring network browsing of a plurality of users on a plurality of computing devices;
determining the plurality of network destinations comprising the first network destination based on the network browsing of the plurality of users; and
transmitting the particular model to the particular computing device.

10. The method of claim 9 , further comprising:
determining additional network destinations based on the network browsing of the particular user on the particular computing device;
determining additional indicators of the additional network destinations; and
generating additional feature vectors based on the additional network destinations; wherein the further training of the particular model to generate the updated model is based on the additional feature vectors and the additional indicators.

11. The method of claim 10 , wherein the particular model comprises a particular convolutional neural network (“CNN”), the method further comprising:
inputting the plurality of feature vectors and the plurality of indicators to the particular CNN to train the particular model;
inputting the additional feature vectors and the additional indicators to the particular CNN to further train the particular model to generate the updated model, wherein the updated model comprises an updated CNN; and
inputting the second feature vector and the at least one indicator of the second network destination to the updated CNN to apply the updated model.

12. The method of claim 11 , wherein the particular model further comprises a clustering algorithm, the method further comprising:
inputting an output resulting from the inputting of the plurality of feature vectors and the plurality of indicators to the particular CNN to the clustering algorithm to train the particular model;
inputting an output resulting from the inputting of the additional feature vectors and the additional indicators to the particular CNN to the clustering algorithm to further train the particular model to generate the updated model, the updated model comprising the clustering algorithm; and
inputting an output resulting from the inputting of the second feature vector and the at least one indicator of the second network destination to the updated CNN to the clustering algorithm to apply the updated model.

13. The method of claim 1 ,
the method further comprising:
determining a plurality of numbers of URL links respectively embedded in the plurality of webpages, wherein a first number of URL links embedded in the first webpage are determined;
determining a second number of URL links embedded in the second webpage;
generating the plurality of feature vectors comprising the first feature vector based on the plurality of numbers of URL links embedded, wherein the first feature vector is based on the first number of URL links embedded; and
generating the second feature vector based on the second number of URL links embedded.

14. The method of claim 1 , wherein the applying of the updated model comprises comparing the second feature vector to the plurality of feature vectors comprising the first feature vector, and the comparing comprises determining a Euclidian distance between the second feature vector and the first feature vector.

15. The method of claim 1 , further comprising providing a notification to the particular user based on the appl

Assignees

• Avast Software Sro

Inventors

• Wasicek Armin
• Biondi Fabrizio
• Salomon Thomas

Classifications

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06F16/955

  using information identifiers, e.g. uniform resource locators [URL] · CPC title

• G06F18/24147

  Distances to closest patterns, e.g. nearest neighbour classification · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/098

  Distributed learning, e.g. federated learning · CPC title