Detecting malformed resource references

Patent metadata

Field	Value
Publication number	US-12332961-B1
Application number	US-202016928669-A
Country	US
Kind code	B1
Filing date	Jul 14, 2020
Priority date	Jul 9, 2020
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Statistical analysis can be used to attempt to identify potentially malicious references, such as trap URLs. When a URL is utilized for a request, that request can be intercepted before analysis before that URL is resolved to an address. Portions of this URL, as well as the entire URL, can be compared against one or more lists of known URLs using a probabilistic matching process to determine whether there are any matches that are very close but not quite exact. Any determined match with high probability above a suspicion threshold can be flagged as being suspicious, or associated with a potentially malicious site. An action can then be taken, such as to block that URL or prompt a user for confirmation of intent.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
intercepting, at a component that is distinct from a user and adapted to be updated using feedback that is specific to the user, a request from the user for a destination specified by a uniform resource locator (URL), the intercepting occurring prior to a receipt of the request by a request resolution server;
determining, by analyzing textual content associated with the URL, a first set of match scores corresponding to a first set of probabilistic matches with entries on a list of approved URLs in the component, the match scores determined in part on similarities identified between text of the URL and text of respective URLs on the list of approved URLs;
determining whether one or more of the first set of match scores for the probabilistic matches did not reach a suspicion threshold;
determining, in response to at least one of the first set of match scores matches did not reach the suspicion threshold:
a second set of match scores based in part on similarities identified between the text of one or more substrings of the URL and the text of respective URLs on the list of approved URLs, and
a third set of match scores when the URL containing fully-qualified domain name (FQDN), where the URL string is decomposed into composite parts and a combined probabilistic string comparison to be performed; and
in response to determining that one or more of the second set of match scores for a subset of the probabilistic matches or the third set of match scores exceeds the suspicion threshold, which is indicative of a non-exact probabilistic match, sending a user notification to confirm the URL before transmitting the request to the destination, wherein the sending of the user notification is enabled to occur after analyzing the URL and the one or more substrings of the URL.

2. The computer-implemented method of claim 1 , further comprising: blocking the request; and providing the user notification after the blocking of the request.

3. The computer-implemented method of claim 1 , wherein the suspicion threshold corresponds to a maximum allowable match probability value for a non-exact probabilistic match.

4. The computer-implemented method of claim 1 , further comprising: comparing the URL against at least one of the list of approved URLs or a list of denied URLs in the analyzing the URL before analyzing the one or more substrings of the URL to determine the probabilistic matches.

5. The computer-implemented method of claim 1 , wherein the probabilistic matches are determined using a Bayesian probabilistic comparison or a trained neural network.

6. A computer-implemented method, comprising:
receiving, at a component that is distinct from a user and adapted to be updated using feedback that is specific to the user, a request from the user that includes a uniform resource locator (URL) string that identifies a destination for the request, the receiving occurring prior to a receipt of the request by a request resolution server;
comparing textual content associated with the string against a whitelist of allowable strings in the component to determine a first set of probabilistic match values;
in response to at least one of the first set of probabilistic match values did not reach a threshold:
comparing one or more portions of the string against the whitelist of the allowable strings in the component to determine a second set of probabilistic match values, and
comparing, when the string containing fully-qualified domain name (FQDN), decomposed parts of the string against the whitelist of the allowable strings in the component to determine a third set of combined probabilistic match values of the decomposed parts;
and
taking a remedial action to at least one of the second set or the third set of probabilistic match values exceeds the threshold which is indicative of a non-exact match, wherein the remedial action is enabled to occur after comparing of the string and the one or more portions of the string.

7. The computer-implemented method of claim 6 , wherein the threshold is a suspicion threshold that is above an exact match value.

8. The computer-implemented method of claim 7 , wherein the remedial action includes at least one of prompting a user for confirmation, generating a notification for the user, blocking the request, disabling input fields associated with the request, adding the string to a blacklist of denied strings, or correcting a string, based in part on the at least one of the one or more probabilistic match values exceeding the threshold.

9. The computer-implemented method of claim 8 , wherein the string that identifies the destination is also compared against the blacklist of denied strings as part of the comparing of the string.

10. The computer-implemented method of claim 6 , wherein the request is received by intercepting the request before the string is resolved into a network address for transmission to the destination.

11. The computer-implemented method of claim 6 , wherein the first and the second set of probabilistic match values are determined using a Bayesian probabilistic comparison or a trained neural network.

12. The computer-implemented method of claim 6 , wherein the receiving the request includes intercepting the request using at least one of application code, a browser plugin, a proxy server, a filter driver, or a boundary network appliance.

13. A communication system, comprising:
one or more processors; and memory including instructions that, when executed by the one or more processors, cause the communication system to:
intercept, at a component that is distinct from a user and adapted to be updated using feedback that is specific to the user, a communication from the user that includes a uniform resource locator (URL) string that identifies a destination for the communication, the intercept to occur prior to a receipt of the communication by a request resolution server;
compare textual content associated with the string against a list of allowable strings to determine a first set of probabilistic match values;
in response to determining that one or more of the first set of probabilistic match values did not reach a threshold:
compare one or more portions of the string against the list of the allowable strings to determine a second set of probabilistic match values, and
comparing, when the string contains fully-qualified domain name (FQDN), decomposed parts of the string against the list of the allowable strings in the component to determine a third set of combined probabilistic match values of the decomposed parts; and
perform at least one remedial action to at least one of the second set or the third set of probabilistic match values exceeding the threshold which is indicative of a non-exact match, wherein the at least one remedial action is enabled to occur after comparing of the string and the one or more portions of the string.

14. The communication system of claim 13 , wherein the threshold is a suspicion threshold that is above an exact match value.

15. The communication system of claim 14 , wherein the remedial action includes at least one of prompting a user for confirmation, generating a notification for the user, blocking the communication, disabling input fields associated with the communication, adding the string to a blacklist of denied strings, or correcting the string, based at least in part on the at least one of the one or more probabilistic match values exceeding the threshold.

16. The communication system of claim 15 , wherein the string that identifies the destination is compared a

Assignees

• Nvidia Corp

Inventors

• Woodard Andrew James
• Rose Amy
• Waine Benjemin Thomas
• Schneider Christopher

Classifications

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06F16/9566 Primary

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title

• G06F16/90344 Primary

  by using string matching techniques · CPC title