Analyzing QR code risk

Patent metadata

Field	Value
Publication number	US-12450361-B2
Application number	US-202318177812-A
Country	US
Kind code	B2
Filing date	Mar 3, 2023
Priority date	Mar 3, 2023
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

A method, computer system, and a computer program product for risk analysis is provided. The present invention may include receiving an access request. The present invention may include analyzing a matrix barcode associated with the access request. The present invention may include validating the matrix barcode. The present invention may include providing a validation status to a user.

First claim

What is claimed is:

1. A method for risk analysis, the method comprising:
receiving an access request from a device associated with a user, wherein the access request includes a matrix barcode;
analyzing a matrix barcode associated with the access request by extracting one or more characteristics from the matrix barcode;
performing a characteristic connection between the one or more characteristics from the matrix barcode and a plurality of characteristics from previously identified malicious matrix barcodes stored in a risk knowledge base;
validating the matrix barcode in a matrix barcode secure sandbox using one or more web vulnerability scanning tools, wherein the matrix barcode secure sandbox is comprised of at least a validator, a risk manager, a rule manager, and a sandbox manager, wherein the rule manager is utilized to evaluate the access request based on one or more rules specific to the user, and wherein the validator is configured to process output received from the risk manager and rule manager in determining a validation status of a Uniform Resource Locator (URL) associated with the access request; and
providing the validation status to the user.

2. The method of claim 1 , further comprising:
identifying one or more similar characteristics between the matrix barcode and at least one of the malicious matrix barcodes using k-means clustering, wherein each of the one or more similar characteristics exceed a similarity threshold, wherein the similarity threshold is specific to the device associated with the user and includes at least a k-means clustering dimension threshold.

3. The method of claim 2 , wherein at least one of the one or more similar characteristics is a similar visual characteristic identified based on applying the k-means clustering an image of the matrix barcode and images of the at least one malicious matrix barcode.

4. The method of claim 1 , wherein the validation status provided to the user is displayed visibly within an internet browser on an end user device (EUD) of the user along with the URL associated with the access request, and wherein the validation status includes visual indicator corresponding to an evaluation and description corresponding to the evaluation, wherein the description corresponding to the evaluation is displayed to the user in response to user feedback received from the user to the validation status of the matrix barcode.

5. The method of claim 1 , wherein the validating further comprises:
launching a matrix barcode server, wherein the matrix barcode server is an isolated computing environment;
executing the one or more web vulnerability scanning tools within the matrix barcode server to analyze the extracted characteristics of the matrix barcode for potential security threats; and
generating a validation result based on the analysis of the extracted characteristics, wherein the validation result is provided to the user as part of the validation status.

6. A computer system for risk analysis, comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
receiving an access request from a device associated with a user, wherein the access request includes a matrix barcode;
analyzing a matrix barcode associated with the access request by extracting one or more characteristics from the matrix barcode;
performing a characteristic connection between the one or more characteristics from the matrix barcode and a plurality of characteristics from previously identified malicious matrix barcodes stored in a risk knowledge base;
validating the matrix barcode in a matrix barcode secure sandbox using one or more web vulnerability scanning tools, wherein the matrix barcode secure sandbox is comprised of at least a validator, a risk manager, a rule manager, and a sandbox manager, wherein the rule manager is utilized to evaluate the access request based on one or more rules specific to the user, and wherein the validator is configured to process output received from the risk manager and rule manager in determining a validation status of a Uniform Resource Locator (URL) associated with the access request; and
providing the validation status to the user.

7. The computer system of claim 6 , further comprising:
identifying one or more similar characteristics between the matrix barcode and at least one of the malicious matrix barcodes using k-means clustering, wherein each of the one or more similar characteristics exceed a similarity threshold, wherein the similarity threshold is specific to the device associated with the user and includes at least a k-means clustering dimension threshold.

8. The computer system of claim 7 , wherein at least one of the one or more similar characteristics is a similar visual characteristic identified based on applying the k-means clustering an image of the matrix barcode and images of the at least one malicious matrix barcode.

9. The computer system of claim 6 , wherein the validation status provided to the user is displayed visibly within an internet browser on an end user device (EUD) of the user along with the URL associated with the access request, and wherein the validation status includes visual indicator corresponding to an evaluation and description corresponding to the evaluation, wherein the description corresponding to the evaluation is displayed to the user in response to user feedback received from the user to the validation status of the matrix barcode.

10. The computer system of claim 6 , wherein the validating further comprises:
launching a matrix barcode server, wherein the matrix barcode server is an isolated computing environment;
executing the one or more web vulnerability scanning tools within the matrix barcode server to analyze the extracted characteristics of the matrix barcode for potential security threats; and
generating a validation result based on the analysis of the extracted characteristics, wherein the validation result is provided to the user as part of the validation status.

11. A computer program product for risk analysis, comprising:
one or more non-transitory computer-readable storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions executable by a processor to cause the processor to perform a method comprising:
receiving an access request from a device associated with a user, wherein the access request includes a matrix barcode;
analyzing a matrix barcode associated with the access request by extracting one or more characteristics from the matrix barcode;
performing a characteristic connection between the one or more characteristics from the matrix barcode and a plurality of characteristics from previously identified malicious matrix barcodes stored in a risk knowledge base;
validating the matrix barcode in a matrix barcode secure sandbox using one or more web vulnerability scanning tools, wherein the matrix barcode secure sandbox is comprised of at least a validator, a risk manager, a rule manager, and a sandbox manager, wherein the rule manager is utilized to evaluate the access request based on one or more rules specific to the user, and wherein the validator is configured to process output received from the risk manager and rule manager in determining a validation status of a Uniform Resource Locator (URL) associated with the access request; and
providing the valid

Assignees

• IBM

Inventors

• Jiang peng hui
• Guan Zhi Li
• Sun sheng yan
• Su Jun
• Yang Kun
• Huang Yi Wen

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title