Automatic detection of search results poisoning attacks

Patent metadata

Field	Value
Publication number	US-8997220-B2
Application number	US-201113116012-A
Country	US
Kind code	B2
Filing date	May 26, 2011
Priority date	May 26, 2011
Publication date	Mar 31, 2015
Grant date	Mar 31, 2015

Abstract

Search result poisoning attacks may be automatically detected by identifying groups of suspicious uniform resource locators (URLs) containing multiple keywords and exhibiting patterns that deviate from other URLs in the same domain without crawling and evaluating the actual contents of each web page. Suspicious websites are identified and lexical features are extracted for each such website. The websites are clustered based on their lexical features, and group analysis is performed on each group to identify at least one suspicious group. Other implementations are directed to detecting a search engine optimization (SEO) attack by processing a large population of URLs to identify suspicious URLs based on the presence of a subset of keywords in each URL and the relative newness of each URL.

First claim

What is claimed:

1. A method comprising:
identifying a plurality of suspicious websites from among a plurality of websites;
extracting a set of lexical features for each website among from the plurality of suspicious websites;
clustering each website from among the plurality of suspicious websites into a plurality of groups based on the set of lexical features extracted for each website;
performing group analysis on each group from among the plurality of groups to identify a…

Assignees

• Yu Fang
• Xie Yinglian
• Abadi Martin
• John John P
• Krishnamurthy Arvind
• Microsoft Technology Licensing Llc

Inventors

• Yu Fang
• Xie Yinglian
• Abadi Martin
• John John P
• Krishnamurthy Arvind

Classifications

• H04L63/1408

  Electricity · mapped topic

• H04L63/168

  Electricity · mapped topic

• H04L63/1466

  Electricity · mapped topic

• G06F21/56 Primary

  Physics · mapped topic