Systems and methods for identifying uniform resource locators that link to potentially malicious resources

Patent metadata

Field	Value
Publication number	US-9330258-B1
Application number	US-201314041826-A
Country	US
Kind code	B1
Filing date	Sep 30, 2013
Priority date	Sep 30, 2013
Publication date	May 3, 2016
Grant date	May 3, 2016

Abstract

A computer-implemented method for identifying URLs that link to potentially malicious resources may include (1) compiling a set of URLs that link to at least one potentially malicious resource, (2) identifying a common pattern of characters included in the set of URLs that link to the potentially malicious resource, (3) deriving a regular expression capable of being used to identify additional URLs that link to one or more potentially malicious resources based at least in part on the common pattern of characters, and then (4) identifying at least one additional URL that links to at least one potentially malicious resource by (i) applying the regular expression to the additional URL and then (ii) determining that the additional URL links to the potentially malicious resource based at least in part on applying the regular expression to the additional URL. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for identifying Uniform Resource Locators (URLs) that link to potentially malicious resources, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
compiling a set of one-time URLs that each facilitate a download of a potentially malicious resource only once in response to a user click performed on a redirection link included in a search result, wherein compiling the set of one-time URLs comprises:
determining that at least one security agent installed on a set of user devices has encountered the potentially malicious resource via the set of one-time URLs in response to user clicks performed on redirection links included in search results;
identifying each one-time URL at which the security agent installed on the set of user devices has encountered the potentially malicious resource;
compiling the set of one-time URLs to include each one-time URL at which the security agent has encountered the potentially malicious resource;

identifying a common pattern of characters included in the set of one-time URLs that link to the potentially malicious resource, the common pattern of characters comprising a plurality of character strings included in each one-time URL within the set of one-time URLs;
deriving, based at least in part on the plurality of character strings included in each one-time URL within the set of one-time URLs, a regular expression capable of being used to identify additional one-time URLs that each facilitate a download of one or more potentially malicious resources only once;
identifying at least one additional one-time URL that facilitates a download of at least one potentially malicious resource only once in response to an additional user click performed on an additional redirection link included in an additional search result by:
applying the regular expression to the additional one-time URL;
determining that the additional one-time URL links to the potentially malicious resource based at least in part on applying the regular expression to the additional one-time URL.

2. The method of claim 1 , further comprising:
detecting at least one attempt by a user device to access the additional URL that links to the potentially malicious resource;
in response to detecting the attempt to access the additional URL, blocking the attempt to access the additional URL before the user device encounters the potentially malicious resource via the additional URL.

3. The method of claim 1 , wherein compiling the set of URLs comprises grouping the set of URLs into subsets based at least in part on similarity by:
comparing at least one URL in the set of URLs with at least one other URL in the set of URLs;
determining, based at least in part on the comparison, that the URL and the other URL exceed a threshold level of similarity relative to one another;
in response to determining that the URL and the other URL exceed the threshold level of similarity, forming a subset of similar URLs that includes the URL and the other URL.

4. The method of claim 3 , wherein:
identifying the common pattern of characters included in the set of URLs comprises identifying the common pattern of characters included in the subset of similar URLs;
deriving the regular expression capable of being used to identify additional URLs that link to the potentially malicious resource comprises deriving, based at least in part on the common pattern of characters included in the subset of similar URLs, a regular expression capable of being used to identify additional URLs that link to the potentially malicious resource.

5. The method of claim 4 , wherein grouping the set of URLs into subsets based at least in part on similarity further comprises:
comparing at least one additional URL in the set of URLs with at least one further URL in the set of URLs;
determining, based at least in part on the comparison, that the additional URL and the further URL exceed a threshold level of similarity relative to one another;
in response to determining that the additional URL and the further URL exceed the threshold level of similarity, forming another subset of similar URLs that includes the additional URL and the further URL.

6. The method of claim 5 , wherein:
identifying the common pattern of characters included in the set of URLs comprises identifying the common pattern of characters included in the other subset of similar URLs;
deriving the regular expression capable of being used to identify additional URLs that link to the potentially malicious resource comprises deriving, based at least in part on the common pattern of characters included in the other subset of similar URLs, a regular expression capable of being used to identify additional URLs that link to the potentially malicious resource.

7. The method of claim 1 , wherein deriving the regular expression capable of being used to identify additional URLs that link to the potentially malicious resource comprises providing the set of URLs to an expression-derivation tool that derives the regular expression from the set of URLs.

8. The method of claim 1 , wherein:
the potentially malicious resource comprises a malicious file;
identifying the additional URL that links to the potentially malicious resource comprises identifying a URL that facilitates downloading the malicious file;
further comprising:
detecting at least one attempt by a user device to access the URL that facilitates downloading the malicious file;
in response to detecting the attempt to access the URL, blocking the attempt to access the URL before the user device downloads the malicious file via the URL.

9. The method of claim 1 , further comprising:
testing the regular expression against one or more non-malicious URLs;
upon testing the regular expression against the non-malicious URLs, determining that the test of the regular expression resulted in at least one false positive;
in response to determining that the test of the regular expression resulted in the false positive, discarding the regular expression to avoid false positives resulting from the regular expression.

10. The method of claim 9 , wherein:
determining that the test of the regular expression resulted in the false positive comprises:
calculating an amount of false positives that resulted from the test of the regular expression;
determining that the amount of false positives exceeds a predetermined threshold;
discarding the regular expression to avoid false positives comprises refraining from applying the regular expression to additional URLs due at least in part to the amount of false positives that resulted from the test of the regular expression.

11. The method of claim 1 , wherein applying the regular expression to the additional URL comprises at least one of:
applying the regular expression at a network layer of a user device;
applying the regular expression at a network gateway.

12. A system for identifying URLs that link to potentially malicious resources, the system comprising:
a compilation module, stored in memory, that compiles a set of one-time URLs that each facilitate a download of a potentially malicious resource only once in response to a user click performed on a redirection link included in a search result, wherein compiling the set of one-time URLs comprises:
determining that at least one security agent installed on a set of user devices has encountered the potentially malicious resource via the set of one-time URLs in response to user clicks performed on redirection links included in search results;
identifying each one-time URL at which the secur

Assignees

• Symantec Corp

Inventors

• Satish Sourabh
• Ren Jingjing

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title