Detecting malicious websites

Patent metadata

Field	Value
Publication number	US-9621576-B1
Application number	US-201414587871-A
Country	US
Kind code	B1
Filing date	Dec 31, 2014
Priority date	Dec 31, 2014
Publication date	Apr 11, 2017
Grant date	Apr 11, 2017

Abstract

There are disclosed techniques for use in detecting malicious websites. In at least one embodiment, there is disclosed a technique for generating a profile in connection with a website. The profile comprising at least one attribute associated with the website. The technique also comprises collecting information relating to the website during a visit to the website. The technique further comprises detecting a change in connection with the website. The detection of the change comprises identifying a variation between the generated profile and the collected information.

First claim

What is claimed is:

1. A method, comprising:
generating, by processing circuitry, a profile in connection with a website, wherein the profile comprises at least one attribute associated with the website;
during a visit to the website, collecting, by processing circuitry, information relating to the website;
detecting, by processing circuitry, a change in connection with the website, wherein detecting the change comprises identifying a variation between the generated profile and the collected information;
assigning, by processing circuitry, a score based on the change;
comparing, by processing circuitry, the score to a threshold; and
in response to a relationship between the score and the threshold, sending, by processing circuitry, an alert identifying a suspicious or malicious website;
wherein detecting the change, comprises:
based on the profile, determining a-priori probability estimation;
based on the collected information, determining an update probability;
identifying the change between the a-priori probability estimation and the update probability;
further wherein determining the a-priori probability estimation comprises determining an a-priori probability distribution P 0 using a first number w of a sequence of observations X 1 , . . . , X n from a probability distribution where X i ∈U and u=|U|;
further wherein determining the update probability comprises updating the probability distribution to P 1 (n) for every observation X n where n>w such that the probability P 1 (n) can be compared with the a-priori probability P 0 in order to detect the change.

2. The method as claimed in claim 1 , wherein generating the profile comprises:
reconstructing a historic visit to the website; and
based on the reconstructed visit, generating the profile comprising at least one website attribute relating to the historic visit to the website.

3. The method as claimed in claim 2 , wherein reconstructing the visit comprises:
retrieving log information in connection with the historic visit to the website;
based on the retrieved log information, reconstructing the historic visit.

4. The method as claimed in claim 1 , wherein generating the profile comprises:
visiting at least once the website; and
based on information collected during the at least one visit, generating profile comprising at least one website attribute relating to the at least one visit to the website.

5. The method as claimed in claim 1 , wherein the at least one attribute in the profile relates to at least one of a URL, a domain, an IP address, a content type and a file size.

6. The method as claimed in claim 1 , wherein the profile comprises a count associated with the at least one attribute; and
detecting the change comprises:
determining a count associated with the at least one attribute in the profile;
based on the collected information, determining count of the at least one attribute;
identifying a change between the counts associated with the profile and the collected information.

7. The method as claimed in claim 1 , further comprising:
updating the at least one attribute of the profile, wherein the updated at least attribute comprises a value corresponding to a weighted combination of a current value in the profile and a value observed in the collected information.

8. An apparatus, comprising:
at least one processing device, said at least one processing device comprising a processor coupled to a memory;
wherein the apparatus is configured to:
generate a profile in connection with a website, wherein the profile comprises at least one attribute associated with the website;
during a visit to the website, collect information relating to the website;
detect a change in connection with the website, wherein detecting the change comprises identifying a variation between the generated profile and the collected information;
assign a score based on the change;
compare the score to a threshold; and
in response to a relationship between the score and the threshold, send an alert identifying a suspicious or malicious website;
wherein detecting the change, comprises:
based on the profile, determining a-priori probability estimation;
based on the collected information, determining an update probability;
identifying the change between the a-priori probability estimation and the update probability;
further wherein determining the a-priori probability estimation comprises determining an a-priori probability distribution P 0 using a first number w of a sequence of observations X 1 , . . . , X n from a probability distribution where X i ∈U and u=|U|;
further wherein determining the update probability comprises updating the probability distribution to P 1 (n) for every observation X n where n>w such that the probability P 1 (n) can be compared with the a-priori probability P 0 in order to detect the change.

9. The apparatus as claimed in claim 8 , wherein generating the profile comprises:
reconstructing a historic visit to the website; and
based on the reconstructed visit, generating the profile comprising at least one website attribute relating to the historic visit to the website.

10. The apparatus as claimed in claim 9 , wherein reconstructing the visit comprises:
retrieving log information in connection with the historic visit to the website;
based on the retrieved log information, reconstructing the historic visit.

11. The apparatus as claimed in claim 8 , wherein generating the profile comprises:
visiting at least once the website; and
based on information collected during the at least one visit, generating profile comprising at least one website attribute relating to the at least one visit to the website.

12. The apparatus as claimed in claim 8 , wherein the at least one attribute in the profile relates to at least one of a URL, a domain, an IP address, a content type and a file size.

13. The apparatus as claimed in claim 8 , wherein the profile comprises a count associated with the at least one attribute; and
detecting the change comprises:
determining a count associated with the at least one attribute in the profile;
based on the collected information, determining count of the at least one attribute;
identifying a change between the counts associated with the profile and the collected information.

14. The apparatus as claimed in claim 8 , wherein the apparatus is also configured to:
update the at least one attribute of the profile, wherein the updated at least attribute comprises a value corresponding to a weighted combination of a current value in the profile and a value observed in the collected information.

15. A computer program product having a non-transitory computer-readable medium storing instructions, the instructions, when carried out by one or more processors, causing the one or more processors to perform a method of:
generating a profile in connection with a website, wherein the profile comprises at least one attribute associated with the website;
during a visit to the website, collecting information relating to the website;
detecting a change in connection with the website, wherein detecting the change comprises identifying a variation between the generated profile and the collected information;
assigning a score based on the change;
comparing the score to a threshold; and
in response to a relationship between the score and the threshold, sending an alert identifying a suspicious or malicious website;
wherein detecting the change, comprises:
based on the profile, determining a-priori probability estimation;
based on the collected information, d

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Oprea Alina
• Alrwais Sumayah
• Bowers Kevin D
• Leetham Todd S
• Li Zhou
• Rivest Ronald L

Classifications

• H04L63/168

  above the transport layer · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/30

  Profiles · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title