Reputation Based Redirection Service

• US 20110145435A1
• Filed: 12/14/2009
• Published: 06/16/2011
• Est. Priority Date: 12/14/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Haber, Elliott J., Mills, Chad W., Bhatawdekar, Ameya S., Iverson, Kristofer N., Scarrow, John L.
• Granted Patent: US 8,862,699 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A reputation based redirection service is usable to build URL wrappers for un-trusted and unknown URLs. Such URL wrappers can be used to protect Web users by, for example, redirecting traffic to interstitial Web pages. Additionally, reputation decisions can be made by the service to further protect users from malicious URLs.

Claims

1. One or more computer-readable storage media, storing processor-executable instructions that, when executed on a processor, configure a processor to perform acts for Uniform Resource Locator (URL) wrapping, the acts comprising:

receiving an input of a URL for accessing a document available over a network;

determining a characteristic associated with the received URL;

creating a security hash; and

outputting a wrapped URL comprising the characteristic associated with the received URL, and the security hash.

2. The one or more computer-readable media of claim 1, wherein the wrapped URL further comprises the received URL.

3. The one or more computer-readable media of claim 1, wherein the characteristic associated with the received URL comprises an identifier of a user who originally posted the received URL, a location on the network where the received URL was posted, a container identifier of a container where the received URL was posted, and/or context information comprising a session identifier.

4. The one or more computer-readable media of claim 1, wherein the characteristic associated with the received URL comprises a unique identifier for back-end reputation look-up and/or back-end additional characteristic look-up.

5. The one or more computer-readable media of claim 1, further comprising instructions to perform acts comprising:

determining that the received URL is an un-trusted URL; and

outputting the wrapped URL based on the determination that the received URL is an un-trusted URL.

6. The one or more computer-readable media of claim 1, further comprising instructions to perform acts comprising outputting an error message when the received URL is a malformed URL, a non-URL, a null URL, a URL of an un-supported Uniform Resource Identifier (URI) schema, and/or a URL with a length longer than a predetermined length.

7. The one or more computer-readable media of claim 1, wherein the wrapped URL further comprises a redirection service and/or shortened URL.

8. The one or more computer-readable media of claim 1, wherein the security hash is created based on the received URL and the characteristic associated with the received URL.

9. A system for implementing a URL redirection service comprising:

memory and a processor;

a redirection server interface module, stored in the memory and executable on the processor, the redirection server interface module configured to receive a request for handling a wrapped URL comprising a destination URL;

a URL validation/verification module, stored in the memory and executable on the processor, the URL validation/verification module configured to verify validity of the received wrapped URL;

a reputation lookup module, stored in the memory and executable on the processor, the reputation lookup module configured to determine a reputation rating for the destination URL; and

a redirection logic module, stored in the memory and executable on the processor, the redirection logic module configured to output a confidence score and/or a redirection decision based on the validity of the received wrapped URL, the reputation rating of the destination URL, and/or a characteristic of the destination URL.

10. The system of claim 9, the wrapped URL further comprising a characteristic associated with the destination URL and a security hash.

11. The system of claim 9, the characteristic associated with the destination URL comprises an identifier of a user who originally posted the destination URL and a location where the destination URL was posted, the user comprising a human or a machine.

12. The system of claim 9, further comprising a shortened/redirected URL handling module, stored in the memory and executable on the processor, the shortened/redirected URL handling module configured to:

receive a shortened URL or a redirected URL;

determine a final destination URL of the shortened or redirected URL; and

output the final destination URL to the reputation lookup module.

13. The system of claim 9, further comprising a telemetry service module, stored in the memory and executable on the processor, the telemetry service module configured to:

receive click-through telemetry information from an interstitial page; and

create a telemetry report based on the click-through telemetry information.

14. The system of claim 13, further comprising a logging module, stored in the memory and executable on the processor, the logging module configured to:

store redirection action data to a log file, the redirection action data based on the characteristic associated with the destination URL and the redirection decision; and

store the telemetry report to the log file.

15. The system of claim 9, further comprising a configuration module, stored in the memory and executable on the processor, the configuration module configured to maintain system configuration settings in a system configuration store.

16. The system of claim 9, the redirection decision comprising determining, based on the reputation rating of the destination URL, when to display an interstitial page, the interstitial page comprising an abuse information page, an unknown information page, or an error information page.

17. The system of claim 9, the redirection decision comprising determining, based on rules applied to the destination URL or a characteristic of the destination URL, when to display an interstitial page, the interstitial page comprising an abuse information page, an unknown information page, or an error information page.

18. One or more computer-readable storage media, storing processor-executable instructions that, when executed on a processor, configure the processor to perform acts for URL Web service calls, the acts comprising:

receiving a Web service call for a destination URL;

determining a redirection decision for the destination URL; and

outputting the redirection decision.

19. The one or more computer-readable media of claim 18, the redirection decision determined based on a reputation rating of the destination URL.

20. The one or more computer-readable media of claim 18, further comprising instructions to perform acts comprising wrapping the destination URL with a characteristic of the destination URL and a security hash, the characteristic comprising the destination URL, an identifier of a user who originally posted the destination URL, and/or a location of where the destination URL was posted.