Prioritizing Malicious Website Detection

• US 20120060221A1
• Filed: 09/08/2010
• Published: 03/08/2012
• Est. Priority Date: 09/08/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Gerber, Alexandre, Spatscheck, Oliver, Dunn, Christopher, Gupta, Minaxi
• Granted Patent: US 8,484,740 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A computer implemented method includes identifying a universal resource locator and characterizing a traffic pattern associated with the universal resource locator. The traffic pattern can include referrer information, referring information, advertising network relationship information, and any combination thereof. The method can further include classifying the universal resource locator into a risk category based on the traffic pattern.

Claims

1. A computer implemented method comprising:

identifying a universal resource locator;

characterizing a traffic pattern associated with the universal resource locator, wherein the traffic pattern can include information selected from the group consisting of referrer information, referring information, advertising network relationship information, and any combination thereof; and

classifying the universal resource locator into a risk category based on characterizing the traffic pattern.

2. The computer implemented method of claim 1, wherein the traffic pattern further includes information selected from the group consisting of popularity information, connectivity information, white list information, and any combination thereof.

3. The computer implemented method of claim 1, wherein the popularity is based on the activity of a plurality of user systems.

4. The computer implemented method of claim 1, wherein classifying is based on multiple aspects of the traffic pattern.

5. The computer implemented method of claim 1, further comprising analyzing the content associated with the universal resource locator to determine if the content is malicious.

6. The computer implemented method of claim 5, further comprising performing an action when the content is malicious, the action selected from the group consisting of blocking the universal resource locator, providing a warning, and any combination thereof.

7. The computer implemented method of claim 5, further comprises performing an action when the content is malicious, the action selected from the group consisting of providing the universal resource locator to a network device configured to block access to the universal resource locator, providing a warning, and any combination thereof.

8. A system comprising:

a processor configured to;

obtain click stream information for a plurality of user systems;

identify a universal resource locator accessed by at least one of the user systems;

characterize a traffic pattern associated with the universal resource locator based on the click stream information, the traffic pattern including information selected from the group consisting of referrer information, referring information, advertising network relationship information, and any combination thereof; and

classify the universal resource locator into a risk category based on the traffic pattern.

9. The system of claim 8, wherein the traffic pattern further includes information selected from the group consisting of host popularity, host connectivity, white list information, and any combination thereof.

10. The system of claim 8, wherein the popularity is based on the click stream information.

11. The system of claim 8, wherein the processor is configured to classify the universal resource locator based on multiple aspects of the traffic pattern.

12. The system of claim 8, further comprising analyzing the content associated with the universal resource locator to determine if the content is malicious.

13. The system of claim 12, wherein the processor is further configured to respond when the content is malicious by performing an action selected from the group consisting of blocking the universal resource locator, providing a warning, and any combination thereof.

14. The system of claim 12, wherein the processor is further configured to respond when the content is malicious by performing an action selected from the group consisting of providing the universal resource locator to a network device configured to block access to the universal resource locator, provide a warning, and any combination thereof.

15. A non-volatile computer readable medium comprising a plurality of instructions to manipulate a processor, the plurality of instructions comprising:

instructions to obtain click stream information for a plurality of user systems;

instructions to identify a universal resource locator accessed by at least one of the plurality of user systems;

instructions to characterize a traffic pattern associated with the universal resource locator based on the click stream information, the traffic pattern including information selected from the group consisting of referrer information, referring information, ad network relationship information, and any combination thereof; and

instructions to classify the universal resource locator into a risk category based on the traffic pattern.

16. The non-volatile computer readable medium of claim 15, wherein the traffic pattern further includes information selected from the group consisting of host popularity, host connectivity, white list information, and any combination thereof.

17. The non-volatile computer readable medium of claim 15, wherein the popularity is based on the click stream information.

18. The non-volatile computer readable medium of claim 15, wherein the instructions to classify include instructions to classify the universal resource locator based on multiple aspects of the traffic pattern.

19. The non-volatile computer readable medium of claim 15, wherein the plurality of instructions further comprises instructions to analyze the content associated with the universal resource locator to determine if the content is malicious.

20. The non-volatile computer readable medium of claim 19, wherein the plurality of instructions further comprises instructions performed when the content is malicious, the instructions selected from the group consisting of instructions to provide the universal resource locator to a network device configured to block access to the universal resource locator, instructions to provide a warning, and any combination thereof.