Systems and methods for providing a secure uniform resource locator (URL) shortening service

• US 9,058,490 B1
• Filed: 02/11/2011
• Issued: 06/16/2015
• Est. Priority Date: 02/11/2011
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Barker, Clifton, Cidambi, Chandrasekhar, Tran, Tuan-Khanh, Zaveri, Ameet
• Primary Examiner(s): Bates, Kevin
• Assistant Examiner(s): McCray, Clarence D
• Application Number:
  US13/025,728
• Time in Patent Office: 1,586 Days
• Field of Search: 715/205, 715/738, 709/200, 709/220, 709/246, 709/245, 709/205, 709/738
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2139 Recurrent verification
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A computer-implemented method to provide a secure uniform resource locator (URL) shortening service is described. A URL is received via a browser provided on a display of a computing device. A shortened URL is generated to represent the received URL. A determination is made as to whether a classification assigned to a web site associated with the shortened URL is valid. Upon determining that the assigned classification is not valid, the web site is evaluated in order to assign an updated valid classification to the web site.

Claims

1. A computer-implemented method to provide a secure uniform resource locator (URL) shortening service, comprising:

receiving a URL via a browser provided on a display of a computing device;

identifying a malicious element in a web site associated with the received URL;

generating, by a processor, a shortened URL to represent the received URL;

assigning a malware classification to the web site based on the identified malicious element, the malware classification being associated with the shortened URL;

configuring a refresh rate for the malware classification of the web site, wherein the refresh rate comprises an expiration of the malware classification of the web site;

determining whether the refresh rate associated with the malware classification of the web site has expired;

upon determining the refresh rate associated with the malware classification of the web site has expired, determining whether the malicious element is removed from the web site since the malware classification was assigned; and

upon determining the malicious element is removed from the web site, assigning a new malware classification to the web site, wherein the web site is classified as non-malicious based on determining the malicious element is removed from the web site.

2. The method of claim 1, further comprising determining whether the web site associated with the shortened URL has been previously classified.

3. The method of claim 1, further comprising accessing the classified web site upon determining that the refresh rate has expired.

4. The method of claim 1, further comprising reclassifying the web site associated with the shortened URL upon detecting changes to the web site.

5. The method of claim 1, further comprising preventing access to the web site associated with the shortened URL upon determining that the web site has been assigned a malicious classification.

6. The method of claim 1, further comprising receiving a request to generate the shortened URL to represent the received URL.

7. The method of claim 6, further comprising providing a notification that the web site associated with the received URL is malicious.

8. A computing device configured to provide a secure uniform resource locator (URL) shortening service, comprising:

a processor;

memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable by the processor to;

receive a URL via a browser provided on a display of a computing device;

identify a malicious element in a web site associated with the received URL;

generate a shortened URL to represent the received URL;

assign a malware classification to the web site based on the identified malicious element, the malware classification being associated with the shortened URL;

configure a refresh rate for the malware classification of the web site, wherein the refresh rate comprises an expiration of the malware classification of the web site;

determine whether the refresh rate associated with the malware classification of the web site has expired; and

upon determining the refresh rate associated with the malware classification of the web site has expired, determine whether the malicious element is removed from the web site since the malware classification was assigned; and

upon determining the malicious element is removed from the web site, assigning a new malware classification to the web site, wherein the web site is classified as non-malicious based on determining the malicious element is removed from the web site.

9. The computing device of claim 8, wherein the instructions are executable by the processor to:

determine whether the web site associated with the shortened URL has been previously classified.

10. The computing device of claim 8, wherein the instructions are executable by the processor to:

access the classified web site upon determining that the refresh rate has expired.

11. The computing device of claim 10, wherein the instructions are executable by the processor to:

reclassify the web site associated with the shortened URL upon detecting changes to the web site.

12. The computing device of claim 8, wherein the instructions are executable by the processor to:

prevent access to the web site associated with the shortened URL upon determining that the web site has been assigned a malicious classification.

13. The computing device of claim 8, wherein the instructions are executable by the processor to:

receive a request to generate the shortened URL to represent the received URL.

14. The computing device of claim 13, wherein the instructions are executable by the processor to:

provide a notification that the web site associated with the received URL is malicious.

15. A computer-program product for providing a secure uniform resource locator (URL) shortening service, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions comprising:

receive a URL via a browser provided on a display of a computing device;

identify a malicious element in a web site associated with the received URL;

generate a shortened URL to represent the received URL;

assign a malware classification to the web site based on the identified malicious element, the malware classification being associated with the shortened URL;

configure a refresh rate for the malware classification of the web site, wherein the refresh rate comprises an expiration of the malware classification of the web site;

determine whether the refresh rate associated with the malware classification of the web site has expired;

upon determining the refresh rate associated with the malware classification of the web site has expired, determine whether the malicious element is removed from the web site since the malware classification was assigned; and

upon determining the malicious element is removed from the web site, assigning a new malware classification to the web site, wherein the web site is classified as non-malicious based on determining the malicious element is removed from the web site.

16. The computer-program product of claim 15, wherein the instructions are executable by the processor to:

determine whether the web site associated with the shortened URL has been previously classified.