System and method of analyzing web content

• US 9,723,018 B2
• Filed: 03/09/2015
• Issued: 08/01/2017
• Est. Priority Date: 07/10/2006
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Websense, Llc (Francisco Partners Management LLC)
• Inventors: Hubbard, Dan, Verenini, Nicholas Joseph, Baddour, Victor Louie
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): Jackson, Jenise
• Application Number:
  US14/642,561
• Publication Number:
  US 20150180899A1
• Time in Patent Office: 876 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Computer-implemented methods and systems for categorizing a uniform resource locator (URL) based on web content associated with the URL are disclosed. In one aspect, a method includes identifying a first URL using a first URL collection method, assigning, using an electronic processor, a first categorization priority to the first URL based on the first URL being identified using the first URL collection method, categorizing, the first URL based on the first categorization priority, identifying a second URL using a second URL collection method, assigning, using an electronic processor, a second categorization priority different than the first categorization priority based on the second URL having been identified using the second URL collection method; and categorizing, using an electronic processor, the second URL based on the second categorization priority.

Claims

1. A computer-implemented method of categorizing a uniform resource locator (URL) based on web content associated with the URL using at least one electronic hardware processor configured to implement a database management module, the method comprising:

associating a first categorization priority with a first URL collection method of a plurality of URL collection methods, and associating a second categorization priority with a second URL collection method of the plurality of URL collection methods, the second URL connection method being a different type of collection method than the first URL collection method, wherein each of the plurality of collection methods is performed using at least one electronic hardware processor, and each collection method comprises one of a web crawler, a Domain Name Server (DNS) database, and a honey client;

assigning a particular categorization priority to each of a plurality of URLs, the categorization priority assigned to each particular URL based on whether the first or the second URL collection method identifies the particular URL of the plurality of URLs, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL;

categorizing the plurality of URL'"'"'s in an order that is based on a difference between the first and second categorization priorities as assigned to each of the plurality of URLs;

storing the categorization of the plurality of URL'"'"'s in a categorization database, a second database derived from the categorization database configured for queries to categorize at least the plurality of URLs when requested by workstations, the workstations being separate from the one or more hardware processors configured to implement the database management module.

2. The computer-implemented method of claim 1, further comprising determining a frequency of requests for the web content associated with each of the plurality of URLs, and prioritizing categorization of each of the plurality of URLs based at least in part on the frequency of requests for the web content associated with each of the plurality of URLs.

3. The computer-implemented method of claim 2, wherein a time at which the category of a first URL of the plurality of URLs is determined is based on the frequency of requests for web content associated with the first URL.

4. The computer-implemented method of claim 1, further comprising:

associating a third URL collection method with a third categorization priority, wherein assigning a particular categorization priority to each of the plurality of URL'"'"'s;

wherein the assigning of the particular categorization priority to each particular URL of the plurality of URLs is based on whether the first or the second or the third URL collection method identifies the particular URL, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL, and the third categorization priority is assigned to the particular URL in response to the third URL collection method identifying the particular URL.

5. The method of claim 1, wherein the first URL collection method comprises a honey client and the second URL collection method comprises a web crawler.

6. The computer-implemented method of claim 1, further comprising providing the plurality of URLs to a data mining module, the data mining module in communication with a plurality of collection sources, the plurality of collection sources implementing the plurality of URL collection methods, and comprising asynchronous processes.

7. The computer-implemented method of claim 6, further comprising configuring the data mining module, wherein configuring the data mining module includes defining a characteristic indicative of a targeted attribute, and configuring the data mining module to identify requests having the attribute.

8. The computer-implemented method of claim 7, wherein the targeted attribute comprises at least one of a keyword, a regular expression, or an operand.

9. The computer-implemented method of claim 7, wherein the attribute is a type of hypertext transfer protocol (HTTP) request header data.

10. The computer-implemented method of claim 9, wherein the HTTP request header data includes a content-type.

11. A computer system for categorizing a uniform resource locator (URL), the system comprising one or more hardware processors configured to implement a database management module to:

associate a first categorization priority with a first URL collection method of a plurality of URL collection methods, and associate a second categorization priority with a second URL collection method of the plurality of URL collection methods, the second URL connection method being a different type of collection method than the first URL collection method, wherein each of the plurality of collection methods are performed using at least one electronic hardware processor, and each collection method comprises one of a web crawler, a Domain Name Server (DNS) database, and a honey client;

assign a particular categorization priority to each of a plurality of URLs, the categorization priority assigned to each particular URL based on whether the first or the second URL collection method identifies the particular URL of the plurality of URLs, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL;

categorize the plurality of URL'"'"'s in an order that is based on a difference between the first and second categorization priorities as assigned to each of the plurality of URLs;

store the categorization of the plurality of URL'"'"'s in a categorization database, a second database derived from the categorization database configured for queries to categorize URLs requested by workstations, the workstations separate from the one or more hardware processors configured to implement the database management module.

12. The system of claim 11, wherein the one or more electronic hardware processors are further configured to determine a frequency of requests for the web content identified by each of the plurality of URLs, and to prioritize categorization of each of the plurality of URLs based at least in part on the frequency of requests.

13. The system of claim 11, wherein the one or more electronic hardware processors are further configured to associate a third URL collection method with a third categorization priority, and wherein the assigning of the particular categorization priority to each of the particular URLs is based on whether the first or the second or the third URL collection method identifies the particular URL, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL and the third categorization priority is assigned to the particular URL in response to the third URL collection method identifying the particular URL.

14. The system of claim 11, wherein the one or more hardware processors are further configured to categorize the first URL based on whether web content identified by the first URL includes active content.

15. A computer-implemented system using at least one electronic hardware processor configured to implement a database management module for identifying uniform resource locators (URLs) associated with malicious content, the system comprising:

an electronic hardware processor; and

an electronic hardware memory for storing computer executable instructions that, when executed by the electronic hardware processor, cause the electronic hardware processor to

associate a first categorization priority with a first URL collection method of a plurality of URL collection methods, and associate a second categorization priority with a second URL collection method of the plurality of URL collection methods, the second URL connection method being different than the first URL collection method, wherein each of the plurality of collection methods is performed using at least one electronic hardware processor, and each collection method comprises one of a web crawler, a Domain Name Server (DNS) database, and a honey client;

assign a particular categorization priority to each of a plurality of URLs, the categorization priority assigned to each particular URL based on whether the first or the second URL collection method identifies the particular URL, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL;

categorize the plurality of URL'"'"'s in an order that is based on a difference between the first and second categorization priorities;

store the categorization of the plurality of URL'"'"'s in a categorization database, the categorization database configured for queries to categorize URLs requested by workstations, the workstations being separate from the one or more hardware processors configured to implement the database management module.

16. The computer-implemented system of claim 15, the method further comprising prioritizing categorization of the plurality of URLs based at least in part on a frequency of requests for web content identified by each of the respective URLs.

17. A non-transitory computer readable storage medium comprising instructions that when executed cause one or more hardware processors configured to implement a database management module to perform a method of categorizing a uniform resource locator (URL) based on web content associated with the URL, the method comprising:

associating a first categorization priority with a first URL collection method of a plurality of URL collection methods, and associating a second categorization priority with second URL collection method of the plurality of URL collection methods, the second URL connection method being different than the first URL collection method, wherein each of the plurality of collection methods is performed using at least one electronic hardware processor, and each collection method comprises one of a web crawler, a Domain Name Server (DNS) database, and a honey client;

assigning a particular categorization priority to each of a plurality of URLs, the categorization priority assigned to each particular URL based on whether the first or the second URL collection method identifies the particular URL of the plurality of URLs, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL;

categorizing the plurality of URL'"'"'s in an order that is based on a difference between the first and second categorization priorities;

storing the categorization of the plurality of URL'"'"'s in a categorization database, the categorization database configured for queries to categorize URLs requested by workstations, the workstations separate from the one or more hardware processors configured to implement the database management module.

18. The non-transitory computer readable storage medium of claim 17, the method further comprising prioritizing categorization of each of the plurality of URLs based at least in part on a frequency of requests for web content identified by first each of the respective URLs.

19. The non-transitory computer readable storage medium of claim 17, wherein the first URL collection method comprises a honey client and the second URL collection method comprises a web crawler.

20. The non-transitory computer readable storage medium of claim 17, the method further comprising:

associating a third URL collection method with a third categorization priority;

assigning a particular categorization priority to each of the plurality of URLs, the categorization priority assigned to each particular URL based on whether the first or the second or the third URL collection method identifies the particular URL of the plurality of URLs, wherein the first categorization priority is assigned to the particular URL in response to the first URL collection method identifying the particular URL and the second categorization priority is assigned to the particular URL in response to the second URL collection method identifying the particular URL, and the third categorization priority is assigned to the particular URL in response to the third URL collection method identifying the particular URL.