Back to results
US 10,313,348 B2Granted
Document classification by a hybrid classifier
AssigneeFortinet, Inc.
InventorsYe Ma, Xiping Cao
Life of this patent
Estimating the term…
Abstract
Systems and methods for classifying URLs by a hybrid classifier are provided. According to one embodiment, a hybrid classifier receives a candidate URL. A naïve Bayes classifier of the hybrid classifier classifies the candidate URL to generate a first classification of the candidate URL and a sublink classifier of the hybrid classifier classifies the candidate URL to generate a second classification of the candidate URL. The hybrid classifier determines a classification of the candidate URL based on the combination of the first and second classification.
Claims16
A method comprising:
- receiving from a network security device protecting a private network, by a hybrid classification engine, a candidate uniform resource locator (URL) intercepted by the network security device as part of an attempt to access a network resource by a user of the private network and that is to be classified by the hybrid classification engine, wherein the hybrid classification engine comprises a naïve Bayes classifier and a sublink classifier;
- facilitating, by the hybrid classification engine, handling of the attempt to access the network resource by the network security device by performing a real-time classification of the candidate URL as being associated with one or more of a plurality of classes of content based on a combination of text content of the network resource and a plurality of sublinks contained within the network resource, including:
- generating a first classification for the candidate URL by classifying, by the naïve Bayes classifier, the candidate URL based on the text content and previous training of the naïve Bayes classifier on text content having a known association with the one or more of the plurality of classes of content;
- generating a second classification for the candidate URL by classifying, by the sublink classifier, the candidate URL, wherein the second classification is determined based on at least one sublink of the plurality of sublinks, by:
- retrieving the network resource referenced by the candidate URL;
- identifying the at least one sublink within the network resource;
- determining a classification of the at least one sublink by searching a URL classification database;
- and
- determining the second classification of the candidate URL based on the classification of the at least one sublink;
- and
- determining, by the hybrid classification engine, a final classification of the candidate URL by combining the first classification and the second classification, including:
- when the first classification is not within a plurality of restricted classes, determining whether a confidence score for the second classification is greater than a predetermined threshold indicative of a sufficient number of the plurality of sublinks being associated with a restricted class of the plurality of restricted classes;
- and
- responsive to determining the confidence score is greater than the predetermined threshold, setting the final classification to the restricted class, whereby the hybrid classification engine is able to classify the candidate URL as being associated with the restricted class despite an inability on a part of the naïve Bayes classifier to classify the candidate URL as being associated with the restricted class;
- and
- causing, by the hybrid classification engine, the network security device to block or allow the attempt to access the network resource based on the final classification.
13 more elements
A computer system comprising:
- non-transitory storage device having embodied therein instructions representing a hybrid classifier;
- and
- one or more processors coupled to the non-transitory storage device and operable to execute the hybrid classifier to perform a method comprising:
- receiving, from a network security device protecting a private network, a candidate uniform resource locator (URL) intercepted by the network security device as part of an attempt to access a network resource by a user of the private network and that is to be classified by the hybrid classifier, wherein the hybrid classifier implements a naïve Bayes classifier and a sublink classifier;
- facilitating handling of the access request by the network security device by performing a real-time classification of the candidate URL as being associated with one or more of a plurality of classes of content based on a combination of text content of the network resource and a plurality of sublinks contained within the network resource, including:
- generating a first classification for the candidate URL by classifying, by the naïve Bayes classifier, the candidate URL based on the text content and previous training of the naïve Bayes classifier on text content having a known association with the one or more of the plurality of classes of content;
- generating a second classification for the candidate URL by classifying, by the sublink classifier, the candidate URL, wherein the second classification is determined based on at least one sublink of the plurality of sublinks by:
- retrieving the network resource referenced by the candidate URL;
- identifying the at least one sublink within the network resource;
- determining a classification of the at least one sublink by searching a URL classification database;
- and
- determining the second classification of the candidate URL based on the classification of the at least one sublink;
- and
- determining a final classification of the candidate URL by combining the first classification and the second classification, including:
- when the first classification is not within a plurality of restricted classes, determining whether a confidence score for the second classification is greater than a predetermined threshold indicative of a sufficient number of the plurality of sublinks being associated with a restricted class of the plurality of restricted classes;
- and
- responsive to determining the confidence score is greater than the predetermined threshold, setting the final classification to the restricted class, whereby the hybrid classifier is able to classify the candidate URL as being associated with the restricted class despite an inability on a part of the naïve Bayes classifier to classify the candidate URL as being associated with the restricted class;
- and
- causing the network security device to block or allow the access request based on the final classification.
16 more elements
Dependencies are inferred from the claim text.