# US 10,313,392 B2 · Method and device for detecting web address hijacking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,392 B2 - Document ID: US10313392B2 - Status: Granted - Kind: B2 - Application number: 15/185,223 - Filed: 2016-06-17 - Published: 2016-12-22 - Granted: 2019-06-04 - Earliest claimed: 2015-06-19 - Assignees: Xiaomi Inc. - Applicants: Xiaomi Inc. - Inventors: Yifei Yu; Zhongyi Du; Jinglong Zuo - Web page: https://patentgrep.com/patent/US10313392B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 16/24578: {using ranking} - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/128: {involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present disclosure relates to a method and a device for detecting web address hijacking. The method includes: obtaining a currently accessed web address and a target directed web address from a current web address access instruction; determining a secure directed web address from the currently accessed web address according to a history of web address access instructions; and determining whether the target directed web address is hijacked according to the secure directed web address. ## Claims ### Claim 1 A method for detecting web address hijacking, comprising: obtaining a currently accessed web address and a target directed web address from a current web address access instruction; determining a secure directed web address from the currently accessed web address according to a history of web address access instructions; and determining whether the target directed web address is hijacked according to the secure directed web address, wherein determining the secure directed web address from the currently accessed web address according to the history of web address access instructions comprises: obtaining at least one historical web address access instruction corresponding to the currently accessed web address from the history of web address access instructions, wherein the historical web address access instruction comprises an access web address, whether including a direct, a directed web address, and an access time; and determining the secure directed web address from the currently accessed web address according to the at least one historical web address access instruction, wherein determining the secure directed web address from the currently accessed web address according to at least one historical web address access instruction comprises: performing a statistical analysis on the at least one historical web address access instruction, and computing an occurrence probability of each directed web address in the at least one historical web address access instruction independently; and determining the secure directed web address from the currently accessed web address according to the occurrence probability of each directed web address and/or the access time of each directed web address, and wherein determining the secure directed web address from the currently accessed web address according to the occurrence probability of each directed web address and/or the access time comprises: determining a directed web address as the secure directed web address, if an access interval from a last access time of the directed web address to a current access time is less than a preset time interval, and a number of continuous occurrences of the directed web address is greater than or equal to a preset number. ### Claim 2 (depends on 1) The method according to claim 1, wherein determining the secure directed web address from the currently accessed web address according to the occurrence probability of each directed web address and/or the access time comprises: determining whether a directed web address having the occurrence probability greater than a preset probability threshold exists in the at least one historical web address access instruction; if a directed web address having the occurrence probability greater than the preset probability threshold exists in the at least one historical web address access instruction, determining the directed web address having the occurrence probability greater than the preset probability threshold as the secure directed web address; and if no directed web address having the occurrence probability greater than the preset probability threshold exists in the at least one historical web address access instruction, determining each directed web address in the at least one historical web address access instruction as the secure directed web address. ### Claim 3 (depends on 1) The method according to claim 1, wherein determining the secure directed web address from the currently accessed web address according to the occurrence probability of each directed web address and/or the access time comprises: determining a directed web address as the secure directed web address, if an occurrence probability P of the directed web address, an access interval T from a last access time of the directed web address to a current access time, a weight M for the occurrence probability P of the directed web address, a weight N for a ratio of the access interval T to a maximum access interval Tmax, and a secure direct threshold Q satisfy a formula of P * M + ( 1 - T T max ) * N ≥ Q . ### Claim 4 (depends on 1) The method according to claim 1, wherein determining whether the target directed web address is hijacked according to the secure directed web address comprises: determining that the target directed web address is not hijacked, if the target directed web address matches the secure directed web address; and determining that the target directed web address is hijacked, if the target directed web address does not match the secure directed web address. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: executing an operation for blocking directing to the target directed web address, if it is determined that the target directed web address is hijacked. ### Claim 6 (depends on 1) The method according to claim 1, further comprising: recording web address access instructions according to access times of access web addresses in the web address access instructions; ranking the recorded web address access instructions in an ascending order of access time; and determining the history of web address access instructions by choosing a preset number of web address access instructions from the ranked web address access instructions, in which each chosen web address access instruction has the access time before the current access time, or in which an access interval from the access time of the access web address in each chosen web address access instruction to the current access time is less than or equal to a preset time period. ### Claim 7 A device for detecting web address hijacking, comprising: a processor; and a memory configured to store instructions executable by the processor, wherein the processor is configured to: obtain a currently accessed web address and a target directed web address from a current web address access instruction; determine a secure directed web address from the currently accessed web address according to a history of web address access instructions; and determine whether the target directed web address is hijacked according to the secure directed web address, wherein the processor is further configured to: obtain at least one historical web address access instruction corresponding to the currently accessed web address from the history of web address access instructions, wherein the historical web address access instruction comprises an access web address, whether including a direct, a directed web address, and an access time; and determine the secure directed web address from the currently accessed web address according to the at least one historical web address access instruction, and wherein the processor is further configured to: perform a statistical analysis on the at least one historical web address access instruction, and compute an occurrence probability of each directed web address in the at least one historical web address access instruction independently; and determine the secure directed web address from the currently accessed web address according to the occurrence probability of each directed web address and/or the access time of each directed web address, and wherein the processor is further configured to: determine a directed web address as the secure directed web address, if an access interval from a last access time of the directed web address to a current access time is less than a preset time interval, and a number of continuous occurrences of the directed web address is greater than or equal to a preset number. ### Claim 8 (depends on 7) The device according to claim 7, wherein the processor is further configured to: determine whether a directed web address having the occurrence probability greater than a preset probability threshold exists in the at least one historical web address access instruction; if a directed web address having the occurrence probability greater than the preset probability threshold exists in the at least one historical web address access instruction, determine the directed web address having the occurrence probability greater than the preset probability threshold as the secure directed web address; and if no directed web address having the occurrence probability greater than the preset probability threshold exists in the at least one historical web address access instruction, determine each directed web address in the at least one historical web address access instruction as the secure directed web address. ### Claim 9 (depends on 7) The device according to claim 7, wherein the processor is further configured to: determine a directed web address as the secure directed web address, if a occurrence probability P of the directed web address, an access interval T from a last access time of the directed web address to a current access time, a weight M for the occurrence probability P of the directed web address, a weight N for a ratio of the access interval T to a maximum access interval Tmax, and a secure direct threshold Q satisfy a formula of P * M + ( 1 - T T max ) * N ≥ Q . ### Claim 10 (depends on 7) The device according to claim 7, wherein the processor is further configured to: determine that the target directed web address is not hijacked, if the target directed web address matches the secure directed web address; and determine that the target directed web address is hijacked, if the target directed web address does not match the secure directed web address. ### Claim 11 (depends on 7) The device according to claim 7, wherein the processor is further configured to: execute an operation for blocking directing to the target directed web address, if it is determined that the target directed web address is hijacked. ### Claim 12 (depends on 7) The device according to claim 7, wherein the processor is further configured to: record web address access instructions according to access times of access web addresses in the web address access instructions; rank the recorded web address access instructions in an ascending order of access time; and determine the history of web address access instruction by choosing a preset number of web address access instructions from the ranked web address access instructions, in which each chosen web address access instruction has the access time before the current access time, or in which an access interval from the access time of each chosen web address access instruction to the current access time is less than or equal to a preset time period.