Uniform resource locator security analysis using malice patterns

A uniform resource locator (URL) security static analysis method, comprising:

• obtaining a URL substring;
• automatically comparing the URL substring to at least one malice pattern, the malice pattern and the comparing each directly based on both of string structure and content as opposed to being based on a result of following a link derived using the URL substring to detect what happens or being based on a preexisting domain reputation;
• automatically assigning a maliciousness risk indicator to the URL substring based on a result of the comparing, thereby making the URL substring an analyzed URL substring, wherein the comparing comprises at least one of the following:
• automatically determining an encoding characteristic of the URL substring,
• automatically calculating a quantitative characteristic of the URL substring,
• automatically ascertaining a rarity characteristic of the URL substring,
• automatically finding an iteration characteristic of the URL substring as a member of a set of URL substrings, or
• automatically locating a dictionary characteristic of the URL substring;
• and
• enhancing security of a guarded system based on at least the maliciousness risk indicator by performing at least one of the following:
• disallowing use of the analyzed URL substring by the guarded system when the maliciousness risk indicator places the analyzed URL substring in a high risk category, or
• allowing use of the analyzed URL substring by the guarded system when the maliciousness risk indicator places the analyzed URL substring in a low risk category.

A computer-readable storage medium configured with data and instructions which upon execution by at least one processor cause one or more devices to perform a static uniform resource locator (URL) security analysis method, the method comprising:

• obtaining a URL substring;
• automatically comparing the URL substring to at least one malice pattern, the malice pattern and the comparing each directly based on both of string structure and content as opposed to being based on a result of following a link derived using the URL substring to detect what happens or being based on a preexisting domain reputation;
• assigning a maliciousness risk indicator to the URL substring based on a result of the comparing, thereby making the URL substring an analyzed URL substring;
• and
• enhancing security by disallowing use of the analyzed URL substring when the maliciousness risk indicator places the analyzed URL substring in a high risk category;
• wherein the method is further characterized in at least one of the following ways:
• the URL security analysis method avoids reliance on any detonation virtual machine as a basis for disallowing use of the analyzed URL substring;
• or
• the URL security analysis method avoids reliance on any subjective analysis by a human as a basis for disallowing use of the analyzed URL substring.