Systems for malicious website detection using machine learning
AssigneeBTBlock, LLC
InventorThomas Olofsson
Life of this patent
Estimating the term…
Abstract
Systems are disclosed herein for detecting and preventing navigation of a user computer to malicious websites. The systems can detect malicious websites using machine learning models and domain name databases containing data on safe and unsafe websites. The systems can extract a uniform resource locator (URL) associated with a webpage and compare the URL with the domain name databases to determine if the URL is safe or unsafe. When the system detects an unsafe website, the system can update the domain name databases to include data on the new unsafe website. The machine learning model may be trained using the updated domain name databases to enhance the detection of malicious websites and prevent users from navigating to such websites.
Claims20
A system for detecting and preventing navigation of a user computer to malicious websites, the system comprising:
- one or more computers comprising one or more processors and one or more memories for storing a domain name database and having non-transitory computer-executable instructions for causing the one or more processors of the one or more computers to perform operations comprising:
- displaying a web browser including a browser window;
- implementing a browser extension associated with the web browser;
- receiving via the web browser a request to retrieve a webpage via a domain name;
- extracting via the browser extension a uniform resource locator (URL) associated with the webpage;
- comparing the URL with the domain name database to determine if the URL is safe or unsafe;
- if the URL is safe, allowing the requested webpage to be rendered in the browser window;
- and
- if the URL is unsafe,
- implementing a machine learning model configured to analyze the determined unsafe URL,
- reclassifying the URL as safe or unsafe using the machine learning model,
- if the URL is reclassified as safe, updating the domain name database with data on the reclassified URL to whitelist the domain name and allowing the requested webpage to be rendered in the browser window, and
- if the URL is reclassified as unsafe, blocking the requested webpage from being rendered in the browser window and training the machine learning model based on the reclassified unsafe URL.
A system for detecting and preventing navigation of a user computer to malicious websites, the system comprising:
- one or more computers including a client computer, the one or more computers including one or more processors and one or more memories for storing a domain name database and having non-transitory computer-executable instructions for causing the one or more processors of the one or more computers to perform operations comprising:
- displaying a web browser including a browser window;
- implementing a browser extension associated with the web browser;
- receiving via the web browser a request to retrieve a webpage via a domain name;
- extracting via the browser extension a uniform resource locator (URL) associated with the webpage;
- comparing the URL with the domain name database to determine if the URL is safe or unsafe;
- if the URL is safe, allowing the requested webpage to be rendered in the browser window;
- and
- if the URL is unsafe,
- implementing a machine learning model configured to analyze the determined unsafe URL via the one or more processors of the client computer,
- reclassifying the URL as safe or unsafe using the machine learning model,
- if the URL is reclassified as safe, allowing the requested webpage to be rendered in the browser window, and
- if the URL is reclassified as unsafe, blocking the requested webpage from being rendered in the browser window.
A system for detecting and preventing navigation of a user computer to malicious websites, the system comprising:
- one or more computers including a client computer, the one or more computers including one or more processors and one or more memories for storing a domain name database and having non-transitory computer-executable instructions for causing the one or more processors of the one or more computers to perform operations comprising:
- displaying a web browser including a browser window;
- implementing a browser extension associated with the web browser;
- receiving via the web browser a request to retrieve a webpage via a domain name;
- extracting via the browser extension a uniform resource locator (URL) associated with the webpage;
- comparing the URL with the domain name database to determine if the URL is safe or unsafe;
- if the URL is safe, allowing the requested webpage to be rendered in the browser window;
- and
- if the URL is unsafe,
- implementing a machine learning model configured to analyze the determined unsafe URL,
- reclassifying the determined unsafe URL as safe or unsafe using the machine learning model,
- if the URL is reclassified as safe, allowing the requested webpage to be rendered in the browser window, and
- if the URL is reclassified as unsafe,
- notifying a user via a notification that the URL is unsafe,
- receiving a request to render the requested webpage in the browser window or to block the requested webpage,
- if the request is to render the requested webpage in the browser window, allowing the requested webpage to be rendered in the browser window and generating an incident report, and
- if the request is to block the requested webpage, blocking the requested webpage from being rendered in the browser window, and
- providing a client portal accessible by the client computer, and
- displaying incident reports via the client portal.
Dependencies are inferred from the claim text.