Classifying locator generation kits
AssigneeRapid 7, Inc.
InventorsRoy Hodgman, Aditya Kuppa, Suchin Gururangan, Andrew Reece
Life of this patent
Estimating the term…
Abstract
Methods and systems for classifying malicious locators. A processor is trained on a set of known malicious locators using a non-supervised learning procedure. Once trained, the processor may classify new locators as being generated by a particular generation kit.
Claims20
A method for classifying malicious locators accessible through a network, the method comprising:
- accessing, through an interface to a computer-readable medium, a plurality of locators, wherein each locator comprises the location of a malicious network-accessible resource;
- extracting at least one feature from each of the plurality of locators;
- labeling each of the plurality of locators as being generated by a specific source based on the extracted features;
- providing the extracted features and the source label for each of the plurality of locators to a classification module to train the classification module;
- and
- applying the classification module to a second locator to determine a source of the second locator.
A system for classifying malicious locators accessible through a network, the system comprising:
- an interface to a computer-readable medium configured to access a plurality of locators, each of the plurality of locators comprising the location of a malicious network-accessible resource;
- a network interface;
- and
- a processor in communication with the medium interface and the network interface, the processor configured to:
- extract at least one feature from each of the plurality of locators;
- label each of the plurality of locators as being generated by a specific source based on the extracted features;
- and
- provide the extracted features and the source label for each of the plurality of locators to a classification module to train the classification module so the classification module can determine a source of a second locator.
A computer readable medium containing computer-executable instructions for performing a method for classifying malicious locators accessible through a network, the medium comprising:
- computer-executable instructions for accessing, through an interface to a computer-readable medium, a plurality of locators, wherein each locator comprises the location of a malicious network-accessible resource;
- computer-executable instructions for extracting at least one feature from each of the plurality of locators;
- computer-executable instructions for labeling each of the plurality of locators as being generated by a specific source based on the extracted features;
- computer-executable instructions for providing the extracted features and the source label for each of the plurality of locators to a classification module to train the classification module;
- and
- computer-executable instructions for applying the classification module to a second locator to determine a source of the second locator.
Dependencies are inferred from the claim text.