# US 2021/0344693 A1 · URL risk analysis using heuristics and scanning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344693 A1
- Document ID: US20210344693A1
- Status: Published application
- Kind: A1
- Application number: 17/374,080
- Filed: 2021-07-13
- Published: 2021-11-04
- Earliest claimed: 2019-12-18
- Assignees: Zscaler, Inc.
- Applicants: Zscaler, Inc.
- Inventors: Rubin Azad; Deepen Desai; Narinder Paul
- Web page: https://patentgrep.com/patent/US20210344693A1

## CPC

- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 20/00: Machine learning
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- G06F 2221/2119: Authenticating web pages, e.g. with suspicious links
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems and methods include, responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database; loading the URL; receiving artifacts based on the loading; using the plurality of listener modules to run rules based on the received artifacts; scoring the URL based on the rules and the received artifacts; and determining whether the URL is one of benign, suspicious, or malicious based on the scoring. The steps can include any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

## Claims

### Claim 1

A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database;
loading the URL;
receiving artifacts based on the loading;
using the plurality of listener modules to run rules based on the received artifacts;
scoring the URL based on the rules and the received artifacts; and
determining whether the URL is one of benign, suspicious, or malicious based on the scoring.

### Claim 2 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the steps include any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

### Claim 3 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the steps include responsive to the URL being suspicious, running a machine learning model on the URL.

### Claim 4 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the database uses LISTEN and NOTIFY in PostgreSQL.

### Claim 5 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the artifacts include any of ‘asn’, ‘user_agent’, ‘content_size’, ‘content_type’, ‘server’, ‘redirected_url’, ‘status_code’, ‘redir_status_code’, ‘country’, ‘domain’, ‘headers’, ‘ipaddr’, ‘md5’, ‘mime’, ‘port’, ‘schema’, ‘sha256’, ‘store_loc’, ‘tld’, and ‘url’.

### Claim 6 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the loading the URL is from a queue.

### Claim 7 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the artifacts include external elements, content checks, host checks, and URL checks.

### Claim 8

A method comprising steps of:
responsive to starting a plurality of listener modules, receiving a Uniform Resource Locator (URL) for a site on the Internet into a database;
loading the URL;
receiving artifacts based on the loading;
using the plurality of listener modules to run rules based on the received artifacts;
scoring the URL based on the rules and the received artifacts; and
determining whether the URL is one of benign, suspicious, or malicious based on the scoring.

### Claim 9 (depends on 8)

The method of claim 8, wherein the steps include any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

### Claim 10 (depends on 8)

The method of claim 8, wherein the steps include responsive to the URL being suspicious, running a machine learning model on the URL.

### Claim 11 (depends on 8)

The method of claim 8, wherein the database uses LISTEN and NOTIFY in PostgreSQL.

### Claim 12 (depends on 8)

The method of claim 8, wherein the artifacts include any of ‘asn’, ‘user_agent’, ‘content_size’, ‘content_type’, ‘server’, ‘redirected_url’, ‘status_code’, ‘redir_status_code’, ‘country’, ‘domain’, ‘headers’, ‘ipaddr’, ‘md5’, ‘mime’, ‘port’, ‘schema’, ‘sha256’, ‘store_loc’, ‘tld’, and ‘url’.

### Claim 13 (depends on 8)

The method of claim 8, wherein the loading the URL is from a queue.

### Claim 14 (depends on 8)

The method of claim 8, wherein the artifacts include external elements, content checks, host checks, and URL checks.

### Claim 15

A server comprising:
a network interface communicatively coupled to a network;
a processor communicatively coupled to the network interface; and
memory storing computer-executable instructions that, when executed, cause the processor to
responsive to starting a plurality of listener modules, receive a Uniform Resource Locator (URL) for a site on the Internet into a database;
load the URL;
receive artifacts based on the loading;
use the plurality of listener modules to run rules based on the received artifacts;
score the URL based on the rules and the received artifacts; and
determine whether the URL is one of benign, suspicious, or malicious based on the scoring.

### Claim 16 (depends on 15)

The server of claim 15, wherein the instructions that, when executed, cause the processor to
any of blocking the URL, allowing the URL, further analyzing the URL, adding the URL to a whitelist or blacklist, and providing a notification, based on whether the URL is benign, suspicious, or malicious.

### Claim 17 (depends on 15)

The server of claim 15, wherein the instructions that, when executed, cause the processor to
responsive to the URL being suspicious, running a machine learning model on the URL.

### Claim 18 (depends on 15)

The server of claim 15, wherein the database uses LISTEN and NOTIFY in PostgreSQL.

### Claim 19 (depends on 15)

The server of claim 15, wherein the artifacts include any of ‘asn’, ‘user_agent’, ‘content_size’, ‘content_type’, ‘server’, ‘redirected_url’, ‘status_code’, ‘redir_status_code’, ‘country’, ‘domain’, ‘headers’, ‘ipaddr’, ‘md5’, ‘mime’, ‘port’, ‘schema’, ‘sha256’, ‘store_loc’, ‘tld’, and ‘url’.

### Claim 20 (depends on 15)

The server of claim 15, wherein the artifacts include external elements, content checks, host checks, and URL checks.