US 12,341,811 B2
Detecting malicious behavior using an accomplice model
Adam Hunt, El Cerrito, CA (US); Joseph Linn, Emeryville, CA (US); Nick Goodman, San Mateo, CA (US); Elias Manousos, San Francisco, CA (US); Chris Kiernan, San Francisco, CA (US); David Pon, Sunnyvale, CA (US); and Jonas Edgeworth, San Francisco, CA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Sep. 27, 2021, as Appl. No. 17/486,731.
Application 17/486,731 is a continuation of application No. 16/709,898, filed on Dec. 10, 2019, granted, now 11,134,101.
Application 16/709,898 is a continuation of application No. 15/803,736, filed on Nov. 3, 2017, granted, now 10,505,981, issued on Dec. 10, 2019.
Claims priority of provisional application 62/417,228, filed on Nov. 3, 2016.
Prior Publication US 2022/0014552 A1, Jan. 13, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 16/2457 (2019.01); G06F 16/951 (2019.01); G06F 16/955 (2019.01); G06F 21/56 (2013.01); H04L 67/02 (2022.01); H04L 67/306 (2022.01)
CPC H04L 63/1483 (2013.01) [G06F 16/24578 (2019.01); G06F 16/951 (2019.01); G06F 16/955 (2019.01); H04L 63/0236 (2013.01); H04L 63/101 (2013.01); G06F 21/56 (2013.01); H04L 63/14 (2013.01); H04L 63/1433 (2013.01); H04L 63/1441 (2013.01); H04L 63/168 (2013.01); H04L 67/02 (2013.01); H04L 67/306 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
creating a uniform resource identifier (URI) list, which includes a plurality of URIs that are used to render a web page;
identifying an attribute associated with the web page;
identifying a number of web pages that are rendered and that cause a first URI associated with the attribute to be called without calling a second URI that is determined to be malicious;
calculating a score for the attribute based at least on the number of the web pages that are rendered and that cause the first URI associated with the attribute to be called without calling the second URI that is determined to be malicious;
classifying the attribute as malicious based at least on the score;
determining that an identified URI in the URI list is associated with the attribute; and
as a result of determining that the identified URI in the URI list is associated with the attribute, performing the following operations:
creating a blacklist incident for the identified URI; and
performing a security action with regard to the identified URI.