US 12,483,531 B2
System and method for multi-layered rule learning in URL filtering
Mantas Briliauskas, Vilnius (LT); Vykintas Maknickas, Vilnius (LT); and Jonas Palacionis, Vilnius (LT)
Assigned to UAB 360 IT, Vilnius (LT)
Filed by UAB 360 IT, Vilnius (LT)
Filed on Jan. 19, 2024, as Appl. No. 18/417,367.
Application 18/417,367 is a continuation in part of application No. 17/948,857, filed on Sep. 20, 2022, granted, now 11,916,875.
Application 17/948,857 is a continuation of application No. 17/545,479, filed on Dec. 8, 2021, granted, now 11,470,044, issued on Oct. 11, 2022.
Prior Publication US 2024/0414125 A1, Dec. 12, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01)
CPC H04L 63/0236 (2013.01) [G06N 20/00 (2019.01); H04L 63/0263 (2013.01); H04L 63/1416 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A URL filtering system comprising: a hardware processor; and a memory accessible by the processor, the memory having stored therein at least one of programs or instructions executable by the at least one processor to cause the filtering system to perform operations comprising: receiving a URL request to access a resource associated with the URL; filtering the URL by comparing the URL to a blocklist of URLs having respective malicious resources associated to predict if a resource associated with the URL is malicious;
in response to determination that the URL does not match a URL on the blocklist and that, as such, a resource associated with the URL is not malicious, filtering the URL by applying a machine learning algorithm trained to analyze the URL using block list rules to predict whether a resource associated with the URL is malicious;
in response to determination, using the block list rules, that a resource associated with the URL is not malicious, filtering the URL by comparing at least one visual feature of a resource associated with the URL with at least one respective visual feature of known non-malicious webpages to identify similarities and/or differences to determine if a resource associated with the URL is malicious; and
in response to determination that a resource associated with the URL is malicious, generating and transmitting a URL filter determination that the resource associated with the URL is malicious and updating the blocklist to include the URL, wherein in response to determination that an amount of the similarities are below a user-defined threshold or an amount of the differences are above the user-defined threshold, the resource associated with the URL is determined to be malicious.