Patent ID: 11882131
Assignee: PROOFPOINT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 5:
6. A universal resource locator (URL) velocity monitoring system, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
receiving a URL, the URL velocity monitoring system operating in a first computer network;
decomposing the URL into URL features based on logical boundaries of the URL;
determining, from the URL features of the URL, URL features of interest;
determining, by the URL velocity monitor, a URL velocity tracking strategy;
tracking, by the URL velocity monitor based on the URL velocity tracking strategy, a velocity of each respective URL feature of the URL features of interest in email traffic of a second computer network, wherein the URL velocity tracking strategy comprises a rule or information that specifies how the respective URL feature of the URL features of interest in the email traffic of the second computer network is to be handled, the tracking comprising monitoring a volume of the respective URL feature in the email traffic within a time period, wherein tracking the velocity of the respective feature is performed in accordance with the rule or information specified by the URL velocity tracking strategy, wherein determining the URL velocity tracking strategy comprises using a slow counter and a fast counter to track acceleration and the velocity of the respective URL feature within the time period;
determining whether the velocity of the respective URL feature is accelerating based on a change in the velocity within the time period; and
responsive to a determination that the velocity of the respective URL feature is accelerating within the time period, placing the URL in a queue for sandboxing or analyzing the URL in a sandboxed computer environment.