Patent ID: 8205258
Filing Date: 2012-06-19
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for performing computer security, the method comprising: a first computer receiving a plurality of browsing histories comprising uniform resource locator (URL) requests made by client computers to access websites on the Internet; the first computer finding a plurality of URL patterns from the browsing histories, each of the URL patterns comprising variable elements and constant elements, the constant elements remaining constant and in a same position in a group of URL request chains in the browsing histories; the first computer finding URL browsing chains having a first URL that matches a first URL pattern in the plurality of URL patterns, each of the URL browsing chains being for a particular client computer and comprising the first URL and a second URL sequentially arranged in time stamp order, the second URL matching a second URL pattern in the plurality of URL patterns; the first computer generating normalized URL browsing chains by normalizing the URL browsing chains to remove noise data from the URL browsing chains; the first computer identifying web threat infection chains from the normalized URL browsing chains, the web threat infection chains comprising a series of ordered URL requests that lead to malicious content; the first computer building a model for detecting web threat infection chains using the identified web threat infection chains; a second computer receiving the model built by the first computer; and the second computer detecting a web threat infection chain in the second computer by identifying a sequence of different URLs accessed at different times from the second computer and accessed in a time ordered sequence as indicated in the model.