Patent Document ID: 9178901
Application ID: 13850535

Base Claim:
1. A method comprising: receiving a uniform resource locator (URL) that includes one or more substrings, wherein each substring comprises a plurality of alphanumeric characters; extracting, via one or more processors, a plurality of features associated with the URL, wherein at least one first feature of the plurality of features is a domain confidence level that determines a reliability of a domain or a second level domain of the URL, wherein the reliability is based on a ratio of a number of known benign URLs hosted by the domain or the second level domain of the URL compared to a number of known malicious URLs hosted by the domain or the second level domain; determining, as at least one second feature of the plurality of features, a similarity measure between a whole or part of the URL and a brand name associated with an authentic resource or a legitimate entity; and applying one or more classification models to the at least one first feature and the at least one second feature to determine whether a resource located by the URL is an unauthentic resource.

---

Claim 6:
6. The method as recited in claim 1 , further comprising: receiving a plurality of training URLs known to be malicious URLs or benign URLs; and learning the one or more classification models using one or more machine learning algorithms based on features extracted from the plurality of training URLs.