Methods, systems and devices to mitigate the effects of side effect URLs in legitimate and phishing electronic messages
A computer-implemented method may comprise receiving an electronic message (such as a legitimate email or malicious phishing email, for example) over a computer network, the electronic message containing a uniform resource locator (URL). The URL in the received electronic message may be parsed and one or more original parameter may be identified therein. The type of the identified original parameter(s) may be determined. The identified original parameter(s) may then be transformed according to a parameter transformation rules, selected according to the determined type. to generate transformed parameter(s). The URL may then be reassembled by substituting the transformed parameter(s) for the original parameter(s). The website pointed to by the reassembled URL may then be accessed, over the computer network, using the transformed parameter(s) only if the reassembled URL meets a predetermined minimum criterion.
1. A computer-implemented method, comprising:
receiving, using a network interface of a computing device, an address of a resource on a computer network and storing the received address of the resource in a memory of the computing device coupled to the computer network;
identifying at least one original parameter in the stored address of the resource, the identified at least one original parameter comprising a plurality of characters;
using a processor of the computing device, transforming the identified at least one original parameter by successively replacing at least some of the plurality of characters with at least one of a random character of a same type of a plurality of predetermined types and another character of the same type obtained by carrying out a predetermined operation thereon, to generate at least one transformed parameter;
using the processor of the computing device, reassembling the address of the resource by substituting the at least one transformed parameter for the at least one original parameter; and
using the processor of the computing device and the network interface of the computing device, accessing the resource pointed to by the reassembled address of the resource over the computer network only when a number of the successive replacements is at least equal to a predetermined minimum number of transformations.
2. The computer-implemented method of claim 1 , wherein the at least one original parameter forms part of a hierarchical structure of the address of the resource on the computer network.
3. The computer-implemented method of claim 1 , wherein the plurality of predetermined types of parameters include at least some of decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
4. The computer-implemented method of claim 1 , wherein a type of the identified at least one original parameter is only determined when at least one of:
1) a length of an original parameter being typed is at least a predetermined minimum length; and
2) a statistical distribution of lowercase letters, uppercase letters and/or numbers of an original parameter being typed is consistent with normal distributions of lowercase letters, uppercase letters and/or numbers for sequences of the determined type.
5. The computer-implemented method of claim 4 , further including applying a selectable margin of error to the statistical distribution for each of the plurality of types of parameters.
6. The computer-implemented method of claim 1 , further comprising analyzing a response of the accessed resource to the at least one transformed parameters to determine whether the address of the resource is a side effect resource locator.
7. The computer-implemented method of claim 1 , wherein the predetermined operation includes at least one arithmetical operation.
8. The computer-implemented method of claim 1 , wherein transforming comprises accessing a database of parameter transformation rules coupled to the computer network, each of the parameter transformation rules corresponding to at least one predetermined type of parameter.
9. The computer-implemented method of claim 1 , wherein the database of parameter transformation rules comprises at least one parameter transformation rule for decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
10. The computer-implemented method of claim 1 , wherein the address of the resource includes a Uniform Resource Locator (URL).
11. A computing device, comprising:
at least one processor;
at least one data storage device coupled to the at least one processor;
a network interface coupled to the at least one processor and to a computer network;
a plurality of processes spawned by said at least one processor, the processes including processing logic for:
using the network interface, receiving an address of a resource over the computer network, and storing the received address of the resource in the at least one data storage device,
using a processor of the computing device, identifying at least one original parameter in the received address of the resource, the identified at least one original parameter comprising a plurality of characters;
using a processor of the computing device, transforming the identified at least one original parameter by successively replacing at least some of the plurality of characters thereof with at least one of a random character of a same type of a plurality of predetermined types and another character of the same type obtained by carrying out a predetermined operation thereon, to generate at least one transformed parameter;
using a processor of the computing device, reassembling the address of the resource by substituting the at least one transformed parameter for the at least one original parameter; and
using the processor of the computing device and the network interface of the computing device, accessing the resource pointed to by the reassembled address of the resource over the computer network only when a number of the successive replacements is at least equal to a predetermined minimum number of transformations.
12. The computing device of claim 11 , wherein the at least one original parameter forms part of a hierarchical structure of the address of the resource on the computer network.
13. The computing device of claim 11 , wherein the plurality of predetermined types of parameters include at least some of decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
14. The computing device of claim 11 , wherein a type of the identified at least one original parameter is only determined when at least one of:
1) a length of an original parameter being typed is at least a predetermined minimum length; and
2) a statistical distribution of lowercase letters, uppercase letters and/or numbers of an original parameter being typed is consistent with normal distributions of lowercase letters, uppercase letters and/or numbers for sequences of the determined type.
15. The computing device of claim 14 , further including processing logic for applying a selectable margin of error to the statistical distribution for each of the plurality of types of parameters.
16. The computing device of claim 11 , further comprising processing logic for analyzing a response of the accessed resource to the at least one transformed parameters to determine whether the address of the resource is a side effect resource locator.
17. The computing device of claim 11 , wherein the predetermined operation includes at least one arithmetical operation.
18. The computing device of claim 11 , wherein the processing logic for transforming comprises processing logic for accessing a database of parameter transformation rules coupled to the computer network, each of the parameter transformation rules corresponding to at least one predetermined type of parameter.
19. The computing device of claim 11 , wherein the database of parameter transformation rules comprises at least one parameter transformation rule for decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
20. The computing device of claim 11 , wherein the address of the resource includes a Uniform Resource Locator (URL).
21. A tangible, non-transitory machine-readable data storage device having data stored thereon representing sequences of instructions which, when executed by a computing device, cause the computing device to:
receive, using a network interface of the computing device, an address of a resource over the computer network and storing the received address of the resource in a memory of the computing device;
using a processor of the computing device, identify at least one original parameter in the received address of the resource, the identified at least one original parameter comprising a plurality of characters;
using a processor of the computing device, transform the identified at least one original parameter by successively replacing at least some of the plurality of characters thereof with at least one of a random character of a same type of a plurality of predetermined types and another character of the same type obtained by carrying out a predetermined operation thereon, to generate at least one transformed parameter;
using a processor of the computing device, reassemble the address of the resource by substituting the at least one transformed parameter for the at least one original parameter; and
using the processor of the computing device and the network interface of the computing device, access the resource pointed to by the reassembled address of the resource over the computer network only when a number of the successive replacements is at least equal to a predetermined minimum number of transformations.
22. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the at least one original parameter forms part of a hierarchical structure of the address of the resource on the computer network.
23. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the plurality of predetermined types of parameters include at least some of decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
24. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein a type of the identified at least one original parameter is only determined when at least one of:
1) a length of an original parameter being typed is at least a predetermined minimum length; and
2) a statistical distribution of lowercase letters, uppercase letters and/or numbers of an original parameter being typed is consistent with normal distributions of lowercase letters, uppercase letters and/or numbers for sequences of the determined type.
25. The tangible, non-transitory machine-readable data storage device of claim 24 , wherein the sequences of instructions are further configured to cause the computing device to apply a selectable margin of error to the statistical distribution for each of the plurality of types of parameters.
26. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the sequences of instructions are further configured to cause the computing device to analyze a response of the accessed resource to the at least one transformed parameters to determine whether the address of the resource is a side effect resource locator.
27. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the predetermined operation includes at least one arithmetical operation.
28. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the sequences of instructions are further configured to cause the computing device to access a database of parameter transformation rules coupled to the computer network, each of the parameter transformation rules corresponding to at least one predetermined type of parameter.
29. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the database of parameter transformation rules comprises at least one parameter transformation rule for decimal numbers, lowercase hexadecimal characters, uppercase hexadecimal characters, base 64 characters, lowercase letters, uppercase letters, lowercase email addresses and uppercase email addresses.
30. The tangible, non-transitory machine-readable data storage device of claim 21 , wherein the address of the resource includes a Uniform Resource Locator (URL).