URL pattern-based risk scoring and anomaly detection
Systems and methods are described for Uniform Resource Locator (“URL”) pattern-based high-risk browsing and anomaly detection. In an example, a user device can compare URLs in a browser's history to URL patterns in a provided list to identify matches. The user device can calculate a browsing risk score based on the percentage of entries in the browsing history that match each URL pattern and a risk score associated with the URL pattern. Security policies can be enforced at the user device if the browsing risk score exceeds a threshold. The user device can also detect potentially dangerous anomalous browsing behavior. The user device can calculate a deviance score based on variations between recent browsing history and historical browsing behavior at the user device. Security policies can be enforced at the user device if the deviance score exceeds a threshold.
1. A method for enforcing security policies on a user's device based on Uniform Resource Locator (URL) pattern-based risk scoring and anomaly detection, the method comprising:
receiving a first reference set of URL patterns that includes a URL risk score for each URL pattern in the first reference set;
comparing entries in a browsing history of the user, to the URL patterns in the first reference set, wherein some of the entries in the browsing history do not match any of the URL patterns in the first reference set;
calculating a browsing risk score for the user's browsing behavior, the browsing risk score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, wherein calculating the browsing risk score comprises applying a predetermined default URL risk score to the entries in the browsing history that do not match any of the URL patterns in the first reference set;
comparing the browsing risk score to a first predetermined threshold; and
in an instance where the browsing risk score exceeds the first predetermined threshold, enforcing a first security policy at the user's device.
2. The method of claim 1 , wherein calculating the browsing risk score further comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that match URL patterns in the first reference set;
for each URL pattern in the first reference set with at least one matching entry in the browsing history, determining a percentage of matching entries in browsing history; and
multiplying, for each URL pattern in the first reference set with at least one matching entry in the browsing history, the percentage of matching entries for the URL pattern by the URL risk score in the first reference set for the URL pattern.
3. The method of claim 1 , further comprising:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that each matches multiple of the URL patterns in the first reference set; and
for each entry in the browsing history that matches multiple of the URL patterns in the first reference set, applying, to the entry, the greatest of the URL risk scores in the first reference set for the matching URL patterns, when calculating the browsing risk score.
4. The method of claim 1 , further comprising:
receiving a second reference set of URL patterns that includes an expected usage score for each URL pattern in the second reference set, each expected usage score indicating a percentage of entries in the browsing history that are expected to match the corresponding URL pattern in the second reference set;
comparing the entries in the browsing history to the URL patterns in the second reference set;
calculating a deviance score indicating a deviance of the user's browsing behavior from a historical browsing history of the user, the deviance score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the second reference set;
comparing the deviance score to a second predetermined threshold; and
in an instance where the deviance score exceeds the second predetermined threshold, enforcing a second security policy at the user's device.
5. The method of claim 4 , wherein calculating the deviance score comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the second reference set, entries in the browsing history that match URL patterns in the second reference set;
for each URL pattern in the second reference set with at least one matching entry in the browsing history, determining an actual percentage of matching entries in the browsing history; and
calculating a Euclidean distance of a plurality of vectors, wherein each vector includes, for one of the URL patterns in the second reference set, the actual percentage of matching entries in the browsing history and a corresponding expected percentage of matching entries in the browsing history.
6. The method of claim 1 , wherein the browsing risk score exceeds the first predetermined threshold, and enforcing the first security policy at the user's device includes at least one of: restricting access to a managed application on the user's device, locking the user's device, and restricting access of the user's device to an enterprise resource or to a network.
7. A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, cause the hardware-based processor to perform stages for enforcing security policies on a user's device based on Uniform Resource Locator (URL) pattern-based risk scoring and anomaly detection, the stages comprising:
receiving a first reference set of URL patterns that includes a URL risk score for each URL pattern in the first reference set;
comparing entries in a browsing history of the user, to the URL patterns in the first reference set, wherein some of the entries in the browsing history do not match any of the URL patterns in the first reference set;
calculating a browsing risk score for the user's browsing behavior, the browsing risk score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, wherein calculating the browsing risk score comprises applying a predetermined default URL risk score to the entries in the browsing history that do not match any of the URL patterns in the first reference set;
comparing the browsing risk score to a first predetermined threshold; and
in an instance where the browsing risk score exceeds the first predetermined threshold, enforcing a first security policy at the user's device.
8. The non-transitory, computer-readable medium of claim 7 , wherein calculating the browsing risk score further comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that match URL patterns in the first reference set;
for each URL pattern in the first reference set with at least one matching entry in the browsing history, determining a percentage of matching entries in the browsing history; and
multiplying, for each URL pattern in the first reference set with at least one matching entry in the browsing history, the percentage of matching entries for the URL pattern by the URL risk score in the first reference set for the URL pattern.
9. The non-transitory, computer-readable medium of claim 7 , the stages further comprising:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that each matches multiple of the URL patterns in the first reference set; and
for each entry in the browsing history that matches multiple of the URL patterns in the first reference set, applying, to the entry, the greatest of the URL risk scores in the first reference set for the matching URL patterns, when calculating the browsing risk score.
10. The non-transitory, computer-readable medium of claim 7 , the stages further comprising:
receiving a second reference set of URL patterns that includes an expected usage score for each URL pattern in the second reference set, each expected usage score indicating a percentage of entries in the browsing history that are expected to match the corresponding URL pattern in the second reference set;
comparing the entries in the browsing history to the URL patterns in the second reference set;
calculating a deviance score indicating a deviance of the user's browsing behavior from a historical browsing history of the user, the deviance score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the second reference set;
comparing the deviance score to a second predetermined threshold; and
in an instance where the deviance score exceeds the second predetermined threshold, enforcing a second security policy at the user's device.
11. The non-transitory, computer-readable medium of claim 10 , wherein calculating the deviance score comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the second reference set, entries in the browsing history that match URL patterns in the second reference set;
for each URL pattern in the second reference set with at least one matching entry in the browsing history, determining an actual percentage of matching entries in the browsing history; and
calculating a Euclidean distance of a plurality of vectors, wherein each vector includes, for one of the URL patterns in the second reference set, the actual percentage of matching entries in the browsing history and a corresponding expected percentage of matching entries in the browsing history.
12. The non-transitory, computer-readable medium of claim 7 , wherein the browsing risk score exceeds the first predetermined threshold, and enforcing the first security policy at the user's device includes at least one of: restricting access to a managed application on the user's device, locking the user's device, and restricting access of the user's device to an enterprise resource or to a network.
13. A system for enforcing security policies on a user's device based on Uniform Resource Locator (URL) pattern-based risk scoring and anomaly detection, the system comprising:
a memory storage including instructions; and
a hardware-based processor that executes the instructions from the memory storage to carry out stages comprising:
receiving a first reference set of URL patterns that includes a URL risk score for each URL pattern in the first reference set;
comparing entries in a browsing history of the user, to the URL patterns in the first reference set, wherein some of the entries in the browsing history do not match any of the URL patterns in the first reference set;
calculating a browsing risk score for the user's browsing behavior, the browsing risk score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, wherein calculating the browsing risk score comprises applying a predetermined default URL risk score to the entries in the browsing history that do not match any of the URL patterns in the first reference set;
comparing the browsing risk score to a first predetermined threshold; and
in an instance where the browsing risk score exceeds the first predetermined threshold, enforcing a first security policy at the user's device.
14. The system of claim 13 , wherein calculating the browsing risk score further comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that match URL patterns in the first reference set;
for each URL pattern in the first reference set with at least one matching entry in the browsing history, determining a percentage of matching entries in the browsing history; and
multiplying, for each URL pattern in the first reference set with at least one matching entry in the browsing history, the percentage of matching entries for the URL pattern by the URL risk score in the first reference set for the URL pattern.
15. The system of claim 13 , the stages further comprising:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the first reference set, entries in the browsing history that each matches multiple of the URL patterns in the first reference set; and
for each entry in the browsing history that matches multiple of the URL patterns in the first reference set, applying, to the entry, the greatest of the URL risk scores in the first reference set for the matching URL patterns, when calculating the browsing risk score.
16. The system of claim 13 , the stages further comprising:
receiving a second reference set of URL patterns that includes an expected usage score for each URL pattern in the second reference set, each expected usage score indicating a percentage of entries in the browsing history that are expected to match the corresponding URL pattern in the second reference set;
comparing the entries in the browsing history to the URL patterns in the second reference set;
calculating a deviance score indicating a deviance of the user's browsing behavior from a historical browsing history of the user, the deviance score being calculated based on the comparison of the entries in the browsing history to the URL patterns in the second reference set;
comparing the deviance score to a second predetermined threshold; and
in an instance where the deviance score exceeds the second predetermined threshold, enforcing a second security policy at the user's device.
17. The system of claim 16 , wherein calculating the deviance score comprises:
identifying, based on the comparison of the entries in the browsing history to the URL patterns in the second reference set, entries in the browsing history that match URL patterns in the second reference set;
for each URL pattern in the second reference set with at least one matching entry in the browsing history, determining an actual percentage of matching entries in the browsing history; and
calculating a Euclidean distance of a plurality of vectors, wherein each vector includes, for one of the URL patterns in the second reference set, the actual percentage of matching entries in the browsing history and a corresponding expected percentage of matching entries in the browsing history.