Blocklists lose the URL game by design. Attackers register fresh domains by the thousand, so any list of known-bad links is stale the moment it ships. The only way to keep up is to stop matching exact URLs and start recognizing the shape of malicious ones.

Palo Alto Networks' US11418485B2, “Pattern-based malicious URL detection” (issued August 16, 2022; CPC H04L 63/1483 — protection against phishing, and H04L 63/1416 — network intrusion detection), describes detecting malicious URLs by their patterns rather than by exact prior matches. Read it at US11418485B2.

“To perform pattern-based detection of malicious URLs, patterns are first generated from known URLs to build a pattern repository. A URL is first normalized and parsed, and keywords are extracted and stored in an additional repository of keywords.”— U.S. Patent No. 11,418,485 source

The filing describes a tokenization pipeline that turns a specific URL into an abstract fingerprint. First, normalization: the URL is pre-processed and decoded to a canonical form — the specification has the normalizer check for “non-readable strings” and translate the URL into a format later stages recognize. Then keyword extraction pulls common URL substrings into a keyword repository. Then a URL processor parses the string, “split[ting] the query string… based on delimiters used for separating URL components, such as ‘/’ (forward slash), ‘?’ (question mark), and ‘&’ (ampersand).”

The crucial step is tagging. A substring tagger replaces each parsed substring with a token that names its type rather than its literal value. The specification gives the actual tag vocabulary: substrings are labeled as a year, a hexadecimal number, a hostname, or “gibberish” — “a sequence of characters which satisfy a threshold for randomness” — rendered as tokens like “#year#”, “#hex#”, “#host#”. That gibberish tag is doing real work: it is how the system flags the random-looking strings that domain-generation algorithms produce. Claim 1 generalizes the move: “determining a representative token for a first substring… that indicates… a type of the first substring” and “generating a representative pattern for the URL based on replacing the first substring with the representative token.”

Detection is then a pattern lookup, not a string match. Patterns built from known malicious and benign URLs are published to a repository; at runtime, an unknown URL is normalized, parsed, and tagged into its own representative pattern, and the system determines “if a pattern which matches the representative pattern can be identified among a plurality of patterns previously generated from known malicious URLs.” Per claim 1, a partial match is enough: “based on identifying a first pattern… that at least partially matches the representative pattern, indicating that the URL is malicious.” A brand-new phishing domain with zero reputation is caught because, once its specifics are abstracted to type-tokens, it has the same structural fingerprint as its malicious cousins.

The dependent claims spell out how the type-tags are decided, and it is a rules-and-regex engine. A representative token “comprises at least one of a tag indicating the type… and the abstracted representation” of a substring (claim 3); the tag is determined “based, at least in part, on evaluating the first substring against at least a first rule” (claim 4); and that rule “comprises an indication of the tag and a regular expression,” so tagging means “determining that the regular expression matches the first substring” (claim 5). The abstracted representation, per claim 6, encodes “a length of the first substring or a type of a character included in the first substring” — capturing how long and how random a segment is without recording its literal value. Matching, per claim 2, is a repository submission: the representative pattern is queried against “a repository of patterns” built from known-bad URLs. The whole detector is therefore explainable and tunable — an analyst can read the rules, add a regex, and understand exactly why a URL was flagged, which matters for a feature sold into enterprise change-control.

The specification also makes clear this is a two-phase system — a training/generation phase feeds a detection phase — and that the training is supervised by ground truth. In generation, URLs pulled from a repository are “already known to be malicious or benign,” each one “labeled” accordingly; once a URL is normalized, parsed, and tagged into a pattern, a “pattern filter” decides “whether to insert the pattern into the malicious pattern repository… or the benign pattern repository… based on filtering rules.” Maintaining both repositories is what controls false positives: a pattern that also appears among benign URLs can be filtered out before it ever causes a block, so the system is not just learning what malicious looks like but what to ignore because legitimate sites share the shape. At detection time, the same normalize-parse-tag pipeline runs on the unknown URL and its pattern is queried against the malicious repository. Because the abstraction throws away the specifics — the exact random string, the exact host — one stored pattern can cover an effectively unlimited family of generated domains, which is the structural reason this scales against attackers who spin up domains faster than any human can catalog them.

Why this is a business story: URL filtering is a core attach to Palo Alto's firewalls and to its Prisma cloud-security suite, sold as a recurring subscription. Pattern-based detection — with its gibberish-token catch for algorithmically generated domains and partial-match logic — is the feature that lets the vendor claim coverage of zero-hour phishing, the links no blocklist has seen. That claim is what differentiates a premium secure-web-gateway from a cheap DNS filter, and it is structural rather than data-bound: the value travels with the abstraction method, not with how recently a feed was updated.

The grounded read: pattern-based URL detection normalizes, parses, and type-tags a URL into an abstract fingerprint — replacing random or specific substrings with tokens like #gibberish# — then matches that pattern, even partially, against patterns from known-bad URLs, catching never-seen domains. Palo Alto's 2022 grant names that tokenize-and-match approach in step-by-step detail — the engine behind catching zero-hour phishing links as a subscription feature.