1. A computer implemented method for expediting maliciousness analysis using focused crawling to reorder breadth first crawling when analyzing pages for maliciousness, the reordering based on fast classifications involving just page URLs (Universal Resource Locators), the method comprising:
during a first pass of analyzing pages for maliciousness, at least one computer system:
ordering a set of URL pages to analyze for maliciousness using a breadth first ordering which is based on proximity in a page level to a root level URL page;
during a second pass of analyzing pages for maliciousness, the at least one computer system:
training a Bayesian classifier with known malicious URLs and known benign URLs;
classifying just a URL of each page, without examining the content, with a Bayesian classifier of conditional probabilities based on the training, wherein maliciousness of each page is unknown;
assigning a maliciousness probability for each page based on the Bayesian classification of just the URL of each page;
receiving a number of pages to represent the degree that focused crawling modifies breadth first ordering, the number of pages being a subset of the number of the set of URL pages being analyzed; and
adjusting the ordering of breadth first with focused crawling to account for malicious probability according to the degree defined by the received number of pages,
wherein the content of each pages is scanned according to the adjusted ordering in order to analyze the content for maliciousness.
2. The method of claim 1, further comprising:
traversing, by the at least one computer, each specific page of the set, in the adjusted ordering; and
analyzing, by the at least one computer, each specific page of the set as the specific page is traversed, to determine whether the specific analyzed page is malicious.
3. The method of claim 1, further comprising:
training, by the at least one computer, a Bayesian classifier to perform the Bayesian classification on a set of URLs known to correspond to actual malicious pages and a set of URLs known to correspond to actual benign pages.
4. The method of claim 1, further comprising:
determining, by the at least one computer, that at least one specific page of the set is malicious; and
in response to determining that the at least one specific page of the set is malicious, transmitting an alert concerning the at least one specific page to a central security server.
5. The method of claim 1, further comprising:
determining, by the at least one computer, that at least one specific page of the set is benign.
6. The computer system of claim 1, wherein modifying traversal priorities of the subset comprises said modifying being responsive to malicious probabilities only of Uniform Resource Locators without analyzing content of pages, and further comprising:
analyzing, by the at least one computer, each specific page of the set as the specific page is traversed, to determine whether the specific analyzed page is malicious responsive to content of pages.
7. At least one non-transitory computer readable storage medium storing a computer program product having software code to cause a processor to perform a method for expediting maliciousness analysis using focused crawling to reorder breadth first crawling when analyzing pages for maliciousness, the reordering based on fast classifications involving just page URLs (Universal Resource Locators), the computer program product comprising:
during a first pass of analyzing pages for maliciousness, at least one computer system:
ordering a set of URL pages to analyze for maliciousness using a breadth first ordering which is based on proximity in a page level to a root level URL page;
during a second pass of analyzing pages for maliciousness, the at least one computer system:
training a Bayesian classifier with known malicious URLs and known benign URLs;
classifying just a URL of each page, without examining the content, with a Bayesian classifier of conditional probabilities based on the training, wherein maliciousness of each page is unknown;
assigning a maliciousness probability for each page based on the Bayesian classification of just the URL of each page;
receiving a number of pages to represent the degree that focused crawling modifies breadth first ordering, the number of pages being a subset of the number of the set of URL pages being analyzed; and
adjusting the ordering of breadth first with focused crawling to account for malicious probability according to the degree defined by the received number of pages,
wherein the content of each pages is scanned according to the adjusted ordering in order to analyze the content for maliciousness.
8. The computer program product of claim 7, further comprising:
program code for traversing each specific page of the set, in the adjusted ordering; and
program code for analyzing each specific page of the set as the specific page is traversed, to determine whether the specific analyzed page is malicious.
9. The computer program product of claim 7, further comprising:
program code for training a Bayesian classifier on a set of Uniform Resource Locators known to correspond to actual malicious pages and a set of Uniform Resource Locators known to correspond to actual benign pages.
10. The computer program product of claim 7, further comprising:
program code for determining that at least one specific page of the set is malicious; and
program code for, in response to determining that the at least one specific page of the set is malicious, transmitting an alert concerning the at least one specific page to a central security server.
11. A computer system to expedite maliciousness analysis using focused crawling to reorder breadth first crawling when analyzing pages for maliciousness, the reordering based on fast classifications involving just page URLs (Universal Resource Locators), the device comprising:
during a first pass of analyzing pages for maliciousness:
a traversal ordering module to order a set of URL pages to analyze for maliciousness using a breadth first ordering which is based on proximity in a page level to a root level URL page;
during a second pass of analyzing pages for maliciousness:
a Bayesian classifying module to train a Bayesian classifier with known malicious URLs and known benign URLs, the Bayesian classifying module to classify just a URL of each page, without examining the content, with a Bayesian classifier of conditional probabilities based on the training, wherein maliciousness of each page is unknown, the Bayesian classifying module to assigning a maliciousness probability for each page based on the Bayesian classification of just the URL of each page;
and
a traversal order modifying module to receive a number of pages to represent the degree that focused crawling modifies breadth first ordering, the number of pages being a subset of the number of the set of URL pages being analyzed, the traversal order modifying module to adjust the ordering of breadth first with focused crawling to account for malicious probability according to the degree defined by the received number of pages,
wherein the content of each pages is scanned according to the adjusted ordering in order to analyze the content for maliciousness.
12. The computer system of claim 11, further comprising:
means for traversing each specific page of the set, in the adjusted ordering; and
means for analyzing each specific page of the set as the specific page is traversed, to determine whether the specific analyzed page is malicious.
13. The computer system of claim 11, further comprising:
means for performing, for each specific page of the set, a Bayesian classification of the URL associated with the specific page.
14. The computer system of claim 11, further comprising:
means for training a Bayesian classifier on a set of Uniform Resource Locators known to correspond to actual malicious pages and a set of URLs known to correspond to actual benign pages.
15. The computer system of claim 11, further comprising:
means for determining that at least one specific page of the set is malicious; and
means for, in response to determining that the at least one specific page of the set is malicious, transmitting an alert concerning the at least one specific page to a central security server.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A device for triggering a vehicle occupant protection device of a motor vehicle, the device comprising:
a plurality of sensors disposed at a first location within the motor vehicle and provide at the first location a plurality of signals including an item of information on an emergency situation of the motor vehicle;
a first and a second transmission link for transmitting the plurality of signals from the first location to a second location within the motor vehicle, said first and second transmission links disposed such that both said first and second transmission links transmit at least a first signal of said plurality of signals from the first location to the second location; and
an evaluation device disposed at the second location and having a first evaluation apparatus, a second evaluation apparatus and an output device, said evaluation device constructed such that signals associated with a respective one of said sensors are supplied to said first evaluation apparatus and the first signal is supplied to the second evaluation apparatus, said first evaluation apparatus evaluates the signals supplied thereto for an existence of the emergency situation of the motor vehicle and passes on a corresponding first item of information to said output device, and the second evaluation apparatus evaluates the first signal supplied thereto for the existence of the emergency situation of the motor vehicle and passes on a corresponding second item of information to said output device, said output device only emits a second signal, for activating the vehicle occupant protection device of the motor vehicle, as an output signal of said evaluation device if both the first and the second items of information correspond to the emergency situation;
the first location being different from and spaced away from the second location;
wherein said first transmission link transmits only a first portion of said plurality of signals to said evaluation device; and
wherein said second transmission link transmits only a second portion of said plurality of signals, different from said first portion of said plurality of signals, to said evaluation device.
2. The device according to claim 1, further comprising first and second read devices disposed at the first location, said first read device reading said sensors associated with said first portion of said plurality of signals and said second read device reading said sensors associated with said second portion of said plurality of signals.
3. The device according to claim 2, wherein said first read device and said second read device read said sensor associated with the first signal.
4. The device according to claim 1, wherein only the first signal is supplied to said second evaluation apparatus.
5. The device according to claim 4, wherein said first signal is transmitted to said evaluation device over both of said first and second transmission links, and said second evaluation apparatus is supplied with both said first signal coming from said first transmission link and coming from said second transmission link.
6. A method for triggering a vehicle occupant protection device of a motor vehicle, which comprises the steps of:
providing a plurality of signals, coming from a plurality of sensors, at a first location at which the plurality of sensors is disposed within the motor vehicle, the plurality of signals including an item of information on an emergency situation of the motor vehicle;
transmitting the plurality of signals over a first and a second transmission link to an evaluation device disposed at a second location within the motor vehicle and the evaluation device including a first and a second evaluation apparatus, at least a first signal of the plurality of signals being transmitted to the evaluation device over both the first and second transmission links, wherein the first location is different from and spaced away from the second location;
supplying the signals associated with a respective one of the sensors to the first evaluation apparatus, and supplying the first signal to the second evaluation apparatus;
evaluating the signals supplied to the first evaluation apparatus using the first evaluation apparatus and evaluating the first signal using the second evaluation apparatus; and
emitting a second signal, for activating the vehicle occupant protection device of the motor vehicle, as an output signal of the evaluation device if both an evaluation made by the first evaluation apparatus and an evaluation made by the second evaluation apparatus give a result that the motor vehicle is in the emergency situation;
transmitting a first portion of the plurality of signals to the evaluation device only over the first transmission link; and
transmitting a second portion, different from the first portion, of the plurality of signals to the evaluation device only over the second transmission link.
7. The method according to claim 6, which further comprises using a first read device, disposed at the first location, to read the sensors associated with the first portion of the signals and a second read device, disposed at the first location, to read the sensors associated with the second portion of the signals.
8. The method according to claim 7, which further comprises using both the first read device and the second read device to read the sensor associated with the first signal.
9. The method according to claim 6, which further comprises supplying only the first signal to the second evaluation apparatus.
10. The method according to claim 6, which further comprises transmitting the first signal to the evaluation device over both the first and second transmission links, and the second evaluation apparatus is supplied with both the first signal coming from the first transmission link and coming from the second transmission link.