Access Classification Device for Malicious Website Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for identifying malicious websites struggle to detect websites from which attack code cannot be obtained due to concealment by attackers, resulting in low detection accuracy and failure to include such sites in blacklists, allowing users to access potentially harmful websites.
Innovation Solution
An access classification device that constructs trees with nodes representing destinations and adds content information, associates nodes based on similarity, and calculates similarity between trees to classify accesses into sets with similar features, enabling accurate detection of malicious websites even when attack code is concealed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional content analysis methods are used to identify malicious websites, then detection can be performed on websites with obtainable attack code, but detection accuracy drops significantly for websites with concealed or unobtainable attack code
Solution Approach 1:
The patent segments the website analysis into multiple independent components: HTML structure analysis, JavaScript analysis, URL analysis, and redirection pattern analysis. Each component is analyzed separately to extract features, allowing the system to detect malicious websites through multiple pathways rather than relying solely on obtainable attack code.
Solution Approach 2:
The patent transitions from analyzing only the content dimension (attack code) to analyzing multiple dimensions including structural dimensions (HTML tree structure), behavioral dimensions (redirection patterns), and relational dimensions (connections between pages). This multi-dimensional approach enables detection of concealed malicious websites through their structural and behavioral characteristics rather than relying on code content.
2Adaptability or versatility
If multiple analysis methods are combined to improve detection coverage, then both obtainable and unobobtainable malicious sites can be detected, but the system complexity increases
Solution Approach 1:
The patent creates a universal analysis framework that handles multiple types of malicious websites through a single integrated system. The feature extraction module universally processes HTML, JavaScript, URL, and redirection data using the same tree-structure-based approach, while the classification module universally applies machine learning models to detect various malicious patterns, reducing the need for separate specialized systems.
Solution Approach 2:
The patent introduces an intermediary feature extraction layer that translates diverse website characteristics (HTML structure, JavaScript behavior, URL patterns, redirection sequences) into a unified feature representation. This intermediary layer simplifies the complexity by providing a standardized interface between the multi-dimensional analysis and the classification algorithms, making the overall system more manageable.
3Measurement precision
If tree structure analysis with node association is used to detect concealed malicious websites, then detection accuracy for unobtainable code sites improves, but computational requirements increase
Solution Approach 1:
The patent extracts only the essential and discriminatory features from website data for tree construction and analysis. Instead of processing complete website content, the system extracts key structural elements (HTML tags, JavaScript functions, URL components, redirection nodes) and builds compact trees representing only the critical pathways. This extraction approach reduces computational power requirements while maintaining high detection accuracy for concealed malicious websites.
Data Source
AI summary
An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.