Accomplice Model for Web Page Malicious Source Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to detect the sources of malicious behavior in web pages, often identifying the final state of a web page as malicious while missing the true source of the behavior, which can be a different web page used during rendering.
Innovation Solution
The accomplice model is used to detect malicious behavior by identifying recurring attributes in blacklist sequences generated during web crawls. These attributes, such as host systems, domains, or elements of documents, are scored based on their reoccurrence and association with malicious behavior, allowing for the identification of malicious URIs and their sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web page analysis identifies the final state of a web page as malicious, then the detection of malicious behavior is simplified, but the source of malicious behavior cannot be identified
Solution Approach 1:
The patent segments the web page rendering process into multiple components (main page, embedded pages, scripts, resources) and tracks each component's contribution to malicious behavior. This allows the system to identify not only the final malicious state but also the specific sources (embedded pages, scripts, or resources) that caused the malicious behavior, resolving the contradiction between detection simplicity and source identification accuracy.
Solution Approach 2:
The patent introduces an intermediary analysis layer that examines the relationships between different web page components. By analyzing how embedded pages, scripts, and resources interact with the main page, the system can trace the source of malicious behavior while maintaining a comprehensive view of the rendering process, thus identifying both the final malicious state and its origins.
2Measurement precision
If multiple web crawls are performed to generate blacklist sequences, then the identification of recurring malicious attributes is improved, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary actions by pre-processing web crawl data to extract and normalize attributes (hostnames, domains, URLs) before conducting the actual analysis. By preparing the data structure in advance and pre-identifying potential malicious patterns, the system reduces the time required for subsequent analysis while maintaining accurate detection of recurring attributes across multiple blacklist sequences.
Solution Approach 2:
The patent creates a simplified representation (copy) of the web crawl data in the form of standardized attribute records. This copied data structure allows for efficient comparison and analysis of recurring patterns across multiple blacklist sequences without re-processing the entire raw crawl data, thus reducing analysis time while maintaining detection precision.
3Reliability
If attributes are scored based on reoccurrence in blacklist sequences, then the likelihood of false positives is reduced, but the complexity of the scoring system increases
Solution Approach 1:
The patent applies parameter changes by transforming the scoring mechanism into a straightforward reoccurrence count and frequency calculation. Instead of using complex machine learning models or multiple weighting factors, the system scores attributes based on simple parameters: the number of times an attribute appears in blacklist sequences and the proportion of times it appears compared to total attributes. This simplifies the scoring system while maintaining high reliability by using statistical significance to filter false positives.
Data Source
AI summary
The present disclosure generally relates to web page analysis, and more particularly to detecting malicious behavior using an accomplice model. In certain embodiments, the accomplice model may determine that a URI is associated with malicious behavior based upon the URI being associated with an attribute determined to be related to malicious behavior. Examples of an attribute include a host system, a domain, or an element of a document used to render the web page. Examples of an element of a document used to render the web page may include an active/dynamic element (e.g., a function, a script, etc.) or an inactive/static element (e.g., a string, a number, a frame, a tracking username, a social networking username, etc.).