Browser Emulator Graph Analysis for Drive-by Download Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting website compromise in drive-by download attacks struggle to specify the content and script involved in the attack, particularly when the landing URL is a compromised website, and are limited to managed web servers.
Innovation Solution
An analysis apparatus that accesses websites using a browser, records transfer information including source and destination URLs, script functions, and identification information, and constructs a directed graph to trace the transfer of content and scripts between websites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection methods are used to detect malicious URLs, then the malicious URL can be detected, but the content and script involved in the attack cannot be specified
Solution Approach 1:
The patent segments the website into multiple components including HTML content, scripts, and resources. By analyzing each component separately and tracking their relationships, the system can identify which specific content and script files are involved in the attack, rather than treating the entire website as a single unit.
Solution Approach 2:
The patent introduces an intermediary analysis mechanism that captures and analyzes the relationships between website components. This intermediary layer tracks how scripts interact with HTML content and resources, enabling precise identification of attack vectors without losing information about the underlying mechanisms.
2Reliability
If content comparison method is used to detect website compromise, then compromise can be detected, but it requires content before compromise and is limited to managed web servers
Solution Approach 1:
Instead of comparing current content with historical content to detect changes, the patent inverts the approach by analyzing the website's structure and relationships to identify suspicious patterns that indicate compromise. This allows detection without requiring prior content or access to server management systems.
Solution Approach 2:
The patent creates a universal detection mechanism that can analyze any website regardless of whether it is managed or unmanaged. The system focuses on analyzing observable relationships between website components rather than relying on server-specific information or historical data, making it applicable across different server types.
3Productivity
If link structure tracing method is used to search for malicious websites, then malicious URLs can be efficiently searched, but the attack path and involved scripts cannot be identified
Solution Approach 1:
The patent employs a nested analysis structure where the overall website structure is analyzed first, then progressively dives into specific components such as scripts and resources. This nested approach maintains the efficiency of high-level structural analysis while capturing detailed information about attack paths and involved scripts at deeper levels.
Data Source
AI summary
A browser emulator manager causes a browser emulator(s) to access a website. The browser emulator traces content interpretation and script execution on a browser that have occurred by access to the website. When detecting transfer, the browser emulator records, in transfer information, a transfer method, a transfer source URL, and a transfer destination URL thereof. When detecting the script execution, the browser emulator records, in the transfer information, an execution method and an execution source script thereof. A graph construction unit constructs a directed graph on the basis of the transfer information. Thereafter, a graph analysis unit specifies places of content and a script causing the transfer by tracing the directed graph.