Browser Log-Based SE Attack Detection Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining social engineering (SE) attacks are limited by their reliance on features specific to particular attack types and often result in erroneous detections due to the lack of consideration for browser operations and events leading up to the target web page.
Innovation Solution
A system that uses log information from web browser interactions to generate a training model, incorporating feature amounts from web pages, browser operations, and events, allowing for accurate determination of SE attacks without type restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing methods use features specific to particular attack types for determination, then determination can be performed for specific attack types, but the determination target attack type is limited and cannot cover all SE attack types
Solution Approach 1:
The patent creates a universal determination method that works across all SE attack types by using general browser operation logs and event sequences rather than attack-type-specific features. The training model learns patterns from diverse attack scenarios (technical support scams, survey scams, prize scams, etc.) and applies them universally to determine malicious web pages regardless of specific attack type.
2Measurement precision
If existing methods use only information from a single target web page, then determination processing is simple, but erroneous detections occur because information on web pages accessed before and browser operations are not considered
Solution Approach 1:
The patent performs preliminary crawling of web pages and collection of browser operation logs before the actual determination process. By pre-gathering information about visited web pages, browser operations, and event sequences, the system builds a comprehensive context that improves determination accuracy while separating the data collection phase from the analysis phase.
Solution Approach 2:
The patent adds temporal and contextual dimensions to the determination process by incorporating browser operation sequences and event histories. Instead of analyzing only the static content of a single target web page, the system examines the dynamic sequence of browser operations and visited pages, creating a multi-dimensional view that reduces erroneous detections.
3Reliability
If comprehensive log information including browser operations and events is used, then erroneous detections are reduced, but the amount of data to be processed increases
Solution Approach 1:
The patent extracts only the essential and useful information from comprehensive browser logs and event data for the determination process. By selectively extracting relevant features and event sequences that are actually indicative of SE attacks, the system maintains high determination reliability while avoiding the processing overhead of analyzing all raw log data.
Solution Approach 2:
The patent transforms raw browser operation logs and event data into structured feature representations suitable for machine learning processing. By changing the parameters from raw logs to extracted features (such as operation sequences, event types, and contextual patterns), the system enables efficient processing of comprehensive information while maintaining determination reliability.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
A learning device (10) uses a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached. The learning device (10) then generates a training model using, as training data, any one or more feature amounts among a feature amount of each web page included in the log information, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page.