Exploit Kit Detection via Grayscale Image Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing exploit kit detection methods face challenges in efficiently identifying malicious code, especially when it is obfuscated, and require extensive feature extraction and analysis, leading to performance issues and low detection rates, particularly when dealing with numerous variants of exploit kits.
Innovation Solution
An exploit kit detection system based on a neural network that converts web files into grayscale images and uses size-specific convolutional neural network (CNN) classification models to classify maliciousness without relying on behavior information or pattern rules, enhancing detection rates and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern-based detection or text/script machine learning techniques are used to detect exploit kits, then detection capability is provided, but detection rate is low when exploit kits are obfuscated and extensive feature extraction is required
Solution Approach 1:
The patent replaces traditional text/script-based analysis mechanisms with an image-based deep learning mechanism. Web files are converted to grayscale images and analyzed using convolutional neural networks, substituting the mechanical feature extraction and pattern matching processes with automated image recognition, thereby reducing detection complexity while maintaining or improving detection rate
Solution Approach 2:
The patent changes the representation parameter of web files from text/script format to image format. By converting web files to grayscale images and analyzing visual patterns instead of text patterns, the system achieves better detection of obfuscated exploit kits without requiring extensive feature extraction
2Measurement precision
If static analysis and dynamic analysis methods are used together to detect exploit kits, then detection capability is improved, but detection time increases significantly
Solution Approach 1:
The patent replaces time-consuming static analysis and dynamic analysis processes with rapid image-based deep learning analysis. By converting web files to images and using pre-trained convolutional neural networks, the system achieves accurate detection without the extensive processing time required by traditional multi-method approaches
Solution Approach 2:
The patent performs preliminary conversion of web files to grayscale images and pre-trains classification models on diverse exploit kit variants. This preliminary preparation enables rapid detection during actual operation, reducing detection time while maintaining high accuracy without requiring extensive feature extraction or multiple analysis passes
3Productivity
If convolutional neural network is applied after extracting only operation codes, then processing speed is improved, but detection rate is limited
Solution Approach 1:
The patent changes the input parameter from extracted operation codes to complete grayscale images of web files. By using the full visual representation of the file content converted to image format, the system achieves both high processing speed through efficient image processing and high detection rate through comprehensive pattern recognition
Solution Approach 2:
The patent transitions from one-dimensional operation code sequences to two-dimensional grayscale image representations. This dimensional change enables the application of powerful 2D convolutional neural network techniques that can simultaneously achieve fast processing and high detection accuracy by recognizing spatial patterns in the visual representation of web files
Data Source
AI summary
The present invention relates to an exploit kit detection system based on a neural network using an image and provides a configuration including: a file collection module for collecting a web file created in a web document code and a script code; a distribution module for distributing and storing the collected web file; a management module for assigning, when the web file is received, a job ID to the web file and registering the web file in an inspection target list; an image conversion module for converting a corresponding web file into grayscale, targeting the web file registered in the inspection target list; a classification model, as a classification model based on the neural network, for receiving an image of grayscale and classifying existence and a type of the exploit kit (EK); and a result processing module for receiving a classification result, creating a result data, and transmitting the result data to the distribution module.According to the system as described above, as maliciousness of an image is determined by analyzing the image, an environment of detecting an exploit kit through only one conversion process is provided, and thus a fast performance can be demonstrated, and the system may be used for easy filtering of a malicious file from large-scale web page files.