Web Page Frame Injection Detection via Tag-Level Feature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate in detecting frame injection threats in computer networks, as malicious frames can be hidden within web pages, making it difficult to distinguish between legitimate and malicious content, leading to potential malware delivery and compromised user devices.
Innovation Solution
A method involving web page analysis to identify and classify frame tags as malicious or benign by extracting style, destination, and context features, using machine learning models to predict maliciousness, and controlling access to web pages based on these classifications, thereby preventing frame injection attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current security measures are used to detect frame injection threats, then the detection process is simple, but the detection accuracy is low and malicious frames cannot be reliably identified
Solution Approach 1:
The patent segments the web page into individual frame tags and analyzes each frame tag separately. Instead of treating the entire web page as a single unit, the system parses the HTML to identify and extract individual iframe tags, then applies machine learning models to each frame tag independently. This segmentation enables precise identification of malicious frames within legitimate web pages by examining specific frame attributes such as src, width, height, and style characteristics.
Solution Approach 2:
The patent introduces machine learning models as intermediaries between the raw frame tag data and the security detection process. These models serve as mediators that analyze frame tag features and predict maliciousness, bridging the gap between simple pattern matching and complex security analysis. The machine learning models process frame tag attributes and provide probabilistic assessments of maliciousness, enabling more accurate detection while maintaining system manageability.
2Measurement precision
If frame injection detection is performed at domain or URL level, then the detection scope is broad, but the precision is insufficient to identify specific malicious frames within web pages
Solution Approach 1:
The system segments the detection process to operate at the frame tag level rather than the domain or URL level. By parsing web pages to identify individual iframe tags and analyzing their specific attributes (src, width, height, style), the system achieves precise identification of malicious frames. This granular approach allows the system to distinguish between legitimate and malicious frames within the same domain, overcoming the limitations of broader domain-level detection.
Solution Approach 2:
The patent replaces traditional mechanical rule-based detection methods with machine learning-based automated analysis. Instead of relying on predefined rules for detecting malicious frames, the system uses trained machine learning models that automatically analyze frame tag features and predict maliciousness. This substitution reduces the manual complexity of creating and maintaining detection rules while improving detection precision at the frame tag level.
3Reliability
If machine learning models are used to classify frame tags, then the detection accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by using machine learning models selectively for frame tag classification rather than analyzing every aspect of every web page in detail. The system extracts specific frame tag features (src, width, height, style) and applies machine learning models only to these extracted features. This partial analysis approach maintains high detection reliability while reducing overall processing time compared to comprehensive web page analysis.
Solution Approach 2:
The system performs preliminary actions by first parsing the web page to identify and extract frame tags and their attributes before applying machine learning models. This preliminary extraction and organization of frame tag features prepares the data in advance, enabling faster and more efficient machine learning inference. By pre-processing and structuring the frame tag data, the system reduces the computational burden during the actual classification phase.
Data Source
AI summary
A method includes obtaining a given web page, parsing the given web page to identify one or more frame tags for one or more inline frames of the given web page, and extracting a set of features of a given inline frame from a given one of the identified frame tags in the given web page, the extracted set of features comprising one or more style features, one or more destination features and one or more context features of the given identified frame tag. The method also includes classifying the given inline frame as one of a malicious frame type and a benign frame type utilizing at least one model and at least a portion of the extracted set of features, and controlling access by one or more client devices associated with an enterprise to the given web page responsive to classifying the given inline frame as the malicious frame type.