HTML Markup Image Compression for Anomalous Website Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious websites are inadequate, as they rely on signature-based detection that can be evaded by sophisticated cybercriminals, and manual inspection is inefficient, allowing malicious activities to go undetected for a long time, impacting many users.
Innovation Solution
A system and method that compresses markup language data from websites into 3D color cubes, generating images which are then processed using an autoencoder to create a normalcy model, allowing for unsupervised detection of anomalous websites without requiring labeled training data or signature-based methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malicious websites, then known threats can be detected, but sophisticated zero-day attacks and obfuscated malware can evade detection
Solution Approach 1:
The patent transforms the detection approach by changing the parameters from signature matching to structural analysis. It converts HTML markup language into image representations and applies deep learning models to detect anomalies in website structure, enabling detection of zero-day attacks without relying on known signatures
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an automated deep learning-based image analysis system. The system automatically converts HTML to images and uses trained neural networks to detect malicious patterns, eliminating the need for manual signature updates
2Measurement precision
If manual inspection techniques are used to detect compromised websites, then detailed analysis can be performed, but the process is slow and inefficient given the volume of websites
Solution Approach 1:
The patent creates visual copies (images) of HTML markup language structures, allowing automated visual inspection methods to be applied. This copying approach enables rapid parallel processing of multiple websites while maintaining the ability to perform detailed structural analysis
Solution Approach 2:
The system employs unsupervised deep learning models that automatically learn normal website patterns and detect anomalies without requiring manual labeling or intervention. The model self-trains on unlabeled data and autonomously identifies suspicious websites, eliminating the need for manual inspection
3Reliability
If supervised learning models are trained with labeled malicious websites to detect anomalies, then detection accuracy can be improved, but obtaining sufficient labeled training samples is difficult and time-consuming
Solution Approach 1:
The patent inverts the traditional supervised learning approach by using unsupervised learning. Instead of training with labeled malicious examples, the system learns normal website patterns from unlabeled data and detects deviations, eliminating the need for extensive labeled training datasets
Solution Approach 2:
The unsupervised deep learning model performs self-training by automatically identifying patterns in unlabeled website data. The system autonomously learns what constitutes normal website structure and detects anomalies without human intervention or labeled examples
Data Source
AI summary
Systems and methods for detecting anomalous and malicious URL's by analyzing markup language structure, such as HTML, are provided. The systems and methods include the querying of a URL to obtain the markup language data. The markup language data their corresponding elements and their locations rows/depths are parsed into coordinates within a 2-dimensional grid and then processed into features. A color is assigned to each feature as a function of the type of feature. The three dimensions (x, y coordinates and color coordinate) of the features are used to generate an image. The generated images are then compressed to facilitate processing. The compressed images of common websites are analyzed using deep machine learning algorithms to generate a model that represents their structure. These generated models are then used to detect suspicious and/or anomalous websites.