HTML Malware Detection via Client-Side Code Module Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and address HTML-modifying malware, which can illicitly modify web pages, compromising user sessions and facilitating malicious activities such as fraud and identity theft.
Innovation Solution
A server-based system that transmits a code module to client devices to collect and analyze web page data, comparing it to patterns associated with non-modified, malicious, and innocuous states to generate a risk factor and identify potential malware modifications, while creating forensic snapshots of modified pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current systems are used to detect malware modifications, then system simplicity is maintained, but detection capability and reliability are insufficient
Solution Approach 1:
The system segments the web page into multiple elements and analyzes each element's HTML code separately. The malware detection module divides the web page content into discrete elements, extracts their HTML codes, and compares them against a database of known malware patterns. This segmentation approach enhances detection capability by examining individual elements while maintaining manageable system complexity through modular processing.
Solution Approach 2:
The system introduces an intermediary malware detection module that acts as a mediator between the web server and the user's browser. This module intercepts HTML code, performs malware pattern matching, and communicates detection results without requiring fundamental changes to existing web infrastructure. The intermediary approach improves reliability by adding a specialized detection layer while avoiding the complexity of rewriting core web protocols.
2Measurement precision
If comprehensive web page analysis is performed to detect all malware modifications, then detection accuracy is improved, but processing time and loss of time increase
Solution Approach 1:
The system performs preliminary actions by pre-processing and storing HTML codes of known malware elements in a database before actual web page analysis occurs. When a web page is analyzed, the system quickly compares extracted element codes against this pre-prepared database rather than performing complex analysis in real-time. This preliminary preparation maintains high detection accuracy while significantly reducing processing time during actual malware detection operations.
Solution Approach 2:
The system applies partial action by focusing analysis only on specific web page elements that are likely to contain malware, rather than analyzing every single element uniformly. The malware detection module identifies and prioritizes analysis of elements such as forms, input fields, and script tags where malware commonly hides. This selective approach maintains detection accuracy for critical elements while reducing overall processing time by avoiding exhaustive analysis of all page content.
3Loss of information
If forensic snapshots of modified pages are created, then forensic capability and information retention are improved, but device complexity and storage requirements increase
Solution Approach 1:
The system creates simplified copies of modified web pages by capturing and storing snapshots of the HTML code and element structures when malware modifications are detected. These copies preserve the essential forensic information about the malware-infected state without requiring storage of complete page renditions or multiple format versions. The copying approach maintains information retention for forensic analysis while keeping storage requirements manageable through selective and efficient duplication of critical data.
4Productivity
If remote detection code is transmitted to client devices, then detection coverage and productivity are improved, but network bandwidth consumption and use of energy increase
Solution Approach 1:
The system extracts and transmits only the essential malware detection code and patterns to client devices, rather than transmitting complete analysis engines or redundant data. The remote detection code is streamlined to perform specific extraction and comparison functions, sending minimal necessary information over the network. This extraction approach improves detection coverage by enabling client-side analysis while reducing network bandwidth consumption by transmitting only essential detection components.
Data Source
AI summary
Techniques to remotely detect behavior associated with malware and identify compromised user-sessions, regardless of the malware variant or family, and independently of the page structure.