HTTP Session Tree Structural Similarity for Web Exploit Kit Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting web-based exploit kits face challenges such as high false positives and negatives, resource-intensive web crawling, and the agility of exploit kits that makes them difficult to detect using conventional blacklisting and signature-based approaches.
Innovation Solution
A tree-based structural similarity search approach that leverages the underlying structure of HTTP traffic to classify exploit kit instances, using a small training set and modeling each node in the subtree as a point in a high-dimensional feature space, allowing for efficient detection of agile exploit kits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature-based or blacklist-based approaches are used to detect exploit kits, then detection can be performed with simple patterns, but false positives and false negatives increase significantly
Solution Approach 1:
The patent transforms the detection problem from analyzing individual HTTP requests to analyzing the entire HTTP session as a tree structure. By adding the dimensional aspect of temporal and structural relationships between multiple requests, the system achieves higher detection accuracy without sacrificing simplicity, as the tree-based approach provides a systematic framework for analysis.
Solution Approach 2:
The patent performs preliminary classification by comparing the HTTP session tree against a trained classifier model before taking detection actions. This preliminary analysis of the complete session structure enables the system to accurately identify exploit kits while maintaining simple decision-making logic based on the classification result.
2Reliability
If web crawling is used to detect malicious content, then comprehensive coverage can be achieved, but resource consumption increases significantly
Solution Approach 1:
Instead of performing exhaustive web crawling to achieve complete coverage, the patent applies partial action by analyzing only the HTTP sessions that pass through the monitoring point. The tree-based structural analysis focuses computational resources on relevant traffic patterns, achieving effective detection coverage without the excessive resource consumption of comprehensive crawling.
Solution Approach 2:
The patent introduces an intermediary approach by using HTTP session trees as a intermediary representation between raw network traffic and detection results. This intermediary structure enables efficient analysis by capturing essential patterns without requiring full web crawling, thus reducing resource consumption while maintaining detection effectiveness.
3Extent of automation
If statistical machine learning techniques are used to classify web traffic, then automated classification can be performed, but false positive rates increase and large training sets are required
Solution Approach 1:
The patent changes the parameters used for classification from traditional statistical features to structural features of HTTP session trees. By transforming the input parameters to capture temporal and hierarchical relationships in traffic patterns, the system achieves automated classification with lower false positive rates and reduced training data requirements.
Solution Approach 2:
The patent adds structural and temporal dimensions to the classification parameters by representing HTTP sessions as trees. This dimensional transformation enables the classifier to capture complex patterns more effectively, reducing false positives while maintaining automation, as the tree structure inherently encodes sequential relationships.
4Adaptability or versatility
If exploit kits are made agile to move between servers, then evasion of blacklisting is achieved, but detection becomes more challenging
Solution Approach 1:
The patent extracts the essential behavioral patterns of exploit kits from their specific server locations by analyzing HTTP session structures. By taking out the detection logic from server-specific blacklisting and focusing on the invariant structural patterns of malicious sessions, the system can detect agile exploit kits regardless of which server they are currently operating from.
Data Source
AI summary
A method includes receiving, at an input port of a computer, indication of HTTP (Hypertext Transfer Protocol) traffic and clustering, using a processor on the computer, the HTTP traffic according to a client IP (Internet Protocol) into a web session tree. A client tree structure of the web session tree is generated and the client tree structure is compared with tree structures of exploit kit samples.