Invisible IFrame Malware Detection via HTML Modification Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are vulnerable to malware infections during online activities, leading to the theft of sensitive information due to the automatic installation of malicious software during web interactions, which existing technologies fail to effectively prevent.
Innovation Solution
A method and system that remotely detects HTML-modifying malware by using a server to serve original web pages, employing a scanning engine to identify changes, and involving a Participating Site, Client Machine, and Service Provider to analyze HTML for malware presence through an invisible IFrame and JavaScript, generating alerts or preventive actions if malware is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users browse web pages during online activities, then they can access Internet services and conduct daily activities electronically, but they become vulnerable to malware infections that automatically install during web interactions
Solution Approach 1:
The system performs preliminary detection by embedding invisible IFrames in HTML pages that automatically execute JavaScript code to detect malware presence before users can be compromised. The detection occurs proactively during normal browsing, preventing malware installation before it can execute harmful actions.
Solution Approach 2:
An intermediary detection system is introduced between the user's browser and potential malware threats. The invisible IFrame acts as a mediator that intercepts and analyzes web page content, using JavaScript to detect modifications indicative of malware presence without interfering with normal user browsing activities.
2Reliability
If malware detection tools are implemented to protect users from exploitation, then sensitive information can be protected, but the system complexity increases with multiple components including Participating Site, Client Machine, and Service Provider
Solution Approach 1:
The detection system is segmented into three distinct functional components: the Participating Site (PS) that hosts HTML pages with embedded IFrames, the Client Machine (CM) that executes the detection code in users' browsers, and the Service Provider (SP) that analyzes collected data. This segmentation allows each component to perform its specific function efficiently while maintaining overall system reliability.
Solution Approach 2:
The invisible IFrame serves multiple functions simultaneously: it acts as an undetectable carrier for JavaScript code, functions as a data collection mechanism, and serves as a communication channel between the client browser and the service provider. This multi-functionality reduces the need for separate components, simplifying the overall system architecture.
3Measurement precision
If a scanning engine detects changes in web page portions to identify malware, then malware presence can be identified in near real-time, but the detection process requires analyzing and comparing HTML content which increases processing requirements
Solution Approach 1:
The system extracts only the critical elements needed for malware detection by using JavaScript to collect specific HTML data through the invisible IFrame, rather than analyzing entire web pages. This extraction approach focuses processing resources on detecting modified form fields and parameters while ignoring irrelevant content, reducing overall processing requirements.
Solution Approach 2:
The detection system performs partial analysis by focusing only on specific portions of HTML content that are most likely to contain malware indicators, such as form fields and parameters. Rather than analyzing every element of a web page, the system targets high-risk areas, achieving effective malware detection with reduced processing overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for detecting HTML-modifying malware present in a computer, comprises: a) providing a server which serves a web page (HTML) to a browser; b) determining whether a modified string exists in the page received by said browser; and c) if a modifying element is found, determining the malware is present in the computer.