Intermediate Representation Classifier for Unseen Malicious Websites
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious websites face challenges due to the vast variability and complexity of web page content, particularly in JavaScript, leading to inefficiencies and low accuracy in identifying unseen URLs, and the impracticality of collecting extensive data to cover new threats.
Innovation Solution
The use of intermediate representations, such as JavaScript bytecode, reduces variability by converting human-readable JavaScript into machine-independent bytecode, which is then analyzed using machine learning models like convolutional neural networks to classify websites as malicious or benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard approaches (blacklisting, URL content analysis) are used, then detection process is simple, but detection accuracy on unseen URLs is low
Solution Approach 1:
The patent introduces an intermediary representation layer (intermediate representation) between the raw webpage content and the machine learning model. This intermediate representation is generated by analyzing JavaScript code and converting it into a standardized format that captures essential malicious patterns while filtering out irrelevant variations. This intermediary layer enables the system to achieve high accuracy on unseen URLs without requiring complex direct analysis of raw webpage content.
2Measurement precision
If webpage content analysis is performed to improve detection accuracy, then detection capability improves, but data complexity and processing difficulty increase
Solution Approach 1:
The patent extracts only the relevant portions of JavaScript code that are likely to contain malicious patterns, while filtering out irrelevant variations and redundant information. By taking out only the essential features from the complex webpage content, the system reduces data complexity while maintaining detection capability. This extraction process transforms the overwhelming complexity of full webpage analysis into a manageable analysis of key code patterns.
3Adaptability or versatility
If massive amounts of data are collected to cover all variations, then detection coverage improves, but data collection scope and effort become unfeasible
Solution Approach 1:
The patent changes the representation parameters of JavaScript code from raw human-readable form to an intermediate representation format. This parameter transformation consolidates numerous variations of malicious code into a smaller set of representative patterns. By changing how the data is represented rather than collecting more raw data, the system achieves comprehensive detection coverage with manageable data quantities.
Data Source
AI summary
Websites are classified based on intermediate representations of the associated source code using a machine learning model applied to a set of intermediate representations from websites having predetermined classifications. The use of intermediate representations can provide a machine independent classifier that does not required use of lists of websites known to be malicious. The intermediate representation-based classifier can be combined with URL and HTML based classifiers, including classifiers that incorporate URLs that are both statically and dynamically linked.