Machine-Learning HTML Content Analysis for Malicious Webpage Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious HTML webpages are inadequate in distinguishing between legitimate and malicious content, often requiring human labor and are inefficient, especially when malicious functionality is embedded without visible assets, and existing preventative measures like sandboxing are slow and resource-intensive.
Innovation Solution
Perform HyperText Markup Language Content Analysis (HCA) to generate a feature vector schema for HTML webpages, training a content analysis model to identify potentially malicious webpages by analyzing asset patterns, and outputting risk indicators for automated cybersecurity actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional detection methods (sandboxing, visual inspection) are used to detect malicious HTML webpages, then detection capability is provided, but the process requires skilled human labor and is slow and resource-intensive
Solution Approach 1:
The patent replaces manual mechanical inspection processes with automated machine learning models. The system uses trained ML models to analyze HTML source code, assets, and webpage characteristics automatically, eliminating the need for human cyberanalysts to manually inspect each webpage while maintaining high detection accuracy.
Solution Approach 2:
The system enables self-service detection where the automated ML-based analysis performs detection without requiring human expertise. The model independently evaluates HTML webpages by analyzing their source code, embedded assets, and structural characteristics, providing autonomous threat detection capability.
2Object-affected harmful factors
If sandboxing is used as a preventative measure to analyze potentially malicious webpages, then secure examination is enabled, but the process is limited by the speed and resources of human cyberanalysts
Solution Approach 1:
The system performs preliminary automated analysis of HTML webpages before they reach human analysts. The ML model pre-evaluates webpages by examining their source code, assets, and characteristics, preparing risk assessments in advance so that human reviewers only need to handle cases that require their expertise, significantly reducing overall response time.
Solution Approach 2:
The patent replaces the manual sandboxing and inspection process with automated ML-based analysis that can process multiple webpages simultaneously without human intervention, eliminating the bottleneck of human analyst speed and resource limitations while maintaining secure examination capabilities.
3Object-affected harmful factors
If conventional methods block access to potentially malicious webpages, then user protection is provided, but false positives may occur when malicious functionality is embedded without visible malicious assets
Solution Approach 1:
The system performs partial analysis by focusing on specific indicators such as embedded assets, source code patterns, and webpage characteristics rather than requiring complete manual inspection. The ML model evaluates multiple partial features (assets, code structure, metadata) to make accurate detection decisions, reducing false positives while maintaining user protection.
Solution Approach 2:
The patent changes the detection parameters from relying on visible malicious assets to analyzing multiple subtle characteristics including asset embedding patterns, source code structures, and webpage metadata. The ML model processes these transformed parameters to improve detection accuracy and reduce false positives caused by embedded malicious functionality without visible assets.
Data Source
AI summary
HyperText Markup Language (HTML) content analysis (HCA) using machine learning is described. A feature vector schema may be generated based on domain names corresponding to HTML webpages and corresponding indications of a status of the HTML webpage. The schema may map each position in a feature vector of a given HTML webpage to a resource identifier. Information may be processed using the schema to generate respective feature vectors. The feature vectors may be used to train a model to generate risk indicators for HTML webpages. A potentially parked domain webpage or a potentially malicious domain webpage may be received. A feature vector for the webpage may be generated and inputted to the model. The model may generate a risk indicator for the webpage. The risk indicator may be output and may cause responsive actions. The model may be updated based on a determination indicating whether the webpage was a parked domain webpage or a malicious domain webpage.