Malicious Web Resource Detection via Redirect Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for identifying malicious web resources face challenges in detecting fraudulent pages due to the use of redirection chains, which complicate blocking processes and allow attackers to evade detection by changing intermediate links in the chain.
Innovation Solution
A computer-implementable method and computing device that analyze redirect chains to identify templates commonly encountered with malicious web pages. This involves obtaining a given link referring to an initial malicious web resource, retrieving simulated user parameters and behavior vectors, determining redirect chains, generating a redirect graph, and analyzing it to determine user redirect rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis methods are used to analyze web pages and codes for malicious activity templates, then detection capability is improved, but device complexity increases due to multiple analysis stages and components
Solution Approach 1:
The system divides the detection process into two distinct stages: a first stage that performs static analysis of web page codes and structures to identify malicious activity templates, and a second stage that executes dynamic analysis by actually visiting the web resources. This segmentation allows each stage to specialize in specific detection techniques, improving overall detection capability while managing system complexity through modular design.
Solution Approach 2:
The system introduces an intermediary component that coordinates between the static analysis and dynamic analysis stages. This intermediary manages the transition of suspicious web resources from the first stage to the second stage, and facilitates the combination of results from both analyses to produce the final detection outcome, thereby managing system complexity through centralized coordination.
2Measurement precision
If dynamic analysis is performed by actually visiting suspicious web resources, then detection accuracy is improved, but loss of time increases due to the need to execute and monitor web resource behavior
Solution Approach 1:
The system performs preliminary static analysis in the first stage to identify malicious activity templates and assess suspicious web resources before executing dynamic analysis. This preliminary action filters out many benign resources that do not match known malicious patterns, allowing the time-consuming dynamic analysis to be applied only to the most suspicious cases, thereby reducing overall analysis time while maintaining high detection accuracy.
Solution Approach 2:
The system applies dynamic analysis selectively rather than universally - only to web resources that pass through the first stage and exhibit suspicious characteristics. This partial action approach avoids wasting time on obviously benign resources while ensuring thorough dynamic analysis is performed on potentially malicious ones, optimizing the balance between detection accuracy and time consumption.
3Measurement precision
If redirect chains are analyzed to identify malicious web resources, then detection capability is improved, but device complexity increases due to graph generation and rule analysis
Solution Approach 1:
The redirect chain analysis is segmented into distinct components: graph generation that constructs the redirect structure, rule analysis that identifies malicious patterns within the graph, and result integration that combines findings with other detection stages. This segmentation manages analysis complexity by breaking down the sophisticated redirect chain detection into manageable, specialized sub-tasks.
Data Source
AI summary
A method and a computing device for identifying malicious web resource are provided. The method comprises: obtaining a given link of a plurality of links, the given link referring to an initial malicious web resource; retrieving, from a database, simulated user parameters indicative of a simulated user environment and at least one user behavior vector including values indicative of simulated user actions with the initial malicious web resource; based on the simulated user parameters and the simulated user actions, determining at least one redirect chain, a given one of the at least one redirect chain including web resources defining a transition sequence from the initial malicious web resource to a respective target malicious web resource; generating, based on the at least one redirect chain, a redirect graph; and analyzing the redirect graph to determine a plurality of user redirect rules for further use in identifying in-use malicious web resources.