Statistical Clustering of Malicious Web Page Elements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions fail to effectively detect malicious software injected into web pages, particularly in web banking systems, without installing additional software on user devices, leading to potential data breaches and false alarms.
Innovation Solution
A system and method that build statistical models of malicious web page elements by transforming data into N-dimensional vectors, creating clusters, and refining models based on user device data, using scripts inserted between user devices and web servers to gather and analyze page content, identifying anomalies and malicious elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If additional software such as security clients or antivirus means is installed at the user's end, then detection capability of malicious elements is improved, but device complexity and user convenience deteriorate
Solution Approach 1:
The patent introduces a control server as an intermediary between the user's browser and the web pages. The control server receives web pages, analyzes them for malicious elements using statistical models, and delivers safe versions to users. This mediator approach enables detection capability without requiring additional software installation on user devices, resolving the contradiction between detection precision and device complexity
Solution Approach 2:
The patent replaces the mechanical approach of installing antivirus software on user devices with a server-side analysis system. Instead of distributing detection capabilities to numerous client devices, the system centralizes analysis on the control server, substituting client-side mechanical installation with server-side automated processing
2Reliability
If traditional antivirus solutions are used, then some malicious elements are detected, but false alarms occur and legitimate web page alterations are incorrectly identified as anomalous
Solution Approach 1:
The patent transforms web page data into N-dimensional vectors and applies statistical clustering to identify patterns of malicious elements. By changing the parameter representation from traditional signature-based detection to multi-dimensional statistical analysis, the system achieves better detection accuracy while reducing false alarms through pattern recognition rather than rigid rule matching
Solution Approach 2:
The system continuously refines its statistical models based on data received from user devices. By implementing feedback loops where detection results and new malicious element patterns are fed back into model training, the system improves reliability over time while learning to distinguish between legitimate and malicious alterations, thereby reducing false alarm rates
3Measurement precision
If statistical models are built using N-dimensional vectors and clustering, then detection precision is improved, but computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary transformation of web page data into N-dimensional vectors and pre-computes statistical models using clustering algorithms during off-peak times or in batches. By preparing detection models in advance rather than in real-time, the system achieves high detection precision while minimizing the time loss during actual web page analysis
Solution Approach 2:
The system segments the complex model building process into distinct phases: data collection, vector transformation, clustering analysis, and model deployment. This segmentation allows parallel processing of different web page features and enables incremental model updates, reducing overall computational time while maintaining high detection precision through specialized processing of each segment
Data Source
AI summary
Disclosed are system and method for building statistical models of malicious elements of web pages. One exemplary method comprises: obtaining, by a control server, data about malicious elements of web pages; transforming, by the control server, the obtained data into at least one N-dimensional vector; creating, by the control server, at least one cluster based on elements of the at least one N-dimensional vector; and building, by the control server, the statistical model of the malicious elements of the web page based on the created at least one cluster.