Malicious Webpage Detection Using Dual Deep Learning Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious webpages rely on repositories of known threats and require understanding the operation and code of each webpage, making them inefficient and vulnerable to new threats, especially when updates are missed.
Innovation Solution
A method using two deep learning neural networks to analyze text and non-text content from webpages, identifying malicious content without prior knowledge, and capable of detecting threats across different programming languages, browsers, and operating systems, even offline.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a repository of known malicious webpages is used for detection, then detection accuracy for known threats is improved, but the system cannot detect new or unseen threats and requires continuous updates
Solution Approach 1:
The system performs preliminary training of deep learning neural networks on large datasets of malicious and benign webpages before deployment. This preliminary action enables the detector to learn patterns and characteristics of malicious content in advance, allowing it to detect new threats without requiring continuous repository updates.
Solution Approach 2:
Instead of relying on exact copies of known malicious webpage addresses from a repository, the system creates a learned model that captures the essential patterns and features of malicious content. This model can then identify new malicious webpages by recognizing similar patterns, effectively copying the detection capability rather than relying on exact matches.
2Loss of information
If analysis of webpage operation and code is performed to identify vulnerabilities, then understanding of malicious mechanisms is improved, but the system becomes complex and requires deep technical analysis
Solution Approach 1:
The system replaces manual or rule-based analysis of webpage code and operations with deep learning neural networks. These networks automatically learn and understand malicious mechanisms through training, substituting complex mechanical analysis processes with automated pattern recognition that reduces system complexity while maintaining or improving understanding of attack vectors.
Solution Approach 2:
The system transforms the complex problem of code analysis into a parameter-based classification task. By converting webpage features into numerical parameters and vectors that neural networks can process, the system simplifies the analysis complexity while preserving the essential information needed to identify malicious mechanisms.
3Reliability
If continuous updates of the repository are performed, then detection capability is maintained, but the system requires network access and cannot operate offline
Solution Approach 1:
The system performs all necessary learning and adaptation actions in advance during the training phase, before deployment. Once trained, the neural network model contains all necessary knowledge to detect malicious webpages without requiring further updates or network access, enabling reliable offline operation.
Solution Approach 2:
The trained neural network detector operates autonomously without requiring external updates or network connectivity. It independently analyzes incoming webpages and makes detection decisions based on learned patterns, serving itself without external assistance and maintaining reliability in offline environments.
Data Source
AI summary
Methods and systems are disclosed for training a malicious webpages detector for detecting malicious webpages, based on a training set comprising a plurality of samples representing malicious and non-malicious webpages. Text content can be extracted from the source code of each sample, and/or non-text content can be extracted from each sample, in order to train respectively at least a first deep learning neural network and a second deep learning neural network of the malicious webpages detector. A malicious webpages detector can detect whether or not a webpage is malicious, by extracting text content from the source code of the webpage, and/or non-text content from the webpage, thereafter providing prospects that the webpage is malicious based on the extracted data.