Malicious Website Cloaking Detection Through Scanner-Style Requests

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Malicious websites employ cloaking techniques to evade detection by anti-malware scanners, allowing users to unknowingly access and potentially fall victim to phishing attacks.

Innovation Solution

A method that alters website access requests to include characteristics of anti-malware scanners, analyzing responses for cloaking techniques, and generating outputs to protect users by blocking or warning them from potentially malicious sites.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional anti-malware scanners are used to detect malicious websites, then detection capability is maintained, but malicious websites using cloaking techniques can evade detection

Engineering Contradiction:

Improvedetection capabilityVSAvoidevasion by cloaking techniques

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies inversion by having the client system send requests with scanner characteristics and analyze the website's response to detect cloaking. Instead of the scanner directly detecting the malicious site, the system inverts the approach by making the site reveal its true nature through its response behavior to scanner-like requests.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent applies preliminary anti-action by proactively sending requests with scanner characteristics before the user actually accesses the site. This preliminary action causes the malicious site to reveal its cloaking behavior in advance, allowing the system to block access before the user is exposed to the threat.

Inventive Principle:

Principle #9Preliminary anti-action

2Reliability

If requests are altered to include scanner characteristics, then detection of cloaked sites improves, but request processing complexity increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidrequest processing complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-configuring scanner characteristics and response analysis rules in the client system. This preliminary setup allows the system to automatically alter requests and analyze responses without requiring complex real-time processing, reducing operational complexity while maintaining detection accuracy.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If multiple requests with different characteristics are sent, then detection reliability improves, but time consumption increases

Engineering Contradiction:

Improvedetection reliabilityVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies periodic action by sending multiple requests with different scanner characteristics in a structured sequence. This periodic approach allows the system to gather comprehensive detection data while managing time consumption through organized, repeated actions rather than random or excessive requests.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS12363161B2Neutralizing evasion techniques of malicious websites

Publication Date: 2025.07.15 PAYPAL INC

AI summary

Techniques are disclosed relating to methods that include a process, executing on a computer system, receiving a request to access a website, and altering the request to include one or more characteristics of anti-malware scanners. The method further includes the process sending the altered request to the website, and receiving a response to the altered request. The method also includes the process detecting whether the received response utilizes one of a known set of anti-malware cloaking techniques, and providing, based on the detecting, an output indicative of an outcome of the altered request.