Malicious Website Detection Through Multi-Page Resource Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing server-side and client-side web analysis tools are limited in their ability to accurately identify malicious websites due to their inability to consider collective data from multiple web pages, leading to missed detections of malicious activities that span across multiple pages.
Innovation Solution
A system and method that correlates resource data from multiple web pages accessed by a user to determine malicious intent, including data relevant to user privacy and security, and performs security actions such as notifications or blocking access to the website.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If server-side web analysis tools are used to imitate real users' browsing sessions, then the ability to explore and evaluate web pages is improved, but the ability to access pages requiring user input is lost
Solution Approach 1:
The patent introduces a user as an intermediary to access pages requiring user input. The system combines automated server-side browsing with manual user interaction, where the user provides necessary inputs (such as passwords or challenge-response answers) that automated tools cannot provide, thereby enabling access to protected pages while maintaining automated analysis capabilities for other pages.
2Reliability
If client-side web analysis tools are used to access web pages requiring user input, then access capability is improved, but the ability to analyze multiple pages collectively is lost
Solution Approach 1:
The patent merges the capabilities of server-side and client-side tools by combining automated server-side browsing with manual client-side interaction. The system collects data from multiple web pages accessed during a browsing session, correlates this data across pages, and performs collective analysis to identify malicious websites, thereby overcoming the limitation of analyzing only single pages in isolation.
3Measurement precision
If resource data from multiple web pages is correlated and analyzed collectively, then the accuracy of identifying malicious websites is improved, but the complexity of data processing increases
Solution Approach 1:
The patent segments the data processing task into distinct phases: data collection from individual web pages, data correlation across pages, and collective analysis to identify malicious patterns. This segmentation allows the system to manage complex multi-page data processing by breaking it into manageable stages, where each stage handles specific aspects of the analysis independently before integrating results.
Data Source
AI summary
Methods and systems for protecting against harm caused by malicious websites are disclosed. Exemplary embodiments of the present disclosure may protect against harm caused by malicious websites by identifying malicious websites more accurately and reliably. In particular, some embodiments of the present disclosure may receive first resource data from a first web page on a website that is accessed by a first user and second resource data from a second web page on the website that is accessed by a second user. This resource data may be correlated and analyzed. Based on this analysis, a determination may be made that the website is malicious and a security action can be performed.