Malware Detection in Web Content via Virtual Environment Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Website operators face challenges in detecting and preventing the distribution of malicious components within external content, such as advertisements, that are inserted into their web pages without their knowledge, which can lead to malware distribution.
Innovation Solution
A data communications network system that includes a server with a content validation application, DOM monitoring application, and pattern matching application, which simulates a virtual environment to render test web pages, monitors network traffic, and applies tests to detect and identify malware in content items before they are served to clients, ensuring the content is safe and free from malicious components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If external content is included in web pages to generate revenue, then productivity is improved, but reliability deteriorates due to potential malware distribution
Solution Approach 1:
The system performs preliminary validation of external content items before they are served to clients. The validation server checks content items for malware and unauthorized actions before they are included in web pages, preventing potential security issues while allowing revenue-generating external content to be used.
Solution Approach 2:
A validation server acts as an intermediary between the external content provider and the website operator's server. This intermediary validates content items by simulating their execution in a virtual machine environment and checking for malicious behavior, thereby mediating the trust relationship and ensuring content safety without blocking legitimate revenue-generating content.
2Reliability
If content validation is performed to ensure safety, then reliability is improved, but device complexity increases due to virtual machine environment requirements
Solution Approach 1:
The validation server performs multiple functions using a single system: it hosts a virtual machine environment, renders web pages, executes content items, monitors DOM changes, and detects malware. This multi-functional approach consolidates what could be separate complex systems into one unified validation platform.
Solution Approach 2:
Instead of requiring complex analysis of the original content item's behavior on actual user systems, the system creates a virtual copy of the execution environment. The content item is executed in a virtual machine that replicates a browser environment, allowing safe observation of its behavior without risking actual user systems.
3Object-affected harmful factors
If malware detection is implemented to protect users, then object-affected harmful factors are reduced, but loss of time increases due to validation processing
Solution Approach 1:
Content validation is performed in advance before the content is served to clients. By checking content items for malware and unauthorized actions before they are included in web pages, the system prevents security issues without delaying the actual content delivery to users.
Solution Approach 2:
The validation process uses automated virtual machine execution and DOM monitoring to quickly detect malicious behavior patterns. The system rushes through the validation process by efficiently monitoring for specific unauthorized actions and DOM changes that indicate malware, rather than performing exhaustive analysis of all content behavior.
Data Source
AI summary
Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, one or more content items are identified in association with the rendering of a network page in a simulated environment. A plurality of tests are applied to the one or more content items to detect an existence of malware associated with the content items.