Malware Detection via Webpage Element Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively detect and prevent malicious applications from intercepting web browser communications, leading to unauthorized exposure of sensitive information, as they require constant updates and significant computing resources, and are vulnerable to man-in-the-middle attacks.
Innovation Solution
A system comprising a web server and a validation server that generates and analyzes hash values of webpage elements, using fuzzy hashing to identify malicious code injected by malware, and communicates with other servers to terminate compromised sessions and block fraudulent requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used to detect malicious applications, then detection capability is provided, but computing resources are significantly consumed and constant updates are required
Solution Approach 1:
The patent extracts only the essential identifying features of webpage elements (hash values) rather than analyzing entire code elements. The validation server compares hash values against known malicious patterns, enabling malware detection without processing the full webpage code, thus significantly reducing computing resource consumption while maintaining detection reliability
Solution Approach 2:
The system creates simplified representations (hash values) of webpage elements that serve as copies for comparison purposes. Instead of analyzing the complete malicious code, the system uses these hash value copies to identify malware presence, reducing the computational burden while preserving detection accuracy
2Measurement precision
If comprehensive code analysis is performed to detect malicious code, then detection accuracy is improved, but detection speed decreases
Solution Approach 1:
The patent extracts only the critical hash values from webpage elements for comparison against malicious patterns. This selective extraction maintains detection accuracy by focusing on identifying features while dramatically speeding up the detection process by avoiding analysis of entire code elements
Solution Approach 2:
The system performs partial analysis by comparing only hash values rather than complete code elements. This partial action approach achieves sufficient detection accuracy for security purposes while enabling much faster detection speeds compared to comprehensive code analysis
3Measurement precision
If hash values of all webpage elements are generated and compared, then malware detection accuracy is improved, but resource utilization increases
Solution Approach 1:
The patent extracts only the necessary hash values from webpage elements for comparison. By selecting only the identifying features rather than processing all webpage data, the system maintains high malware detection accuracy while significantly reducing the volume of data that needs to be processed and transmitted
Solution Approach 2:
The system performs partial processing by generating and comparing only hash values rather than analyzing complete webpage elements. This approach achieves sufficient detection accuracy without the excessive resource consumption that would result from processing all webpage data
Data Source
AI summary
Detection and notification of malware at a user device may be performed by a validation server. The user device may hash elements associated with a document object model of a webpage and send generated hash values to the validation server. The validation server may validate the hash values. Based on detection of hash values corresponding to elements maliciously-injected by malware, the validation server may send one or more notifications to other servers that may communicate with the user device.