Semi-Automatic Phishing Rule Generator Using HTML Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for detecting malicious websites rely heavily on human-generated regular expressions, which are labor-intensive and inefficient due to the exponential increase in the number of websites and phishing sites, leading to challenges in creation, maintenance, and accuracy.
Innovation Solution
A computer-implemented method generates a set of longest common sequences from known malicious webpages, transforming HTML source strings to reduce stop words and repeated tags, performing string alignment, and filtering to simplify human analysis for generating regular expressions, thereby reducing human involvement and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human experts manually analyze and generate regular expressions by searching and matching HTML source codes, then detection accuracy is improved, but labor intensity and time consumption increase significantly
Solution Approach 1:
The system performs preliminary automated processing of HTML source codes by transforming them to reduce stop words and repeated tags before human analysis. This preprocessing step prepares the data in advance, reducing the time humans need to spend on manual analysis while maintaining detection accuracy through structured transformation of the source codes.
Solution Approach 2:
The patent introduces an intermediary automated transformation process that acts as a bridge between raw HTML source codes and human expert analysis. This intermediary system transforms and structures the source codes, reducing the complexity of manual analysis while preserving the information needed for accurate detection, thus reducing time consumption without sacrificing precision.
2Adaptability or versatility
If more regular expressions are created to detect increasing number of phishing sites, then detection coverage is improved, but maintenance effort and complexity increase
Solution Approach 1:
The system creates transformed copies of HTML source codes that eliminate redundant elements like stop words and repeated tags. These transformed copies serve as standardized representations that can be analyzed more efficiently, allowing the system to handle diverse phishing sites with reduced complexity while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent applies parameter changes by transforming the HTML source codes through systematic reduction of stop words and repeated tags. This transformation changes the parameters of the source code representation, making them more consistent and easier to analyze across different phishing sites, thereby improving detection coverage while reducing maintenance complexity.
3Manufacturing precision
If manual analysis of HTML source codes is performed to ensure accuracy, then regular expression quality is improved, but productivity decreases
Solution Approach 1:
The system performs preliminary automated transformation of HTML source codes to reduce stop words and repeated tags before human experts generate regular expressions. This preliminary action prepares high-quality, standardized input data that improves regular expression quality while reducing the time experts need to spend on analysis, thereby increasing productivity.
Solution Approach 2:
The patent substitutes the manual mechanical process of analyzing raw HTML source codes with an automated transformation system. This mechanical substitution handles the tedious preprocessing tasks automatically, allowing human experts to focus on higher-level pattern recognition and rule generation, thus improving both quality and productivity.
4Productivity
If automated transformation is applied to reduce stop words and repeated tags, then processing efficiency is improved, but information loss may occur
Solution Approach 1:
The system selectively extracts and removes redundant elements such as stop words and repeated tags from HTML source codes. This extraction process eliminates unnecessary information that does not contribute to phishing detection while preserving the meaningful content needed for accurate analysis, thus improving processing efficiency without causing significant information loss.
Solution Approach 2:
The transformation process applies local quality by selectively reducing specific elements (stop words and repeated tags) while preserving other important parts of the HTML source codes. This localized approach ensures that only redundant information is removed, maintaining the integrity of detection-critical information while improving processing efficiency.
Data Source
AI summary
A computer-implemented method for generating a first set of longest common sequences from a plurality of known malicious webpages, the first set of longest common sequences representing input data from which a human generates a set of regular expressions for detecting phishing webpages. There is included obtaining HTML source strings from the plurality of known malicious webpages and transforming the HTML source strings to reduce the number of at least one of stop words and repeated tags, thereby obtaining a set of transformed source strings. There is further included performing string alignment on the set of transformed source strings, thereby obtaining at least a scoring matrix. There is additionally included obtaining a second set of longest common sequences responsive to the performing the string alignment. There is further included filtering the second set of longest common sequences, thereby obtaining the first set of longest common sequences.