Scareware Detection via Feature Extraction and Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Scareware webpages deceive users by misrepresenting malware solutions, leading to unnecessary payments and the installation of malicious software, posing a significant threat to computer security as they often include malware that can take control of a user's computer or harm it.
Innovation Solution
A method for detecting scareware using a search engine that extracts features from webpages, such as URLs, text, images, and pop-ups, and compares them to known scareware and non-scareware pages using a classifier to determine the likelihood of a webpage being scareware, allowing for the removal of scareware pages from search results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If scareware webpages are allowed to exist and be accessible, then users can access the information presented on these pages, but users are deceived into unnecessary payments and malware installation
Solution Approach 1:
The system performs preliminary analysis of webpages by extracting features such as text content, URLs, images, and pop-up characteristics before users access them. A classifier evaluates these features to identify scareware patterns in advance, allowing the system to block harmful pages before users can be deceived, thus resolving the contradiction between allowing access and preventing harm
Solution Approach 2:
The patent introduces an intermediary detection system between the user and the webpage. This intermediary analyzes webpage features and uses a classifier to determine whether a page is scareware, acting as a mediator that allows legitimate information access while blocking malicious content, thereby resolving the contradiction between accessibility and safety
2Reliability
If a classifier system is implemented to detect scareware, then user protection improves, but system complexity increases
Solution Approach 1:
The detection system is segmented into distinct functional components: a feature extraction module that identifies specific webpage characteristics (text, URLs, images, pop-ups), and a classifier module that evaluates these features. This segmentation allows the complex protection task to be divided into manageable parts, reducing overall system complexity while maintaining high reliability
Solution Approach 2:
The system transforms the complex problem of scareware detection into a parameter-based evaluation by extracting specific measurable features from webpages (text content, URL patterns, image characteristics, pop-up frequency). The classifier then evaluates these parameters against known scareware patterns, converting a complex qualitative assessment into a structured quantitative process that improves reliability without excessive complexity
Data Source
AI summary
A machine-implemented method for detecting scareware includes the steps of accessing one or more landing pages to be evaluated, extracting one or more features from the landing pages, and providing a classifier to compare the features extracted from the landing pages with features of known scareware and non-scareware pages. The classifier determines a likelihood that the landing page is scareware. If determined to be scareware, the landing page is removed from search results generated by a search engine. The features can be URLs, text, image interest points, image descriptors, a number of pop-ups generated, IP addresses, hostnames, domain names, text derived from images, images, metadata, identifiers of executables, and combinations thereof.