Web Page Analysis Apparatus for Active Attack Observation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Web page patrol technologies and Web client honey pot methods are inadequate in observing attacks that lead to user operation, as they are passive and struggle to accurately reproduce user operations and targets, making it difficult to analyze the occurrence or non-occurrence of attacks via Web pages.
Innovation Solution
An analysis apparatus that actively performs operations on Web pages, detects operation targets, and outputs log data to identify attacks leading to user operations, utilizing a classification unit, detection units, and a function hook to associate operation events with URL communication, thereby generating a blacklist to prevent malware infection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If passive Web page patrol technology or Web client honey pot is used, then the system complexity is reduced, but the ability to observe attacks leading to user operation deteriorates
Solution Approach 1:
The analysis apparatus performs preliminary actions by automatically executing operations on detected operation targets before actual user interaction occurs. The system pre-configures detection methods for different Web page categories and proactively tests potential attack vectors by simulating user operations, thereby observing attacks that would only manifest with actual user interaction without requiring complex passive monitoring systems
Solution Approach 2:
The analysis apparatus acts as an intermediary between passive detection systems and actual user operations. It receives Web page URLs, performs automated operations as a middle layer, and generates analysis results that bridge the gap between simple patrol technology and complex active observation requirements, resolving the contradiction by providing intermediate complexity with enhanced observation capability
2Ease of operation
If conventional Web client honey pot is used, then the ease of operation is improved, but the accuracy of reproducing user operations and targets deteriorates
Solution Approach 1:
The analysis apparatus dynamically adapts its operation detection methods based on the classified category of each Web page. Rather than using a static, one-size-fits-all approach, the system adjusts detection strategies according to the specific characteristics of different Web page types, thereby accurately reproducing relevant user operations for each context while maintaining ease of automated operation
Solution Approach 2:
The system changes operational parameters by selecting different detection methods based on Web page categories. For each category, specific detection parameters and operation types are configured, allowing the system to accurately reproduce context-appropriate user operations without requiring manual configuration for each individual page, thus maintaining ease of operation while achieving high reproduction accuracy
3Productivity
If technology for reconstructing Web page transition is used, then the productivity is improved, but the accuracy of reproducing user operation contents and targets deteriorates
Solution Approach 1:
The analysis apparatus segments the Web page analysis process into distinct categories and operation types. By dividing Web pages into classified categories and associating specific detection methods with each category, the system efficiently processes multiple pages in parallel (improving productivity) while maintaining accurate reproduction of relevant user operations for each segment without requiring exhaustive analysis of all possible operations
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An analysis apparatus (4) includes a category classification unit (32) that accesses a URL of an analysis target Web page and classifies the analysis target Web page into a category, an operation target detection unit (33) that detects an operation target of user operation from the analysis target Web page in accordance with a detection method that is set in advance for the classified category, an operation execution unit (34) that performs operation on the detected operation target, a function hook unit (35) that detects an operation event that occurs after the operation has been performed on the operation target, and a log output unit (36) that outputs log data in which communication that has occurred due to the operation, the detected operation event, and a Web browser screen that has been changed due to the operation are associated with the URL of the analysis target Web page.