Web Page Classification via Dynamic Function Signature Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies face challenges in effectively detecting malicious behavior embedded in web pages, particularly due to obfuscated network attacks like phishing, which are difficult to detect and require improved methods for classifying web pages as malicious.

Innovation Solution

A classification system that generates signatures for web pages based on attributes associated with invoked functions during rendering, using models like neural networks or decision trees to classify pages as malicious, and employs anomaly detection to distinguish between known and unknown patterns.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If web pages use dynamic elements and obfuscated code to hide malicious behavior, then the malicious activity can be concealed from users, but detection of the malicious behavior becomes more difficult

Engineering Contradiction:

Improveconcealment of malicious behaviorVSAvoiddetection difficulty

Core Design Contradiction:

Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The patent replaces traditional static analysis methods with dynamic execution tracking. Instead of analyzing web page code statically, the system executes JavaScript functions in a controlled environment and monitors their runtime behavior, substituting mechanical code inspection with dynamic observation of actual execution patterns

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a classification system as an intermediary between the web page and the detection process. This system captures function invocation patterns, creates signatures, and compares them against known malicious patterns, acting as a mediator that translates dynamic execution behavior into detectable classification data

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If traditional static analysis methods are used to detect malicious web pages, then the detection process is simple, but it cannot effectively detect obfuscated or dynamically generated malicious content

Engineering Contradiction:

Improvedetection process simplicityVSAvoidmalicious content detection accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent performs preliminary actions by pre-defining a set of JavaScript functions to track and pre-establishing a classification system with signature capture capabilities. Before actual detection occurs, the system is prepared with knowledge of which functions to monitor and how to classify their invocation patterns, enabling accurate detection without complex real-time analysis

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If dynamic JavaScript execution tracking is implemented to improve malicious web page detection, then detection accuracy improves, but system complexity increases

Engineering Contradiction:

Improvemalicious web page detection accuracyVSAvoiddetection system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the detection system into distinct modular components: a tracking module that monitors function invocations, a signature capture module that records invocation patterns, and a classification module that compares signatures against known patterns. This segmentation reduces overall system complexity by making each component independent and manageable

Inventive Principle:

Principle #1Segmentation

4Measurement precision

If function invocation patterns are tracked and signatures are generated for every web page, then malicious pages can be classified accurately, but processing time and computational resources increase

Engineering Contradiction:

Improveweb page classification accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies partial action by tracking only a specific subset of JavaScript functions that are most indicative of malicious behavior, rather than monitoring all functions. This selective tracking reduces the amount of data to be processed and stored, decreasing processing time while maintaining detection accuracy

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11503070B2Techniques for classifying a web page based upon functions used to render the web page

Publication Date: 2022.11.15 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

The present disclosure generally relates to web page analysis, and more particularly to a classification system for web pages. The classification system may classify a web page as malicious based upon one or more signatures generated for the web page. For example, the classification system may compare one or more signatures generated for a first web page to one or more signatures generated for a second web page, where the first web page and the second web page are the same web page at different times or different web pages. Based upon a similarity of the signatures, the classification system may output whether the first web page is malicious. For another example, the classification system may include a classification model that is trained based upon one or more signatures for one or more classified web pages. The classification model may output whether the web page is malicious.