Web Page Characteristic Detection Using HTM for Malicious Changes

The patent introduces an HTM-based anomaly detection system as an intermediary layer between web application operations and security analysis. This intermediary automatically learns normal operational patterns during training and detects deviations during monitoring, achieving high detection precision without requiring complex manual rule configurations. The HTM model acts as a mediator that translates complex web application behaviors into recognizable patterns and anomalies.

The system transforms web application operational data into sparse distributed representations (SDRs), changing the parameter space from raw operational logs to structured binary vectors. This parameter transformation enables the HTM model to efficiently process and recognize patterns in web application characteristics, achieving high detection precision while maintaining computational efficiency.

The system performs preliminary action by training the HTM model during a dedicated training phase using sparse distributed representations of normal web application operations. This pre-learning of operational patterns enables rapid real-time detection during the monitoring phase, as the model has already established baseline expectations for normal behavior, reducing processing time while maintaining high detection reliability.

The patent extracts only the essential characteristics of web application operations into sparse distributed representations, focusing on key parameters such as HTML tag structures and operational patterns. This extraction of critical features from comprehensive data reduces processing complexity and time while maintaining sufficient detection reliability for identifying malicious changes.

The HTM-based system performs self-service by automatically learning normal web application operational patterns during training and autonomously detecting anomalies during monitoring. The system self-adjusts to changing operational patterns through continuous learning, eliminating the need for manual rule updates and configuration, thereby achieving high security monitoring productivity while managing complexity through automated adaptation.

The system implements feedback mechanisms where detection results and anomaly patterns are continuously fed back into the HTM model, enabling it to refine its understanding of normal operations and improve detection accuracy over time. This automated feedback loop enhances security monitoring productivity by continuously improving detection capabilities without requiring manual intervention.