Web Page Malware Detection via Attribute Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-virus software is ineffective in detecting malware specific to web pages, as it is not tailored for specific types of web content, leading to potential unauthorized access and data theft.
Innovation Solution
A method and system that injects client-side code into web pages before execution to detect malware by comparing expected attributes with executed attributes, using a processor to determine the presence of malware and transmitting alerts if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus software is used for general malware detection, then broad virus coverage is achieved, but detection effectiveness for web page specific malware is poor
Solution Approach 1:
The patent segments the malware detection problem into two parts: (1) general malware detection using conventional anti-virus software, and (2) web page specific malware detection using a specialized module that compares expected web page attributes with actual rendered attributes. This segmentation allows each component to specialize in its strength area.
Solution Approach 2:
The patent introduces an intermediary comparison mechanism that acts as a mediator between the web page delivery system and the malware detection system. This intermediary module compares expected attributes (from the server) with actual attributes (from the rendered page) to detect webinject malware that conventional software misses.
2Object-generated harmful factors
If web pages are modified by webinject malware, then fraudulent content is injected, but conventional software fails to detect the modification
Solution Approach 1:
The patent applies preliminary action by establishing expected web page attributes on the server side before the page is transmitted to the client. These expected attributes serve as a baseline for later comparison with the actual rendered page, enabling detection of any unauthorized modifications.
Solution Approach 2:
The patent implements a feedback mechanism where the rendered web page attributes are compared against the expected attributes, and the results are used to detect malware. The system receives feedback from the client device about the actual page execution and uses this feedback to identify discrepancies indicating malware presence.
3Ease of operation
If generic anti-virus software is deployed, then installation is simple, but detection precision for web page malware is insufficient
Solution Approach 1:
The patent creates a multi-functional detection system that combines conventional anti-virus capabilities with web page attribute comparison functionality. The system can perform both general malware scanning and specific web page integrity verification, making it universally applicable to different malware types while maintaining ease of deployment through integration with existing browsers.
Data Source
AI summary
Systems and methods are provided for detecting malware. The method includes receiving a request for a web page; determining expected attributes of the web page; generating a modified web page by combining the web page with code for detecting malware; transmitting the modified web page to a client device; receiving data collected from the executed version of the modified web page; determining attributes of the executed version of the modified web page; comparing the expected attributes with the attributes of the executed version of the modified web page; and determining whether the malware is present on the client device based on the comparison.