Web Resource Image Generation for Malicious Modification Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies struggle to detect unknown modifications of web resources effectively, particularly during data transfer between clients and servers, which can be vulnerable and potentially unlawful, and often rely on signature analysis, heuristic analysis, and black/white lists that may not cover all malicious activities.
Innovation Solution
A method and system that generates an image of a web resource by selecting objects, identifying tokens, calculating hash signatures, and detecting potentially malicious calls to determine if the web resource has been modified, using techniques like fuzzy hash or locality-sensitive hash to create a vector representation for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature analysis, heuristic analysis, and black/white lists are used to detect malicious programs, then known malicious activities can be identified, but unknown modifications of web resources cannot be detected effectively
Solution Approach 1:
The patent creates visual copies (images) of web resources that represent their structural and content characteristics. Instead of analyzing the actual web resource data directly, the system generates image representations that capture essential features while excluding sensitive information. These image copies can then be analyzed using machine learning models to detect modifications, enabling detection of unknown threats without relying on predefined signatures or heuristics.
2Reliability
If personal user data is sent from clients to servers for analysis, then web resource modifications can be detected, but data transfer becomes vulnerable and potentially unlawful
Solution Approach 1:
The patent extracts and excludes personal user data and sensitive information from the web resource analysis process. The image generation process deliberately omits personally identifiable information while retaining structural and content features necessary for modification detection. This extraction approach enables detection functionality while eliminating the vulnerability and legal compliance issues associated with transmitting personal data to servers.
Solution Approach 2:
The patent introduces images as an intermediary representation between the client and server. Instead of directly transmitting personal user data or actual web resource content, the system uses generated images as a mediator that preserves detection capabilities while protecting sensitive information. This intermediary layer enables server-side analysis without exposing vulnerable data transfer of personal information.
3Productivity
If traditional analysis methods are used to detect web resource modifications, then known malicious patterns can be identified, but unknown modifications remain undetected
Solution Approach 1:
The patent performs preliminary action by generating images of web resources before they are executed or interacted with. The image generation process captures the structural and content characteristics of the web resource in advance, creating a baseline representation that can be compared against subsequent versions. This preliminary image creation enables rapid detection of modifications without requiring complex real-time analysis during resource execution.
Solution Approach 2:
The system creates simplified visual copies of web resources that retain essential structural and content features while removing sensitive information. These image copies serve as analyzable representations that can be processed by machine learning models to detect unknown modifications. The copying approach maintains detection precision for novel threats while enabling efficient processing through standardized image formats.
Data Source
AI summary
The present disclosure provides for systems and methods for generating an image of a web resource to detect a modification of the web resource. An exemplary method includes selecting one or more objects of the web resource based on one or more object attributes; identifying a plurality of tokens for each selected object based on contents of the selected object; calculating a hash signature for each selected object of the web resource using the identified plurality of tokens; identifying potentially malicious calls within the identified plurality of tokens; generating an image of the web resource based on the plurality of hash signatures and based on the identified potentially malicious calls, wherein the image of the web resource comprises a vector representation of the contents of the web resource; and detecting whether the web resource is modified based on the image of the web resource.