Web Sandbox Threat Detection for Delay Loaded Pages

Solution Overview

Problem

Web sandboxes miss detecting attack code embedded in delay loading web pages due to the partial content loading mechanism, which reduces network throughput and loading speed, leading to a compromised user experience and security.

Innovation Solution

A threat detection method that injects preset dynamic code into the page code of a first display page group, allowing sequential display and parsing, triggering the switching to the next page, and requesting subsequent page code from the server when a preset size condition is met, enabling detection of attack code in delay loaded pages.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If delay loading technology is used to improve loading speed and user experience, then loading speed and user experience are improved, but attack code in delay loaded pages cannot be detected, causing missed detection

Engineering Contradiction:

Improveloading speedVSAvoiddetection accuracy

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The patent applies preliminary action by injecting monitoring code into the page code before the delay loading occurs. The monitoring code is embedded in the initial page code, enabling it to track and detect attack code in subsequently loaded delay loading pages. This preliminary injection ensures detection capability is established before the actual delay loading and potential attack code execution occurs.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses monitoring code as an intermediary element that bridges the gap between the initial page loading and the subsequent delay loaded pages. This monitoring code acts as a mediator that can intercept and analyze the content of delay loaded pages, enabling detection without disrupting the normal delay loading mechanism and maintaining both loading speed and detection accuracy.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If Web sandbox is used to detect attack code, then security detection capability is improved, but delay loaded pages are not detected, causing missed detection

Engineering Contradiction:

Improvesecurity detection capabilityVSAvoidmissed detection of delay loaded pages

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent applies preliminary action by injecting monitoring code into the page code before the delay loading occurs. The monitoring code is embedded in the initial page code, enabling it to track and detect attack code in subsequently loaded delay loading pages. This preliminary injection ensures detection capability is established before the actual delay loading and potential attack code execution occurs.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent ensures continuity of useful action by implementing a monitoring mechanism that persists across page loads. The monitoring code remains active and continues to monitor subsequent delay loaded pages, ensuring uninterrupted detection capability throughout the entire page loading process including delay loaded content.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If all page code is loaded at once, then detection completeness is improved, but network throughput decreases and user experience deteriorates

Engineering Contradiction:

Improvedetection completenessVSAvoidnetwork throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies segmentation by dividing the page code into multiple segments: initial page code and delay loaded pages. The monitoring code is injected into the initial page code segment, which is loaded immediately. The monitoring code then tracks subsequent delay loaded page segments, enabling detection across all segments without requiring them to be loaded simultaneously, thus maintaining both detection completeness and network throughput.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies preliminary action by injecting monitoring code into the page code before the delay loading occurs. The monitoring code is embedded in the initial page code, enabling it to track and detect attack code in subsequently loaded delay loading pages. This preliminary injection ensures detection capability is established before the actual delay loading and potential attack code execution occurs.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11604872B2Threat detection method and apparatus, and network system

Publication Date: 2023.03.14 HUAWEI TECH CO LTD

AI summary

Example threat detection methods and apparatus are disclosed. One example method includes obtaining page code of a first display page group identified by a uniform resource locator (URL) and an overall size occupied by the first display page group in a display area of a browser of a Web sandbox when loading the URL in the browser. After preset dynamic code is injected into the page code of the first display page group, the page code is parsed and executed. A request message is sent when a value of a display variable is greater than or equal to a preset value, to request to obtain page code of a second display page group. A response message that carries the page code of the second display page group is received. It is further detected, in the Web sandbox, whether the page code of the second display page group carries attack code.