Webpage Content Manipulation for Malware Analysis Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware that analyzes web traffic by examining webpage content for specific features, such as hash values or HTML elements with particular attributes, poses a threat by potentially identifying user information, and existing techniques are inadequate in preventing this malicious analysis without altering the webpage's appearance to the user.
Innovation Solution
A content manipulator system that randomly alters the ordering of HTML attributes and inserts white space into webpages, using a pseudo-random number generator to generate variations, ensuring that each client device receives a different version of the same webpage, thereby thwarting malware analysis without affecting the webpage's appearance to the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If webpage content is kept identical for all users, then consistency and reliability are improved, but malware can easily analyze and collect confidential information by examining the content
Solution Approach 1:
The patent applies local quality by making only specific portions of the webpage content variable (such as attribute orderings, whitespace insertion points, or comment placements) while keeping the core functional content identical. This allows the webpage to maintain its essential reliability and functionality while introducing local variations that prevent malware analysis.
Solution Approach 2:
The patent changes parameters of the webpage content such as the ordering of HTML attributes, insertion of variable whitespace, or placement of comments, without altering the fundamental structure or appearance. These parameter changes create different content representations that confuse malware attempting to analyze or compare webpage content while maintaining user experience consistency.
2Object-affected harmful factors
If webpage content is randomly altered to prevent malware analysis, then security against malware is improved, but the webpage appearance may be affected to the user
Solution Approach 1:
The patent carefully selects which local aspects of the webpage to modify (attribute orderings, whitespace within non-rendering elements, comment placements) ensuring these changes occur in areas that do not affect the visual rendering. This maintains the webpage's appearance (shape) while introducing variations that prevent malware analysis.
Solution Approach 2:
The patent creates multiple copies or variations of the same webpage content with different non-visual characteristics. Each copy contains the same functional and visual information but differs in aspects like attribute ordering or whitespace, making malware analysis difficult while presenting the identical appearance to users.
3Measurement precision
If traditional malware detection techniques are used, then malware identification is improved, but they cannot prevent malware already present on client devices from analyzing web traffic
Solution Approach 1:
The patent applies preliminary anti-action by modifying the webpage content before it reaches the malware on the client device. By introducing variations in the content (attribute orderings, whitespace, comments) at the source, the patent prevents the malware from successfully analyzing or collecting information from the web traffic, countering the threat before the malware can act.
Solution Approach 2:
The patent introduces an intermediary layer of content modification between the legitimate webpage source and the malware. This intermediary transforms the content by adding variations that maintain functionality and appearance but disrupt the malware's ability to analyze the traffic, effectively blocking the information loss without affecting the user experience.
Data Source
AI summary
Techniques are disclosed relating to limiting malicious-code analysis of webpage content. In one embodiment, a computing system receives a webpage requested by a client device. The computing system randomly alters content of the webpage to limit analysis of the content by malicious code such that the altering does not affect how the webpage is displayed by the client device. The computing system may then serve the webpage with the altered content to the client device. In some embodiments, the altering includes searching the webpage for an HTML element that specifies a plurality of attributes in a particular ordering and rearranging the plurality of attributes to have a new ordering different from the particular ordering. In some embodiments, the altering includes parsing the webpage for an HTML element that specifies an identifier attribute and modifying an identifier attribute of the element.