Website Classification Using Update History Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods lack an accurate technique to detect websites that are at risk of abuse due to their management state by administrators, despite the increasing threat of vulnerability exploitation in content management systems (CMS) leading to website defacement and other malicious activities.
Innovation Solution
A classification apparatus that monitors website access data, generates update histories, and uses machine learning to classify websites based on feature values from these histories to predict potential abuse, distinguishing between managed and unmanaged websites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional detection methods using URLs and web content are used, then detection capability is provided, but accuracy in detecting websites at risk due to management state is insufficient
Solution Approach 1:
The system performs preliminary actions by collecting access result data and generating update histories before abuse occurs. It monitors website access patterns, CMS version information, and update frequencies in advance to establish baseline management states, enabling early detection of websites at risk before they are compromised by attackers.
Solution Approach 2:
The system introduces an intermediary classification apparatus that analyzes the relationship between website management behaviors and abuse risks. This intermediary processes access result data, generates update histories, and creates classification models that bridge the gap between observable management patterns and potential security risks, improving detection accuracy without requiring direct access to administrator intentions.
2Ease of operation
If simple Dork technique is used to find old version CMS websites, then ease of operation is improved, but false positives increase because old version does not necessarily indicate poor management
Solution Approach 1:
The system changes the detection parameters from static CMS version identification to dynamic management behavior analysis. Instead of simply flagging old CMS versions, it monitors access result data over time, tracks update frequencies, and analyzes management patterns to compute risk scores, thereby reducing false positives while maintaining ease of operation through automated classification.
Solution Approach 2:
The system transitions from static detection (checking CMS version at a single point in time) to dynamic detection (monitoring management behaviors over time). It continuously collects access result data, generates update histories showing changes in website management, and adapts classification models based on evolving patterns, enabling more accurate identification of truly unmanaged websites.
3Measurement precision
If comprehensive monitoring of website management is implemented, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The classification apparatus is segmented into distinct functional modules: an acquisition unit that collects access result data, an update history generation unit that processes the data chronologically, and a classifier generation unit that creates detection models. This segmentation allows each component to perform a specific function, simplifying the overall system architecture while maintaining high detection accuracy through coordinated operation of specialized units.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A classification apparatus includes: a crawler unit (121) that acquires access result data for a website, the access result data including website application information, web server information, and the like that are updated by an administrator of the website; an update history generation unit (122) that generates an update history of the website by making comparison in chronological order between pieces of information included in the access result data for the website; a classifier generation unit (123) that generates a classifier that classifies a website having a possibility of being abused in the future, by using, as a feature value, the update history of the website; and a classification unit that classifies, through the classifier generated, the website having the possibility of being abused in the future.