CN107808095B - 用于检测网页的异常元素的系统和方法 - Google Patents

用于检测网页的异常元素的系统和方法 Download PDF

Info

Publication number
CN107808095B
CN107808095B CN201710477694.1A CN201710477694A CN107808095B CN 107808095 B CN107808095 B CN 107808095B CN 201710477694 A CN201710477694 A CN 201710477694A CN 107808095 B CN107808095 B CN 107808095B
Authority
CN
China
Prior art keywords
web page
cluster
web
dimensional vector
statistical model
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201710477694.1A
Other languages
English (en)
Chinese (zh)
Other versions
CN107808095A (zh
Inventor
奥列格·V·库普列夫
安东·B·盖尔琛科
米哈伊尔·V·尤斯蒂诺夫
维塔利·V·孔德拉托夫
弗拉基米尔·A·库斯科夫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Kaspersky Lab AO
Original Assignee
Kaspersky Lab AO
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Kaspersky Lab AO filed Critical Kaspersky Lab AO
Publication of CN107808095A publication Critical patent/CN107808095A/zh
Application granted granted Critical
Publication of CN107808095B publication Critical patent/CN107808095B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02—Banking, e.g. interest calculation or account maintenance
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Virology (AREA)
  • Databases & Information Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Health & Medical Sciences (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Development Economics (AREA)
  • Data Mining & Analysis (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
CN201710477694.1A 2016-09-08 2017-06-21 用于检测网页的异常元素的系统和方法 Active CN107808095B (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
RU2016136226A RU2652451C2 (ru) 2016-09-08 2016-09-08 Способы обнаружения аномальных элементов веб-страниц
RU2016136226 2016-09-08
US15/437,828 US10291640B2 (en) 2016-09-08 2017-02-21 System and method for detecting anomalous elements of web pages
US15/437,828 2017-02-21

Publications (2)

Publication Number Publication Date
CN107808095A CN107808095A (zh) 2018-03-16
CN107808095B true CN107808095B (zh) 2021-03-26

Family

ID=61281472

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710477694.1A Active CN107808095B (zh) 2016-09-08 2017-06-21 用于检测网页的异常元素的系统和方法

Country Status (4)

Country Link
US (1) US10291640B2 (enExample)
JP (1) JP2018041442A (enExample)
CN (1) CN107808095B (enExample)
RU (1) RU2652451C2 (enExample)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2638710C1 (ru) * 2016-10-10 2017-12-15 Акционерное общество "Лаборатория Касперского" Способы обнаружения вредоносных элементов веб-страниц
US11509540B2 (en) 2017-12-14 2022-11-22 Extreme Networks, Inc. Systems and methods for zero-footprint large-scale user-entity behavior modeling
RU2702080C1 (ru) * 2018-06-29 2019-10-03 Акционерное общество "Лаборатория Касперского" Способ блокировки сетевых соединений с ресурсами из запрещенных категорий
US20200019583A1 (en) * 2018-07-11 2020-01-16 University Of Southern California Systems and methods for automated repair of webpages
GB2596502B (en) 2020-01-06 2023-01-04 British Telecomm Crypto-jacking detection
GB202000129D0 (en) 2020-01-06 2020-02-19 British Telecomm Distributed transactional database consensus
CN111597107B (zh) * 2020-04-22 2023-04-28 北京字节跳动网络技术有限公司 信息输出方法、装置和电子设备
US11811824B2 (en) * 2020-06-08 2023-11-07 Target Brands, Inc. Security system for detecting malicious actor's observation
CN112434238A (zh) * 2020-11-25 2021-03-02 平安普惠企业管理有限公司 网页质量检测方法、装置、电子设备及存储介质
CN120832456A (zh) * 2024-04-23 2025-10-24 北京字跳网络技术有限公司 一种显示状态确定方法、装置、电子设备及存储介质

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105808906A (zh) * 2014-10-27 2016-07-27 三星Sds株式会社 患者个人特性的分析方法及其装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1176432C (zh) * 1999-07-28 2004-11-17 国际商业机器公司 提供本国语言查询服务的方法和系统
US8544087B1 (en) 2001-12-14 2013-09-24 The Trustess Of Columbia University In The City Of New York Methods of unsupervised anomaly detection using a geometric framework
JP4652741B2 (ja) * 2004-08-02 2011-03-16 インターナショナル・ビジネス・マシーンズ・コーポレーション 異常検出装置、異常検出方法、異常検出プログラム、及び記録媒体
US20090307191A1 (en) * 2008-06-10 2009-12-10 Li Hong C Techniques to establish trust of a web page to prevent malware redirects from web searches or hyperlinks
US8225401B2 (en) 2008-12-18 2012-07-17 Symantec Corporation Methods and systems for detecting man-in-the-browser attacks
AU2011209673B2 (en) 2010-01-26 2015-11-19 Emc Corporation System and method for network security including detection of man-in-the-browser attacks
US8364811B1 (en) * 2010-06-30 2013-01-29 Amazon Technologies, Inc. Detecting malware
RU2446459C1 (ru) * 2010-07-23 2012-03-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ проверки веб-ресурсов на наличие вредоносных компонент
CN103180862B (zh) * 2010-08-25 2016-03-02 前景公司 用于服务器耦合的恶意软件防止的系统和方法
WO2012154657A2 (en) 2011-05-06 2012-11-15 The Penn State Research Foundation Robust anomaly detection and regularized domain adaptation of classifiers with application to internet packet-flows
US8869279B2 (en) * 2011-05-13 2014-10-21 Imperva, Inc. Detecting web browser based attacks using browser response comparison tests launched from a remote source
EP2725512B1 (en) * 2012-10-23 2019-03-27 Verint Systems Ltd. System and method for malware detection using multi-dimensional feature clustering
US9225737B2 (en) 2013-03-15 2015-12-29 Shape Security, Inc. Detecting the introduction of alien content
US9979748B2 (en) * 2015-05-27 2018-05-22 Cisco Technology, Inc. Domain classification and routing using lexical and semantic processing
US9923916B1 (en) * 2015-06-17 2018-03-20 Amazon Technologies, Inc. Adaptive web application vulnerability scanner

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105808906A (zh) * 2014-10-27 2016-07-27 三星Sds株式会社 患者个人特性的分析方法及其装置

Also Published As

Publication number Publication date
RU2016136226A3 (enExample) 2018-03-15
RU2016136226A (ru) 2018-03-15
JP2018041442A (ja) 2018-03-15
US10291640B2 (en) 2019-05-14
CN107808095A (zh) 2018-03-16
RU2652451C2 (ru) 2018-04-26
US20180069880A1 (en) 2018-03-08

Similar Documents

Publication Publication Date Title
CN107918733B (zh) 检测网页的恶意元素的系统和方法
US10291640B2 (en) System and method for detecting anomalous elements of web pages
US20240121266A1 (en) Malicious script detection
RU2637477C1 (ru) Система и способ обнаружения фишинговых веб-страниц
US9621570B2 (en) System and method for selectively evolving phishing detection rules
US11961021B2 (en) Complex application attack quantification, testing, detection and prevention
RU2610254C2 (ru) Система и способ определения измененных веб-страниц
US11223637B2 (en) Detecting attacks on web applications using server logs
US10079854B1 (en) Client-side protective script to mitigate server loading
US20260037626A1 (en) Detection of phishing websites using machine learning
JP6708794B2 (ja) 判定装置、判定方法、および、判定プログラム
US20190297092A1 (en) Access classification device, access classification method, and recording medium
CN104580230A (zh) 网站攻击验证方法及装置
US11550920B2 (en) Determination apparatus, determination method, and determination program
EP3306511B1 (en) System and methods of detecting malicious elements of web pages
EP3293661A1 (en) System and method for detecting anomalous elements of web pages
RU2702081C2 (ru) Система и способ обнаружения модификации веб-ресурса
JP7320462B2 (ja) アクセス権に基づいてコンピューティングデバイス上でタスクを実行するシステムおよび方法
CN118509220B (zh) 基于蜜罐的零日漏洞攻击捕获方法及电子设备
RU2659741C1 (ru) Способы обнаружения аномальных элементов веб-страниц на основании статистической значимости
CN111460422B (zh) 生成验证码的方法和装置
CN114157452A (zh) 一种基于http连接平台的xxe漏洞的检测方法及系统
US20240430254A1 (en) Automated login framework for application security testing
EP3547646A1 (en) System and method of detecting a modification of a web resource
CN115567294A (zh) 一种对水坑攻击的处理方法及程序产品

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant