RU2652451C2 - Способы обнаружения аномальных элементов веб-страниц - Google Patents

Способы обнаружения аномальных элементов веб-страниц Download PDF

Info

Publication number
RU2652451C2
RU2652451C2 RU2016136226A RU2016136226A RU2652451C2 RU 2652451 C2 RU2652451 C2 RU 2652451C2 RU 2016136226 A RU2016136226 A RU 2016136226A RU 2016136226 A RU2016136226 A RU 2016136226A RU 2652451 C2 RU2652451 C2 RU 2652451C2
Authority
RU
Russia
Prior art keywords
web page
elements
cluster
web
clusters
Prior art date
Application number
RU2016136226A
Other languages
English (en)
Russian (ru)
Other versions
RU2016136226A3 (enExample
RU2016136226A (ru
Inventor
Олег Викторович Купреев
Антон Борисович Гальченко
Михаил Валерьевич Устинов
Виталий Викторович Кондратов
Владимир Анатольевич Кусков
Original Assignee
Акционерное общество "Лаборатория Касперского"
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Акционерное общество "Лаборатория Касперского" filed Critical Акционерное общество "Лаборатория Касперского"
Priority to RU2016136226A priority Critical patent/RU2652451C2/ru
Priority to US15/437,828 priority patent/US10291640B2/en
Priority to EP17176125.7A priority patent/EP3293661A1/en
Priority to CN201710477694.1A priority patent/CN107808095B/zh
Priority to JP2017126050A priority patent/JP2018041442A/ja
Publication of RU2016136226A3 publication Critical patent/RU2016136226A3/ru
Publication of RU2016136226A publication Critical patent/RU2016136226A/ru
Application granted granted Critical
Publication of RU2652451C2 publication Critical patent/RU2652451C2/ru

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02—Banking, e.g. interest calculation or account maintenance
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Virology (AREA)
  • Databases & Information Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Technology Law (AREA)
  • Health & Medical Sciences (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Development Economics (AREA)
  • Data Mining & Analysis (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
RU2016136226A 2016-09-08 2016-09-08 Способы обнаружения аномальных элементов веб-страниц RU2652451C2 (ru)

Priority Applications (5)

Application Number Priority Date Filing Date Title
RU2016136226A RU2652451C2 (ru) 2016-09-08 2016-09-08 Способы обнаружения аномальных элементов веб-страниц
US15/437,828 US10291640B2 (en) 2016-09-08 2017-02-21 System and method for detecting anomalous elements of web pages
EP17176125.7A EP3293661A1 (en) 2016-09-08 2017-06-14 System and method for detecting anomalous elements of web pages
CN201710477694.1A CN107808095B (zh) 2016-09-08 2017-06-21 用于检测网页的异常元素的系统和方法
JP2017126050A JP2018041442A (ja) 2016-09-08 2017-06-28 Ｗｅｂページの異常要素を検出するためのシステム及び方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
RU2016136226A RU2652451C2 (ru) 2016-09-08 2016-09-08 Способы обнаружения аномальных элементов веб-страниц

Publications (3)

Publication Number Publication Date
RU2016136226A3 RU2016136226A3 (enExample) 2018-03-15
RU2016136226A RU2016136226A (ru) 2018-03-15
RU2652451C2 true RU2652451C2 (ru) 2018-04-26

Family

ID=61281472

Family Applications (1)

Application Number Title Priority Date Filing Date
RU2016136226A RU2652451C2 (ru) 2016-09-08 2016-09-08 Способы обнаружения аномальных элементов веб-страниц

Country Status (4)

Country Link
US (1) US10291640B2 (enExample)
JP (1) JP2018041442A (enExample)
CN (1) CN107808095B (enExample)
RU (1) RU2652451C2 (enExample)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2638710C1 (ru) * 2016-10-10 2017-12-15 Акционерное общество "Лаборатория Касперского" Способы обнаружения вредоносных элементов веб-страниц
US11509540B2 (en) 2017-12-14 2022-11-22 Extreme Networks, Inc. Systems and methods for zero-footprint large-scale user-entity behavior modeling
RU2702080C1 (ru) * 2018-06-29 2019-10-03 Акционерное общество "Лаборатория Касперского" Способ блокировки сетевых соединений с ресурсами из запрещенных категорий
US20200019583A1 (en) * 2018-07-11 2020-01-16 University Of Southern California Systems and methods for automated repair of webpages
GB2596502B (en) 2020-01-06 2023-01-04 British Telecomm Crypto-jacking detection
GB202000129D0 (en) 2020-01-06 2020-02-19 British Telecomm Distributed transactional database consensus
CN111597107B (zh) * 2020-04-22 2023-04-28 北京字节跳动网络技术有限公司 信息输出方法、装置和电子设备
US11811824B2 (en) * 2020-06-08 2023-11-07 Target Brands, Inc. Security system for detecting malicious actor's observation
CN112434238A (zh) * 2020-11-25 2021-03-02 平安普惠企业管理有限公司 网页质量检测方法、装置、电子设备及存储介质
CN120832456A (zh) * 2024-04-23 2025-10-24 北京字跳网络技术有限公司 一种显示状态确定方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2133809A2 (en) * 2008-06-10 2009-12-16 Intel Corporation Techniques to establish trust of a web page to prevent malware redirects from web searches or hyperlinks
RU2446459C1 (ru) * 2010-07-23 2012-03-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ проверки веб-ресурсов на наличие вредоносных компонент
US20120304296A1 (en) * 2011-05-13 2012-11-29 Amichai Shulman Detecting web browser based attacks using browser response comparison tests launched from a remote source
US8364811B1 (en) * 2010-06-30 2013-01-29 Amazon Technologies, Inc. Detecting malware
RU2571594C2 (ru) * 2010-08-25 2015-12-20 Лукаут, Инк. Система и способ защиты от вредоносного программного обеспечения, связывающаяся с сервером

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1176432C (zh) * 1999-07-28 2004-11-17 国际商业机器公司 提供本国语言查询服务的方法和系统
US8544087B1 (en) 2001-12-14 2013-09-24 The Trustess Of Columbia University In The City Of New York Methods of unsupervised anomaly detection using a geometric framework
JP4652741B2 (ja) * 2004-08-02 2011-03-16 インターナショナル・ビジネス・マシーンズ・コーポレーション 異常検出装置、異常検出方法、異常検出プログラム、及び記録媒体
US8225401B2 (en) 2008-12-18 2012-07-17 Symantec Corporation Methods and systems for detecting man-in-the-browser attacks
AU2011209673B2 (en) 2010-01-26 2015-11-19 Emc Corporation System and method for network security including detection of man-in-the-browser attacks
WO2012154657A2 (en) 2011-05-06 2012-11-15 The Penn State Research Foundation Robust anomaly detection and regularized domain adaptation of classifiers with application to internet packet-flows
EP2725512B1 (en) * 2012-10-23 2019-03-27 Verint Systems Ltd. System and method for malware detection using multi-dimensional feature clustering
US9225737B2 (en) 2013-03-15 2015-12-29 Shape Security, Inc. Detecting the introduction of alien content
KR101758055B1 (ko) * 2014-10-27 2017-07-14 삼성에스디에스 주식회사 환자 개인 특성에 대한 분석 방법 및 그 장치
US9979748B2 (en) * 2015-05-27 2018-05-22 Cisco Technology, Inc. Domain classification and routing using lexical and semantic processing
US9923916B1 (en) * 2015-06-17 2018-03-20 Amazon Technologies, Inc. Adaptive web application vulnerability scanner

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2133809A2 (en) * 2008-06-10 2009-12-16 Intel Corporation Techniques to establish trust of a web page to prevent malware redirects from web searches or hyperlinks
US8364811B1 (en) * 2010-06-30 2013-01-29 Amazon Technologies, Inc. Detecting malware
RU2446459C1 (ru) * 2010-07-23 2012-03-27 Закрытое акционерное общество "Лаборатория Касперского" Система и способ проверки веб-ресурсов на наличие вредоносных компонент
RU2571594C2 (ru) * 2010-08-25 2015-12-20 Лукаут, Инк. Система и способ защиты от вредоносного программного обеспечения, связывающаяся с сервером
US20120304296A1 (en) * 2011-05-13 2012-11-29 Amichai Shulman Detecting web browser based attacks using browser response comparison tests launched from a remote source

Also Published As

Publication number Publication date
RU2016136226A3 (enExample) 2018-03-15
RU2016136226A (ru) 2018-03-15
JP2018041442A (ja) 2018-03-15
US10291640B2 (en) 2019-05-14
CN107808095A (zh) 2018-03-16
CN107808095B (zh) 2021-03-26
US20180069880A1 (en) 2018-03-08

Similar Documents

Publication Publication Date Title
RU2638710C1 (ru) Способы обнаружения вредоносных элементов веб-страниц
US10291640B2 (en) System and method for detecting anomalous elements of web pages
RU2610254C2 (ru) Система и способ определения измененных веб-страниц
RU2637477C1 (ru) Система и способ обнаружения фишинговых веб-страниц
KR101724307B1 (ko) 악성코드를 검출하는 방법 및 시스템
US12634302B2 (en) Malicious traffic identification method and related apparatus
CN109768992B (zh) 网页恶意扫描处理方法及装置、终端设备、可读存储介质
US20180176242A1 (en) Access classifying device, access classifying method, and access classifying program
JP6708794B2 (ja) 判定装置、判定方法、および、判定プログラム
US20190297092A1 (en) Access classification device, access classification method, and recording medium
CN109492403B (zh) 一种漏洞检测方法及装置
JP6691240B2 (ja) 判定装置、判定方法、および、判定プログラム
JP2020109611A (ja) コンピュータシステム内の悪意のあるアクティビティの源を検出するシステムおよび方法
US20260111568A1 (en) Method and system for the automatic detection of cyber vulnerabilities in an api
CN119766546A (zh) 攻击行为检测方法、装置、设备及介质
EP3306511B1 (en) System and methods of detecting malicious elements of web pages
EP3293661A1 (en) System and method for detecting anomalous elements of web pages
RU2659741C1 (ru) Способы обнаружения аномальных элементов веб-страниц на основании статистической значимости
CN118509220B (zh) 基于蜜罐的零日漏洞攻击捕获方法及电子设备
CN115065540B (zh) 检测web漏洞攻击的方法、装置和电子设备
RU2813242C1 (ru) Способ обнаружения фишинговых сайтов и система его реализующая
RU2811375C1 (ru) Система и способ формирования классификатора для обнаружения фишинговых сайтов при помощи хешей объектов DOM
CN119299112A (zh) 用于使用大型语言模型来响应信息安全事故的系统和方法
CN115514539A (zh) 一种网络攻击的防护方法及装置、存储介质及电子设备
CN118054960A (zh) 基于图注意力神经网络的钓鱼网站检测方法、装置、设备及介质