# US 10,872,196 B2 · Techniques for web framework detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,196 B2 - Document ID: US10872196B2 - Status: Granted - Kind: B2 - Application number: 16/506,968 - Filed: 2019-07-09 - Published: 2019-10-31 - Granted: 2020-12-22 - Earliest claimed: 2016-04-26 - Assignees: RiskIQ, Inc. - Applicants: RiskIQ, Inc. - Inventors: Adam Hunt; Jonas Edgeworth; Chris Kiernan; David Pon; Elias Manousos - Web page: https://patentgrep.com/patent/US10872196B2 ## CPC - G06F 40/143: Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD] - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 40/14: Tree-structured documents (parsing G06F40/205; validation G06F40/226) - G06F 40/205: Parsing - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - G06F 40/197: Version control (for software G06F8/71) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are disclosed for analyzing documents to detect web components and the web frameworks in the documents. In at least one embodiment, a network analysis system is provided to passively detect web frameworks of documents. The network analysis system can render a document using a document object model to identify objects in the document that are defined as web components. A hash function may be applied to each of the objects to generate a hash signature for the object. Files defining web frameworks can be downloaded from a repository system. Each file may corresponding to a web component. A hash function is applied content in each file to generate a hash signature. The hash signatures of each file may be compared to the hash signatures of the objects in the document to identify a web component for each object. A web framework can be identified based on the web components. ## Claims ### Claim 1 A method, comprising: processing a structure of a web page; initiating requests for a set of web components in the web page for rendering the web page, for each request: receiving a response to the request; generating a digital signature of the response; comparing the digital signature to a data store of digital signatures; retrieving version information for the digital signature; and grouping the version information with other version information for the web page; determining version changes for web components in the set of web components using the grouped version information; causing display of information about each version change for web components in the set of web components and a security score. ### Claim 2 (depends on 1) The method of claim 1, wherein the information indicates a name of each displayed web component and a version of the web component. ### Claim 3 (depends on 2) The method of claim 2, wherein the information indicates a first date when the web component was first identified and a second date when the web component was most recently identified. ### Claim 4 (depends on 1) The method of claim 1, wherein the web page includes one or more web frameworks. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining one or more web frameworks in the web page using the grouped version information; causing display of information about the one or more web frameworks that includes a name and a version identifier of each of the one or more web frameworks. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining a web framework in the web page using the grouped version information; causing display of information about the web framework that includes a name, a previous version identifier, and a current version identifier of the web framework. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining a web framework in the web page having a best match among a set of web frameworks using the grouped version information. ### Claim 8 (depends on 1) The method of claim 1, wherein the digital signature is generated using a cryptographic hash function. ### Claim 9 (depends on 8) The method of claim 8, wherein the cryptographic hash function is based on an MD5 hashing algorithm. ### Claim 10 (depends on 1) The method of claim 1, wherein the digital signature is generated using a non-cryptographic hash function based on a number hashing algorithm. ### Claim 11 (depends on 1) The method of claim 1, wherein the web page is obtained from a server computer using a web crawler, and wherein the web page is one of a plurality of web page of a website. ### Claim 12 (depends on 1) The method of claim 1, wherein the web page is obtained from a server computer using a uniform resource locator (URL), and wherein the web page is one of a plurality of web page of a website. ### Claim 13 One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of: processing a structure of a web page; initiating requests for a set of web components in the web page for rendering the web page, for each request: receiving a response to the request; generating a digital signature of the response; comparing the digital signature to a data store of digital signatures; retrieving version information for the digital signature; and grouping the version information with other version information for the web page; determining version changes for web components in the set of web components using the grouped version information; causing display of information about each version change for web components in the set of web components and a security score. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, wherein the information indicates a name of each displayed web component and a version of the web component. ### Claim 15 (depends on 14) The one or more non-transitory computer-readable storage media of claim 14, wherein the information indicates a first date when the web component was first identified and a second date when the web component was most recently identified. ### Claim 16 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, wherein the web page includes one or more web frameworks. ### Claim 17 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, further comprising: determining one or more web frameworks in the web page using the grouped version information; causing display of information about the one or more web frameworks that includes a name and a version identifier of each of the one or more web frameworks. ### Claim 18 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, further comprising: determining a web framework in the web page using the grouped version information; causing display of information about the web framework that includes a name, a previous version identifier, and a current version identifier of the web framework. ### Claim 19 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, further comprising: determining a web framework in the web page having a best match among a set of web frameworks using the grouped version information. ### Claim 20 (depends on 13) The one or more non-transitory computer-readable storage media of claim 13, wherein the digital signature is generated using a cryptographic hash function.