Security weakness and infiltration detection and repair in obfuscated website content

A method of data security, comprising:

• providing a first server;
• providing a second server containing website content file attribute data for website files comprising host website content;
• determining whether any of the website files contained on the second server have changed by comparing a file change date attribute value of a website file to a stored file change date attribute value stored at the first server for the website file;
• transferring each website file from the second server to the first server where the file change date attribute value of each website file does not match the file change date attribute value stored at the first server for each website file;
• with the first server, analyzing each transferred website file for security breach;
• with the first server, decoding scripting code that is detected within each transferred website file;
• with the first server, executing each transferred website file, the first server configured to isolate and monitor execution of executable content detected in each transferred website file;
• and
• determining security breach content in each transferred website file based on a result of the analyzing, decoding and executing steps.

A method of data security, comprising:

• configuring a first set of servers with website content security breach analysis, detection, and repair functionality;
• downloading website files from a second set of servers that host websites based on the website files to a non-transient memory accessible by the first set of servers;
• analyzing the downloaded website files for data security breach risk factors by comparing file content of the website files to a predetermined set of website characteristics;
• totaling occurrences of each characteristic;
• determining if each characteristic occurrence total should be limited to no more than one by referencing a website dichotomizing list of website characteristics and limiting the characteristic count to no more than one for characteristics that appear on the dichotomizing list to produce a characteristic risk count value;
• processing each characteristic risk count value with a predetermined weight to produce a characteristic contribution value;
• aggregating groups of characteristics into security breach risk groups based on a predetermined list of characteristic groupings and calculating a total group contribution value for each group;
• summing the total group contribution for each group to produce a website data security breach risk total;
• determining a decile within a rare website security breach event prediction range of values that corresponds to the security breach risk total;
• sending an alert based on the determine decile to at least one of the servers in the second set of servers;
• and
• performing a website security protection function for a website that corresponds to the downloaded website files.

A method of determining if a website file is likely to include malicious content comprising:

• generating a content feature indication array that comprises an entry for at least a portion of a plurality of possible content features by populating a corresponding entry in the array for features detected in the file;
• comparing the file content feature indication array of the file to a library of known feature indication arrays, wherein each array in the library is associated with a malicious content classification;
• and
• based on the comparison, associating the file with the content classification that corresponds to the matching library feature array.

A method of updating a library of known feature indication arrays comprising:

• processing a previously unknown array through a statistical similarity analysis model that determines a degree of similarity of the array to known feature indication arrays in the library;
• adding the unknown array to a malicious set of arrays in the library when the statistical analysis model results in a degree of similarity to a plurality of malicious-classified known arrays that exceeds a malicious likelihood threshold;
• and
• adding the unknown array to a non-malicious set of arrays in the library when the statistical analysis model results in a degree of similarity to a plurality of non-malicious-classified known arrays that exceeds a non-malicious likelihood threshold.