US 2018/0124109 A1 · TECHNIQUES FOR CLASSIFYING A WEB PAGE BASED UPON FUNCTIONS USED TO RENDER THE WEB PAGE

Abstract

The present disclosure generally relates to web page analysis, and more particularly to a classification system for web pages. The classification system may classify a web page as malicious based upon one or more signatures generated for the web page. For example, the classification system may compare one or more signatures generated for a first web page to one or more signatures generated for a second web page, where the first web page and the second web page are the same web page at different times or different web pages. Based upon a similarity of the signatures, the classification system may output whether the first web page is malicious. For another example, the classification system may include a classification model that is trained based upon one or more signatures for one or more classified web pages. The classification model may output whether the web page is malicious.

Claims20

Dependent claims

A method performed by a computer system, the method comprising:

receiving a document from a server, the document used to render a particular web page;
parsing the document to render the particular web page, wherein parsing the document causes one or more functions to be invoked;
while parsing the document, measuring a number of times each of one or more types of functions is invoked;
generating a first signature for the particular web page, wherein the first signature includes an attribute comprising:
a type of function invoked when parsing the document and
a number of times the type of function was invoked when parsing the document;
determining a classification for the particular web page using the first signature, wherein determining the classification for the particular web page is based upon a second signature of a web page, and wherein a classification indicates whether a web page is malicious;
and
outputting the classification of the particular web page.

6 more elements

A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors of a computer system, the plurality of instructions when executed by the one or more processors cause the one or more processors to:

receive a document from a server, the document used to render a particular web page;
parse the document to render the particular web page, wherein parsing the document causes one or more functions to be invoked;
while parsing the document, measure a number of times each of one or more types of functions is invoked;
generate a first signature for the particular web page, wherein the first signature includes an attribute comprising:
a type of function invoked when parsing the document and
a number of times the type of function was invoked when parsing the document;
determine a classification for the particular web page using the first signature, wherein determining the classification for the particular web page is based upon a second signature of a web page, and wherein a classification indicates whether a web page is malicious;
and
output the classification of the particular web page.

6 more elements

Dependencies are inferred from the claim text.

Techniques for classifying a web page based upon functions used to render the web page

Life of this patent

Techniques for classifying a web page based upon functions used to render the web page

Life of this patent

Abstract

Claims20