BACKGROUND

As the Internet becomes more widespread, network attacks are becoming more and more common. Such network attacks are often embedded into web pages, creating security threats for users of the web pages without hosts of the web pages being aware. For example, one common network attack includes phishing, which is when a web page represents itself as being associated with a false identity in order to obtain sensitive information or other valuables from a user. Many times phishing attacks may be initiated by a malicious third party hacking into a legitimate website provided by a host and embedding software into one or more web pages of the website to facilitate phishing attacks without the host knowing. However, many network attacks are obfuscated in web pages, making it difficult for detection of malicious behavior. For example, a web page may be implemented with dynamic elements (e.g., a function) that are invoked while rendering the web page. Therefore, there is a need in the art to better detect malicious behavior in web pages.

SUMMARY

The present disclosure generally relates to web page analysis, and more particularly to classifying web pages.

In certain embodiments, a classification system may classify a web page as malicious based upon one or more signatures generated for the web page. For example, the classification system may compare one or more signatures generated for a first web page to one or more signatures generated for a second web page, where the first web page and the second web page are (1) the same web page at different times or (2) different web pages. When the first web page is the same web page as the second web page, the classification system may be determining whether the first web page has changed relative to the second web page. When the first web page is different than the second web page, the classification system may be determining whether the first web page is similar to the second web page, where the second web page has been classified as malicious. Based upon the comparison, the classification system may output whether the first web page is malicious.

For another example, the classification system may include a classification model (e.g., a neural network or a decision tree) for classifying the web page as malicious. The classification model may be trained based upon one or more signatures for (1) the web page at different times or (2) one or more classified web pages that are different than the web page.

In some examples, an anomaly detection model (e.g., k-means sigma based model) may be used to confirm that a web page is malicious. The anomaly detection model may distinguish between whether the malicious classification is due to a known pattern or an unknown pattern. If the malicious classification is due to an unknown pattern, information associated with the web page may be reviewed by an administrator to identify the unknown pattern. In such examples, the anomaly detection model may be used in concert with the classification system described above or after the classification model determines that the web page is malicious. The classification model may output whether the web page is malicious.

In one illustrative example, a web page document may be received for rendering a web page. The web page document may be parsed to render the web page. While rendering the web page, one or more functions (e.g., JavaScript) may be invoked. In some examples, when a type of function is invoked, the invocation may be tracked such that when the web page is rendered, a number of times that the type of the function was invoked is recorded.

After the web page is rendered, one or more attributes may be determined for the web page, each attribute associated with one or more functions. In some examples, an attribute associated with multiple functions may include the multiple functions in an ordered list based upon when the functions were invoked in relation to each other (e.g., when a second function is invoked after a first function, the ordered list may include the first function and then the second function). Each attribute may also be associated with a number of times that each function associated with the attribute was invoked to render the web page.

After the one or more attributes are determined, one or more signatures may be generated for the web page, where a signature includes the one or more attributes with a number of times functions associated with each attribute were invoked. In some examples, multiple signatures may be generated, each signature based upon one or more different attributes.

Then, using the one or more signatures, a classification of the web page may be determined as described above. The classification may indicate whether the web page is malicious. After being determined, the classification for the web page may be output. In some examples, when the web page is indicated as being malicious, the classification system may output that the network asset associated with the web page might be malicious. Examples of network assets include domains, hosts, domain name system (DNS) name servers, Internet protocol (IP) addresses, etc.

This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in isolation to determine the scope of the claimed subject matter. The subject matter should be understood by reference to appropriate portions of the entire specification of this patent, any or all drawings, and each claim.

The foregoing, together with other features and examples, will be described in more detail below in the following specification, claims, and accompanying drawings.

