Systems and methods for detecting and addressing HTML-modifying malware
Among other things, embodiments of the present disclosure help provide entities with the ability to remotely detect behavior associated with malware and identify compromised user-sessions, regardless of the malware variant or family, and independently of the page structure.
1. A method, comprising:
during a training phase, generating a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmitting, by a server computing device to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receiving, by the server computing device, the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device, wherein the data related to the web page comprises elements that request a user of the client computing device to enter data, and wherein the elements are mapped to a representation in a form of a tree structure containing details of input fields nested inside details of a form element;
analyzing, by the server computing device, the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications;
in response to the analyzing, generating a risk factor associated with the web page;
in response to identifying the web page as a potential risk, classifying the web page into a first classification of a plurality of classifications, wherein the identifying is based on the elements mapped to the representation in the form of the tree structure;
after classifying the web page into the first classification, generating a first pattern associated with the first classification, the first pattern comprising a modification of the web page performed by malware;
providing a label identifying the modification of the web page, the label comprising an identifier of the malware performing the modification;
generating updated patterns by training using the first pattern and the one or more patterns associated with the malicious web page states; and
analyzing data related to a second web page presented on the client computing device, wherein analyzing the data related to the second web page includes comparing the data to the updated patterns.
2. The method of claim 1 , wherein transmitting the code module includes embedding the code module into the web page.
3. The method of claim 2 , wherein embedding the code module into the web page includes inserting a loader module into the web page and executing the loader module to embed the code module into the web page.
4. The method of claim 1 , wherein the data related to the web page includes a subset of the total elements present in the web page.
5. The method of claim 1 , wherein the data related to the web page further includes one or more of: an identifier, a styling detail, a location of an element within the web page, or a script element.
6. The method of claim 5 , further comprising configuring the code module, by the server computing device and prior to transmission to the client computing device, to retrieve the data related to the web page based on one or more selected page elements.
7. The method of claim 6 , wherein the one or more selected page elements include one or more editable elements.
8. The method of claim 6 , wherein the one or more selected page elements include a script tag.
9. The method of claim 1 , wherein generating the risk factor associated with the web page includes performing a risk-assessment algorithm.
10. The method of claim 9 , wherein the risk-assessment algorithm is only performed in response to a determination by analyzing the data related to the web page that one or more elements in the data related to the web page does not correspond to any pattern in: the one or more patterns associated with non-modified web page states, the one or more patterns associated with malicious web page states, and the one or more patterns associated with innocuous web page modifications.
11. The method of claim 10 , further comprising updating, based on performance of the risk-assessment algorithm, a pattern in one or more of: the one or more patterns associated with non-modified web page states, the one or more patterns associated with malicious web page states, or the one or more patterns associated with innocuous web page modifications.
12. The method of claim 1 , further comprising generating, for the one or more patterns associated with non-modified web page states, a pattern associated with a new version of a web page.
13. The method of claim 1 , further comprising generating a pattern for the one or more patterns associated with malicious web page states.
14. The method of claim 13 , wherein generating the pattern for the one or more patterns associated with malicious web page states includes generating a pattern associated with malware performing an injection to a web page.
15. The method of claim 1 , further comprising generating a pattern for the one or more patterns associated with innocuous web page modifications.
16. The method of claim 15 , wherein generating the pattern for the one or more patterns associated with innocuous web page modifications includes generating a pattern associated with one or more of an extension or a plug-in for a web page.
17. The method of claim 1 , further comprising generating an alert associated with the web page in response to the risk factor meeting or exceeding a predetermined threshold.
18. A system, comprising:
a processor; and
memory coupled to the processor and storing instructions that, when executed by the processor, cause the system to:
during a training phase, generate a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmit, to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receive the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device, wherein the data related to the web page comprises elements that request a user of the client computing device to enter data, and wherein the elements are mapped to a representation in a form of a tree structure containing details of input fields nested inside a form element;
analyze the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications;
in response to the analyzing, generate a risk factor associated with the web page;
in response to identifying the web page as a potential risk, classify the web page into a first classification of a plurality of classifications, wherein the identifying is based on the elements mapped to the representation in the form of the tree structure;
after classifying the web page into the first classification, generate a first pattern associated with the first classification, the first pattern comprising a modification of the web page performed by malware;
provide a label identifying the modification of the web page, the label comprising an identifier of the malware performing the modification;
generate updated patterns by training using the first pattern and the one or more patterns associated with the malicious web page states; and
analyze data related to a second web page presented on the client computing device, wherein analyzing the data related to the second web page includes comparing the data to the updated patterns.
19. A tangible, non-transitory computer-readable medium storing instructions that, when executed by a server computing device, cause the server computing device to:
during a training phase, generate a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmit, to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receive the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device, wherein the data related to the web page comprises elements mapped to a representation in a form of a tree structure containing details of input fields nested inside a form element;
analyze the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications;
in response to the analyzing, generate a risk factor associated with the web page;
in response to identifying the web page as a potential risk, classify the web page into a first classification of a plurality of classifications, wherein the identifying is based on the elements mapped to the representation in the form of the tree structure:
after classifying the web page into the first classification, generate a first pattern associated with the first classification, the first pattern comprising a modification of the web page performed by malware;
generate updated patterns by training using the first pattern; and
analyze data related to a second web page presented on the client computing device, wherein analyzing the data related to the second web page includes comparing the data to the updated patterns.