Systems and methods for detecting and addressing HTML-modifying malware
Among other things, embodiments of the present disclosure help provide entities with the ability to remotely detect behavior associated with malware and identify compromised user-sessions, regardless of the malware variant or family, and independently of the page structure.
1. A method, comprising:
during a training phase, generating a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmitting, by a server computing device to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receiving, by the server computing device, the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device;
analyzing, by the server computing device, the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications; and
in response to the analyzing, generating a risk factor associated with the web page.
2. The method of claim 1 , wherein transmitting the code module includes embedding the code module into the web page.
3. The method of claim 2 , wherein embedding the code module into the web page includes inserting a loader module into the web page and executing the loader module to embed the code module into the web page.
4. The method of claim 1 , wherein the data related to the web page includes a subset of the total elements present in the web page.
5. The method of claim 1 , wherein the data related to the web page includes one or more of: an identifier, a styling detail, a nesting detail, a location of an element within the web page, an element that requests a user of the client computing device to enter data, or a script element.
6. The method of claim 5 , further comprising configuring the code module, by the server computing device and prior to transmission to the client computing device, to retrieve the data related to the web page based on one or more selected page elements.
7. The method of claim 6 , wherein the one or more selected page elements include one or more editable elements.
8. The method of claim 6 , wherein the one or more selected page elements include a script tag.
9. The method of claim 1 , wherein generating the risk factor associated with the web page includes performing a risk-assessment algorithm.
10. The method of claim 9 , wherein the risk-assessment algorithm is only performed in response to a determination by analyzing the data related to the web page that one or more elements in the data related to the web page does not correspond to any pattern in: the one or more patterns associated with non-modified web page states, the one or more patterns associated with malicious web page states, and the one or more patterns associated with innocuous web page modifications.
11. The method of claim 10 , further comprising updating, based on performance of the risk-assessment algorithm, a pattern in one or more of: the one or more patterns associated with non-modified web page states, the one or more patterns associated with malicious web page states, or the one or more patterns associated with innocuous web page modifications.
12. The method of claim 1 , further comprising generating, for the one or more patterns associated with non-modified web page states, a pattern associated with a new version of a web page.
13. The method of claim 1 , further comprising generating a pattern for the one or more patterns associated with malicious web page states.
14. The method of claim 13 , wherein generating the pattern for the one or more patterns associated with malicious web page states includes generating a pattern associated with malware performing an injection to a web page.
15. The method of claim 1 , further comprising generating a pattern for the one or more patterns associated with innocuous web page modifications.
16. The method of claim 15 , wherein generating the pattern for the one or more patterns associated with innocuous web page modifications includes generating a pattern associated with one or more of an extension or a plug-in for a web page.
17. The method of claim 1 , further comprising generating an alert associated with the web page in response to the risk factor meeting or exceeding a predetermined threshold.
18. A system, comprising:
a processor; and
memory coupled to the processor and storing instructions that, when executed by the processor, cause the system to:
during a training phase, generate a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmit, to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receive the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device;
analyze the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications; and
in response to the analyzing, generate a risk factor associated with the web page.
19. A tangible, non-transitory computer-readable medium storing instructions that, when executed by a server computing device, cause the server computing device to:
during a training phase, generate a pattern for one or more patterns associated with non-modified web page states, the pattern based on a state report received from a training machine, wherein the state report comprises an adequate header and is received from an expected IP address;
transmit, to a client computing device over a network, a code module for collecting and transmitting data related to a web page presented on the client computing device;
receive the data related to the web page presented on the client computing device, wherein the data related to the web page is received over the network via the code module operating on the client computing device;
analyze the data related to the web page, wherein analyzing the data related to the web page includes comparing the data to one or more of:
the one or more patterns associated with non-modified web page states;
one or more patterns associated with malicious web page states; or
one or more patterns associated with innocuous web page modifications; and
in response to the analyzing, generate a risk factor associated with the web page.