Systems and methods for detecting the injection of malicious elements into benign content
A method, system, and computer-usable medium are disclosed for include receiving a first version of content from a resource, generating a first lightweight fingerprint for the first version of the content, receiving a second version of the content from the same resource, generating a second lightweight fingerprint for the second version of the content, comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version, and determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content have remained substantially static between the first version and the second version and determining that potentially-injected sections of the content has substantially changed between the first version and the second version.
1. A computer-implementable method comprising:
receiving a first version of content from a resource;
generating a first lightweight fingerprint for the first version of the content;
receiving a second version of the content from the same resource;
generating a second lightweight fingerprint for the second version of the content;
comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version; and
determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content has remained substantially static between the first version and the second version and determining that potentially-injected sections of the content have substantially changed between the first version and the second version.
2. The computer-implementable method of claim 1 , further comprising taking remedial action responsive to determining the content to include potentially malicious elements.
3. The computer-implementable method of claim 1 , further comprising determining a low likelihood of potentially malicious elements responsive to one of:
a first condition comprising determining that potentially-injected sections of the content have remained substantially static between the first version and the second version; and
a second condition comprising determining that the non-injectable section of the content has substantially changed between the first version and the second version.
4. The computer-implementable method of claim 1 , wherein generating a lightweight fingerprint comprising one of the first lightweight fingerprint and the second lightweight fingerprint comprises:
partitioning content into a plurality of sections including an outline section associated with non-injectable content of the content and at least one potentially-injectable section wherein each of the at least one potentially-injectable section is associated with a potentially-injectable element of the content;
generating respective individual fingerprints for each of the outline section and the at least one potentially-injectable section; and
combining the respective individual fingerprints to form the lightweight fingerprint.
5. The computer-implementable method of claim 4 , wherein generating an individual fingerprint for one of the outline section and an embedded script section of the at least one potentially-injectable section comprises generating a winnowing hash for the outline section.
6. The computer-implementable method of claim 4 , wherein generating an individual fingerprint for one of an external script section and an iframe section of the at least one potentially-injectable section comprises generating a two-part fingerprint comprising a host name and a final file name.
7. The computer-implementable method of claim 1 , wherein the content comprises a HyperText Markup Language file for rendering a web page.
8. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving a first version of content from a resource;
generating a first lightweight fingerprint for the first version of the content;
receiving a second version of the content from the same resource;
generating a second lightweight fingerprint for the second version of the content;
comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version; and
determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content has remained substantially static between the first version and the second version and determining that potentially-injected sections of the content have substantially changed between the first version and the second version.
9. The system of claim 8 , the instructions further configured for taking remedial action responsive to determining the content to include potentially malicious elements.
10. The system of claim 8 , the instructions further configured for determining a low likelihood of potentially malicious elements responsive to one of:
a first condition comprising determining that potentially-injected sections of the content have remained substantially static between the first version and the second version; and
a second condition comprising determining that the non-injectable section of the content has substantially changed between the first version and the second version.
11. The system of claim 8 , wherein generating a lightweight fingerprint comprising one of the first lightweight fingerprint and the second lightweight fingerprint comprises:
partitioning content into a plurality of sections including an outline section associated with non-injectable content of the content and at least one potentially-injectable section wherein each of the at least one potentially-injectable section is associated with a potentially-injectable element of the content;
generating respective individual fingerprints for each of the outline section and the at least one potentially-injectable section; and
combining the respective individual fingerprints to form the lightweight fingerprint.
12. The system of claim 11 , wherein generating an individual fingerprint for one of the outline section and an embedded script section of the at least one potentially-injectable section comprises generating a winnowing hash for the outline section.
13. The system of claim 11 , wherein generating an individual fingerprint for one of an external script section and an iframe section of the at least one potentially-injectable section comprises generating a two-part fingerprint comprising a host name and a final file name.
14. The system of claim 8 , wherein the content comprises a HyperText Markup Language file for rendering a web page.
15. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
receiving a first version of content from a resource;
generating a first lightweight fingerprint for the first version of the content;
receiving a second version of the content from the same resource;
generating a second lightweight fingerprint for the second version of the content;
comparing the first lightweight fingerprint to the second lightweight fingerprint to determine changes to a non-injectable section of the content and potentially-injected sections of the content between the first version and the second version; and
determining the content to include potentially malicious elements responsive to determining that the non-injectable section of the content has remained substantially static between the first version and the second version and determining that potentially-injected sections of the content have substantially changed between the first version and the second version.
16. The storage medium of claim 15 , the instructions further configured for taking remedial action responsive to determining the content to include potentially malicious elements.
17. The storage medium of claim 15 , the instructions further configured for determining a low likelihood of potentially malicious elements responsive to one of:
a first condition comprising determining that potentially-injected sections of the content have remained substantially static between the first version and the second version; and
a second condition comprising determining that the non-injectable section of the content has substantially changed between the first version and the second version.
18. The storage medium of claim 15 , wherein generating a lightweight fingerprint comprising one of the first lightweight fingerprint and the second lightweight fingerprint comprises:
partitioning content into a plurality of sections including an outline section associated with non-injectable content of the content and at least one potentially-injectable section wherein each of the at least one potentially-injectable section is associated with a potentially-injectable element of the content;
generating respective individual fingerprints for each of the outline section and the at least one potentially-injectable section; and
combining the respective individual fingerprints to form the lightweight fingerprint.
19. The storage medium of claim 18 , wherein generating an individual fingerprint for one of the outline section and an embedded script section of the at least one potentially-injectable section comprises generating a winnowing hash for the outline section.
20. The storage medium of claim 18 , wherein generating an individual fingerprint for one of an external script section and an iframe section of the at least one potentially-injectable section comprises generating a two-part fingerprint comprising a host name and a final file name.
21. The storage medium of claim 15 , wherein the content comprises a HyperText Markup Language file for rendering a web page.