Systems and methods for detecting malicious activity on a web server
Disclosed herein are systems and method for detecting malicious activity on a web server. A method may include: retrieving a first backup and a second backup of a web server from a backup archive that stores a plurality of backups of the web server, wherein the first backup was generated at a first time and the second backup was generated at a second time; detecting at least one change between the first backup and the second backup; determining whether the at least one change is associated with malicious activity based on a plurality of security rules and a plurality of machine learning models and a severity of the malicious activity; and in response to determining that the severity is greater than a threshold severity, executing a rollback function of the web server to a backup that does not include the malicious activity.
1 . A method for detecting malicious activity on a web server, the method comprising:
retrieving a first backup and a second backup of a web server from a backup archive that stores a plurality of backups of the web server, wherein the first backup was generated at a first time and the second backup was generated at a second time;
detecting at least one change between the first backup and the second backup;
determining whether the at least one change is associated with malicious activity based on a plurality of security rules and a plurality of machine learning models, by:
determining a rule verdict on whether the at least one change violates one or more of the plurality of security rules;
inputting a file corresponding to the at least one change in a first machine learning model configured to verify whether an input change originates from an authorized channel;
inputting the file in a second machine learning model configured to verify if a webpage associated with the file is a phishing webpage;
inputting the rule verdict, an output of the first machine learning model, and an output of the second machine learning model into a third machine learning model configured to generate a severity of malicious activity on the web server; and
in response to determining that the severity is greater than a threshold severity, executing a rollback function of the web server to a backup that does not include the malicious activity.
2 . The method of claim 1 , wherein the file is an image, and wherein determining whether the at least one change is associated with the malicious activity further comprises:
inputting the file in a fourth machine learning model configured to determine whether the file comprises an authentic logo; and
inputting an output of the fourth machine learning model in the third machine learning model.
3 . The method of claim 1 , wherein determining whether the at least one change is associated with the malicious activity further comprises:
inputting the file in a fifth machine learning model configured to determine whether the file comprises malicious binaries; and
inputting an output of the fifth machine learning model in the third machine learning model.
4 . The method of claim 1 , wherein the web server comprises a plurality of websites, wherein each of the plurality of websites comprises one or more web pages, and wherein the first backup and the second backup comprise files of a specific website of the plurality of websites.
5 . The method of claim 1 , wherein detecting at least one change between the first backup and the second backup further comprises executing a sixth machine learning model that detects changes across one or more input backups.
6 . The method of claim 1 , wherein detecting at least one change between the first backup and the second backup comprises:
detecting that a hash value of the file in the first backup differs from a hash value of the file in the second backup.
7 . The method of claim 1 , wherein detecting at least one change between the first backup and the second backup comprises:
detecting that a file version number of the file in the first backup differs from a file version number of the file in the second backup.
8 . The method of claim 1 , further comprising:
identifying a webpage associated with the file corresponding to the at least one change;
executing the webpage in a sandbox;
determining a verdict of whether the webpage comprises malicious activity; and
inputting the verdict in the third machine learning model.
9 . The method of claim 1 , wherein the web server is part of a plurality of web servers, further comprising:
identifying each web server of the plurality of web servers that comprises the file; and
executing the rollback function on each of the plurality of web servers.
10 . A system for detecting malicious activity on a web server, comprising:
at least one memory;
at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
retrieve a first backup and a second backup of a web server from a backup archive that stores a plurality of backups of the web server, wherein the first backup was generated at a first time and the second backup was generated at a second time;
detect at least one change between the first backup and the second backup;
determine whether the at least one change is associated with malicious activity based on a plurality of security rules and a plurality of machine learning models, by:
determining a rule verdict on whether the at least one change violates one or more of the plurality of security rules;
inputting a file corresponding to the at least one change in a first machine learning model configured to verify whether an input change originates from an authorized channel;
inputting the file in a second machine learning model configured to verify if a webpage associated with the file is a phishing webpage;
inputting the rule verdict, an output of the first machine learning model, and an output of the second machine learning model into a third machine learning model configured to generate a severity of malicious activity on the web server; and
in response to determining that the severity is greater than a threshold severity, execute a rollback function of the web server to a backup that does not include the malicious activity.
11 . The system of claim 10 , wherein the file is an image, and wherein determining whether the at least one change is associated with the malicious activity further comprises:
inputting the file in a fourth machine learning model configured to determine whether the file comprises an authentic logo; and
inputting an output of the fourth machine learning model in the third machine learning model.
12 . The system of claim 10 , wherein determining whether the at least one change is associated with the malicious activity further comprises:
inputting the file in a fifth machine learning model configured to determine whether the file comprises malicious binaries; and
inputting an output of the fifth machine learning model in the third machine learning model.
13 . The system of claim 10 , wherein the web server comprises a plurality of websites, wherein each of the plurality of websites comprises one or more web pages, and wherein the first backup and the second backup comprise files of a specific website of the plurality of websites.
14 . The system of claim 10 , wherein detecting at least one change between the first backup and the second backup further comprises executing a sixth machine learning model that detects changes across one or more input backups.
15 . The system of claim 10 , wherein detecting at least one change between the first backup and the second backup comprises:
detecting that a hash value of the file in the first backup differs from a hash value of the file in the second backup.
16 . The system of claim 10 , wherein detecting at least one change between the first backup and the second backup comprises:
detecting that a file version number of the file in the first backup differs from a file version number of the file in the second backup.
17 . The system of claim 10 , further comprising:
identifying a webpage associated with the file corresponding to the at least one change;
executing the webpage in a sandbox;
determining a verdict of whether the webpage comprises malicious activity; and
inputting the verdict in the third machine learning model.
18 . The system of claim 10 , wherein the web server is part of a plurality of web servers, further comprising:
identifying each web server of the plurality of web servers that comprises the file; and
executing the rollback function on each of the plurality of web servers.
19 . A non-transitory computer readable medium storing thereon computer executable instructions for detecting malicious activity on a web server, including instructions for:
retrieving a first backup and a second backup of a web server from a backup archive that stores a plurality of backups of the web server, wherein the first backup was generated at a first time and the second backup was generated at a second time;
detecting at least one change between the first backup and the second backup;
determining whether the at least one change is associated with malicious activity based on a plurality of security rules and a plurality of machine learning models, by:
determining a rule verdict on whether the at least one change violates one or more of the plurality of security rules;
inputting a file corresponding to the at least one change in a first machine learning model configured to verify whether an input change originates from an authorized channel;
inputting the file in a second machine learning model configured to verify if a webpage associated with the file is a phishing webpage;
inputting the rule verdict, an output of the first machine learning model, and an output of the second machine learning model into a third machine learning model configured to generate a severity of malicious activity on the web server; and
in response to determining that the severity is greater than a threshold severity, executing a rollback function of the web server to a backup that does not include the malicious activity.