System and methods of detecting malicious elements of web pages
Disclosed are system and method for detecting anomalous or malicious elements of a web page. One exemplary method comprises: obtaining data about elements of a tested web page; generating at least one N-dimensional vector characterizing elements of the tested web page; retrieving a statistical model of known malicious web page elements; comparing the at least one N-dimensional vector with clusters of the statistical model of known malicious web page elements, by measuring the distance of the N-dimensional vector of the element and centers of all clusters of the statistical model; and identifying at least one malicious element of the tested web page based on results of the comparison.
1. A method for detecting malicious elements of a web page, the method comprising:
deploying, by a server, on a user device a script configured to:
(i) collect data from web pages accessed by the user device, the data including inline scripts whose executable code is part of a content of the web pages;
(ii) transform the data collected from a web page into at least one N-dimensional vector characterizing elements of the web page, the elements including a number and a type of operators in the inline scripts; and
(iii) transmit, to the server, the at least one N-dimensional vector and predetermined operators and constructions of the elements of the web page;
retrieving, by the server, from a database, a statistical model of known malicious inline scripts organized into one or more clusters based on function;
comparing, by the server, the at least one N-dimensional vector with clusters of the retrieved statistical model, the comparison including measuring a distance of the N-dimensional vector and centers of the one or more clusters; and
identifying, by the server, at least one malicious element of the web page based on results of the comparison when a measure of proximity between the at least one N-dimensional vector and the centers of the one or more clusters is less than a selected threshold value.
2. The method of claim 1 ,
wherein the script is further configured to send the collected data to the server, and
the method further comprising:
calculating, by the server, a hash of the received data;
obtaining, by the server, at least one hash of a known malicious element of the web page from the database; and
comparing, by the server, the calculated hash with the at least one hash to determine whether the at least one element is malicious.
3. The method of claim 1 , further comprising:
storing in the database, by the server, at least one of: the identified malicious element of the web page and a corresponding calculated hash, and the inline script.
4. The method of claim 1 , wherein the script is embedded by an intermediate node located between a web server that provides the web pages and the user device.
5. The method of claim 1 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector, by the script deployed on the user device, includes: constructing an abstract syntactical tree based on settings of the script or by commands from the server.
6. The method of claim 1 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector includes performing at least one of:
quantizing the data, sorting the data, merging the data, grouping the data, configuring data set, inserting values from the data in tables, coding the data, normalizing the data, and scaling the data.
7. The method of claim 1 , wherein the elements of the web page being characterized into the N-dimensional vector further include at least one of: a number and a type of eval operators in the inline scripts, a number of lexicographical order of string parameters of the content of the web pages, and Levenshtein distance between string parameters of different element of the web page.
8. A system for detecting malicious elements of a web page, the system comprising:
a server having at least one processor configured to:
deploy, on a user device, a script configured to: collect data from web pages accessed by the user device, the data including inline scripts whose executable code is part of a content of the web pages, transform the data collected from a web page into at least one N-dimensional vector characterizing elements of the web page, the elements including a number and a type of operators in the inline scripts, and transmit, to the server, the at least one N-dimensional vector and predetermined operators and constructions of the elements of the web page;
retrieve, from a database, a statistical model of known malicious inline scripts organized into one or more clusters based on function;
compare the at least one N-dimensional vector with clusters of the retrieved statistical model, the comparison including measuring a distance of the N-dimensional vector and centers of the one or more clusters; and
identify at least one malicious element of the web page based on results of the comparison when a measure of proximity between the at least one N-dimensional vector and the centers of the one or more clusters is less than a selected threshold value.
9. The system of claim 8 ,
wherein the script is further configured to send the collected data to the server, and p 1 the processor is further configured to:
calculate a hash of the received data;
obtain at least one hash of a known malicious element of the web page from the database; and
compare the calculated hash with the at least one hash to determine whether the at least one element is malicious.
10. The system of claim 8 , the processor further configured to:
store in the database at least one of: the identified malicious element of the web page and a corresponding calculated hash, and the inline script.
11. The system of claim 8 , wherein the script is embedded by an intermediate node located between a web server that provides the web pages and the user device.
12. The system of claim 8 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector, by the script deployed on the user device, includes: constructing an abstract syntactical tree based on settings of the script or by commands from the server.
13. The system of claim 8 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector includes performing at least one of:
quantizing the data, sorting the data, merging the data, grouping the data, configuring data set, inserting values from the data in tables, coding the data, normalizing the data, and scaling the data.
14. The system of claim 8 , wherein the elements of the web page being characterized into the N-dimensional vector further include at least one of: a number and a type of eval operators in the inline scripts, a number of lexicographical order of string parameters of the content of the web pages, and Levenshtein distance between string parameters of different element of the web page.
15. A non-transitory computer readable medium storing thereon computer executable instructions for detecting malicious elements of a web page, including instructions for:
deploying, by a server, on a user device a script configured to:
(i) collect data from web pages accessed by the user device, the data including inline scripts whose executable code is part of a content of the web pages;
(ii) transform the data collected from a web page into at least one N-dimensional vector characterizing elements of the web page, the elements including a number and a type of operators in the inline scripts; and
(iii) transmit, to the server, the at least one N-dimensional vector and predetermined operators and constructions of the elements of the web page;
retrieving, by the server, from a database, a statistical model of known malicious inline scripts organized into one or more clusters based on function;
comparing, by the server, the at least one N-dimensional vector with clusters of the retrieved statistical model, the comparison including measuring a distance of the N-dimensional vector and centers of the one or more clusters; and
identifying, by the server, at least one malicious element of the web page based on results of the comparison when a measure of proximity between the at least one N-dimensional vector and the centers of the one or more clusters is less than a selected threshold value.
16. The non-transitory computer readable medium of claim 5 ,
wherein the script is further configured to send the collected data to the server, and
the instructions further comprise instructions for:
calculating, by the server, a hash of the received data;
obtaining, by the server, at least one hash of a known malicious element of the web page from the database; and
comparing, by the server, the calculated hash with the at least one hash to determine whether the at least one element is malicious.
17. The non-transitory computer readable medium of claim 5 , the instructions further comprising instructions for: storing in the database at least one of: the identified malicious element of the web page and a corresponding calculated hash, and the inline script.
18. The non-transitory computer readable medium of claim 5 , wherein the script is embedded by an intermediate node located between a web server that provides the web pages and the user device.
19. The non-transitory computer readable medium of claim 5 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector, by the script deployed on the user device, includes: constructing an abstract syntactical tree based on settings of the script or by commands from the server.
20. The non-transitory computer readable medium of claim 5 , wherein the transformation of the data collected from the web page into the at least one N-dimensional vector includes performing at least one of: quantizing the data, sorting the data, merging the data, grouping the data, configuring data set, inserting values from the data in tables, coding the data, normalizing the data, and scaling the data.