Detecting changes to web page characteristics using machine learning

Patent metadata

Field	Value
Publication number	US-12401686-B2
Application number	US-201816636282-A
Country	US
Kind code	B2
Filing date	Jul 30, 2018
Priority date	Aug 2, 2017
Publication date	Aug 26, 2025
Grant date	Aug 26, 2025

Abstract

A computer implemented method to detect an anomalous change to a web application, the web application executing with a web server, the method including receiving a first set of records for the web application operating in a training mode of operation, each record including characteristics of a content of a web page for the web application; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the web application in the training mode of operation; receiving a second set of records for the web application, each record including characteristics of content of the web page; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the web page.

First claim

The invention claimed is:

1. A computer implemented method to detect an anomalous change to a configuration of a web application, the web application executing with a web server, the method comprising:
receiving a first set of distinct records for the web application operating in a training mode of operation during which the web application is isolated from a wide area network, each record in the first set of distinct records including characteristics of a content of a web page the web application during a training time period;
generating a sparse distributed representation of the first set of distinct records to form a training set for a hierarchical temporal memory (HTM);
training the HTM based on the training set in order that the trained HTM provides a model of operation of the web application in the training mode of operation, wherein the HTM evaluates an anomaly score for the records in the first set of distinct records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly;
receiving a second set of distinct records for the web application, each record in the second set of distinct records including characteristics of the web application during an operational time period, the operational time period being distinct from the training time period;
generating a sparse distributed representation of the second set of distinct records to form an input set for the trained HTM;
executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set;
responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the configuration of the web page; and
in response to the identification of the anomalous change to the web page, causing a responsive measure to the anomalous change to be implemented that includes one or more of the following actions:
interrupting operation of the web application;
identifying client components in communication with the web application as potentially compromised;
executing at least one of an intrusion detection, malware detection, virus removal, or a malware removal process for the web application; or
effecting at least one of a redeployment, a reinstallation, or a reconfiguration of the web application.

2. The method of claim 1 , wherein the characteristics of the web page include records corresponding to hypertext markup language (HTML) tags in the web page.

3. A computer system comprising:
a processor and memory storing computer program code for detecting an anomalous change to a configuration of a web application, the web application executing with a web server, by:
receiving a first set of distinct records for the web application operating in a training mode of operation during which the web application is isolated from a wide area network, each record in the first set of distinct records including characteristics of a content of a web page for the web application during a training time period;
generating a sparse distributed representation of the first set of distinct records to form a training set for a hierarchical temporal memory (HTM);
training the HTM based on the training set in order that the trained HTM provides a model of operation of the web application in the training mode of operation, wherein the HTM evaluates an anomaly score for the records in the first set of distinct records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly;
receiving a second set of records for the web application operating in a production mode of operation, each record in the second set of records including characteristics of content of the web page during an operational time period, the operational time period being distinct from the training time period and the production mode of operation being distinct from the training mode of operation;
generating a sparse distributed representation of the second set of distinct records to form an input set for the trained HTM;
executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set;
responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the web page; and
responsive to the identification of the anomalous change to the web page, causing a responsive measure to the anomalous change to be implemented that includes one or more of the following actions:
interrupting operation of the web application;
identifying client components in communication with the web application as potentially compromised;
executing at least one of an intrusion detection, malware detection, virus removal, or a malware removal process for the web application; or
effecting at least one of a redeployment, a reinstallation, or a reconfiguration of the web application.

4. A non-transitory computer-readable storage element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

Assignees

• British Telecomm

Inventors

• El-Moussa Fadi
• Du Xiaofeng

Classifications

• G06N3/0495

  Quantised networks; Sparse networks; Compressed networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title

• G06N3/08

  Learning methods · CPC title