System and method for webpage analysis

Patent metadata

Field	Value
Publication number	US-9614862-B2
Application number	US-201313949570-A
Country	US
Kind code	B2
Filing date	Jul 24, 2013
Priority date	Jul 24, 2013
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

A system and method for classifying a webpage may include generating, by an analysis server, a first representation of a webpage. A system and method may include generating, by a unit installed in a user web browser, a second representation of the webpage and the method may comprise producing a classification of the webpage by relating the first representation to the second representation.

First claim

What is claimed is:

1. A method of classifying a webpage, the method comprising:
producing, by a hardware analysis server computer, a baseline pool, the baseline pool including data, the data including a plurality of normalized string representations of a respective plurality of webpages served by a web server, wherein producing each of a normalized string representation of the plurality of a normalized string representations of a webpage further comprises:
for each webpage of the plurality of webpages:
creating an empty output string;
for each element of the webpage:
i) determine if the element is a known element,
ii) if the element is a known element adding the element and its attributes to the empty output string, and
iii) if the element is not a known element, refraining from adding the element to the empty output string; and

setting the corresponding normalized string representation of the current webpage to the empty output string;
obtaining, from a web browser, a string representation of the webpage received by the web browser from the web server; and

producing, by the hardware analysis server, a classification of the webpage by
i) determining a sequence having a maximum string length from all strings in the baseline pool that are a subsequence of the string representation;
ii) selecting a minimal set size of consecutive substrings from the sequence that is required to reconstruct the string representation, and
iii) if any of the substrings in the sequence contain an HTML script tag, an HTML input tag, or a URL having different domain names, then classify the webpage as suspect.

2. The method of claim 1 , comprising:
producing, by a unit in the web browser, the string representation of the webpage;
generating, by the unit in the web browser, a unique identification parameter;
sending, by the unit in the web browser, the unique identification parameter to the web server;
sending, by the unit in the web browser, the unique identification parameter and the string representation of the webpage to the analysis server;
producing, by the hardware analysis server, a pre-classification for the webpage based on the string representation of the webpage and storing the pre-classification in association with the unique identification parameter;
sending the unique identification parameter from the web server to the analysis server;
using the unique identification parameter to locate the pre-classification at the analysis server; and
producing the classification based on the pre-classification.

3. The method of claim 1 , comprising:
receiving the webpage from the web server by the analysis server;
generating, by the hardware analysis server, a normalized string representation of the webpage as received by the analysis server; and
producing the classification by relating the normalized string representation of the webpage as received by the analysis server to the string representation of the webpage as received by the web browser.

4. The method of claim 2 , comprising producing the classification based on determining an element included in the webpage as received by the web browser is not included in the webpage as received by a controlled browser included in the analysis server.

5. The method of claim 2 , comprising:
collecting, by the unit in the web browser, device data related to a user computing device;
sending, by the unit in the web browser, the device data to the analysis server; and
using the device data to produce the classification.

6. The method of claim 2 , comprising:
collecting, by the unit in the web server, server data related to the web server;
sending the server data to the hardware analysis server; and
using the server data to produce the classification.

7. The method of claim 2 , comprising updating the baseline pool based on the string representation of the webpage.

8. The method of claim 1 , comprising:
classifying the webpage received by the web browser as unknown; and
based on a frequency of appearance, classifying the webpage received by the web browser as authentic.

9. A system comprising:
an analysis server computer including:
a memory including a baseline pool including data, the data including a plurality of normalized string representations of a respective plurality of webpages served by a web server; and
a controller, the controller configured to:
produce each normalized string representation of the plurality of a normalized string representation by:
create an empty output string;
for each element of the webpage:
i) determine if the element is a known element,
ii) if the element is a known element adding the element and its attributes to the empty output string, and
iii) if the element is not a known element, refraining from adding the element to the empty output string; and

set a normalized string representation of the webpage to the empty output string;
generate a string representation of the webpage, and
produce a classification of the webpage by
i) determining a sequence having a maximum string length from all strings in the baseline pool that are a subsequence of the string representation;
ii) selecting a minimal set size of consecutive substrings from the sequence that is required to reconstruct the string representation, and
iii) if any of the substrings in the sequence contain an HTML script tag, an HTML input tag, or a URL having different domain names, then classify the webpage as suspect.

10. The system of claim 9 , wherein the controller is configured to:
determine that an element represented in the normalized string representation is not represented in the string representation; and
classify the webpage as suspicious.

11. The system of claim 9 , comprising:
a unit installed in a user web browser and configured to send a parameter identifying the webpage to the controller and to a web server, the web server serving the webpage; and
wherein the controller is configured to receive the parameter from the web server and to use the parameter to locate the classification of the webpage.

12. The system of claim 11 , wherein:
the unit in the web browser is configured:
to collect device data related to a user computing device, and
send the device data to the controller; and
wherein the controller is configured to use the device data to produce the classification.

13. The system of claim 9 , wherein the controller is configured to:
classify the webpage as unknown; and
based on a frequency of appearance, classify the webpage as authentic.

14. The system of claim 9 , wherein the controller is configured to:
generate a baseline pool by obtaining a plurality of webpages using a controlled web browser; and
classify the webpage based on the baseline pool.

15. The system of claim 11 , comprising a unit installed in the web server, the unit configured to:
collect server data related to the web server, and
send the server data to the controller; and
wherein the controller is configured to use the server data to produce the classification.

16. The system of claim 11 , wherein:
the unit installed in the web browser is configured to:
collect device data related to a user computing device, and
send the device data to the controller; and
wherein the controller is configured to use the device data to produce the classification.

Assignees

• Nice-Systems Ltd
• Nice Ltd

Inventors

• Stern Nir
• Cohen Ganor Shlomo
• Farkash Rotem

Classifications

• G06F12/14

  Protection against unauthorised use of memory {or access to memory} · CPC title

• G06F40/12

  Use of codes for handling textual entities · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F17/22

  Physics · mapped topic

• H04L29/06

  Electricity · mapped topic