Detecting malware in mobile sites

摘要

Behavioral analysis of a mobile webpage is performed to determine whether the webpage is malicious. During analysis, the webpage is visited by an emulated mobile device to cause behaviors to occur which may be malicious. The behaviors occurring after accessing the webpage are stored. The behaviors are classified as hard or soft signals. A probability of the webpage being malicious is determined through combining soft signals, and the webpage is classified as malicious or non-malicious. Users of the webpage, the developer of the webpage, or a distributor of the webpage are notified of the webpage classification to enable responsive action.

主权项

1. A computer-implemented method for analyzing webpages for malware, the method comprising:
receiving a uniform resource locator (URL); performing analysis on a webpage associated with the URL to determine programming languages and plug-ins used on the webpage; accessing the webpage on a web browser in an emulated environment, the emulated environment simulating a mobile device; observing and storing behaviors of the simulated mobile device after accessing the webpage; and classifying the mobile webpage as malicious or non-malicious based on the observed and stored behaviors.