Patent ID: 11941491
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. The apparatus of claim 1, wherein the HTML file is a first HTML file and the modified HTML file is a first modified HTML file,
the processor configured to add the subtree to a second HTML file to produce a second modified HTML file, the processor configured to extract a set of features from the second modified HTML file, the processor configured to provide an indication of the set of features from the second modified HTML file as a third input to the machine learning model to produce a third malicious content classification,
the processor configured to identify an impact of the subtree on the third malicious content classification, the third malicious content classification being made by the machine learning model and for the second modified HTML file,
the processor configured to classify the subtree as malicious based on (1) the impact of the subtree on the first malicious content classification for the first HTML file and (2) the impact of the subtree on the third malicious content classification for the second modified HTML file.