Patent ID: 11941491
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to receive a Hypertext Markup Language (HTML) file, the processor configured to extract a set of features from the HTML file,
the processor configured to provide an indication of the set of features extracted from the HTML file as a first input to a machine learning model to produce a first malicious content classification,
the processor configured to remove a subtree of the HTML file to define a modified HTML file, the modified HTML file having a valid HTML format and being interpretable,
the processor configured to extract a set of features from the modified HTML file, the processor configured to provide an indication of the set of features extracted from the modified HTML file as a second input to the machine learning model to produce a second malicious content classification, the second malicious content classification being made by the same machine learning model as the first malicious content classification and for the modified HTML file defined by the removal of the subtree from the HTML file,
the processor configured to determine a difference between the first malicious content classification and the second malicious content classification based on a distance measure,
the processor configured to identify an impact of the subtree of the HTML file on the first malicious content classification of the HTML file based on the difference between the first malicious content classification and the second malicious content classification,
the processor configured to store, in a database, an indication of the impact as associated with the subtree of the HTML file.