System and method for protecting services by detecting client web page tampering

Abstract

Systems and methods are provided for client web page tampering assessment and fraud prevention by detecting one or more events of user-specific behavior without typical features. A method is provided for monitoring a web document associated with a Document Object Model (DOM) of a browsing session of a user, capturing one or more event-based variations in the web document, and retrieving user behavior metric history data from a file repository. In response to comparing the one or more event-based variations to the user behavior metric history data, the method may include rejecting continued browsing of the session based on a predetermined similarity mismatch of the one or more event-based variations to entries in the user behavior metric history data, and outputting one or more indications of potential fraud.

Description

Technical Field

[0001] The technology of the present disclosure relates generally to Internet browsing security and, more particularly, to systems and methods for detecting and preventing fraudulent client network modifications that are not typical of a particular user. Background Art

[0002] Web page tampering is closely associated with fraud, especially when client-side modifications to web pages are made through developer tools and / or through remote access. For example, a fraudster could cause the visible content on a user's web browser to differ from the expected code / content served by a web server. This type of tampering can make it easy for a fraudster to cause a user to unknowingly perform unintended actions.

[0003] An example of web page defacement might involve a social engineering scam by a fraudster posing as a "tech support agent" who convinces a user to give the fraudster remote access to the user's computing device. Once access is provided, the fraudster might use script injection or other custom code to fill out online transaction forms, secretly changing the values ​​in the fields / code in a way that does not change what is displayed to the user. Such defacement could include multiplying monetary values, registering another beneficiary of a monetary transaction in a form field, redirecting transactions, etc. Such value changes could occur in less than a millisecond and would be invisible to the end user.

[0004] Script injection can currently be detected by comparing the scripts used in the document interface to a set of allowed scripts. However, using this method to check for allowed scripts requires pre-configuration and may not detect transient scripts that can be added to a document but removed before the document is replaced (e.g., when the user navigates to another page). Often, such scripts are added and removed from documents as soon as the code is executed. In some cases, the generated code will still be present in the process even after the script is removed, which can be highly correlated with fraudulent intent.

[0005] Injected script detection using traditional methods does not work reliably because such methods only run at specific points in a user's journey through a web page, or at set intervals. Using traditional methods to detect script injections in millisecond timeframes can severely degrade the user interface and user experience. In addition, scripts attached to a document can run and be deleted in less than a millisecond. Such scripts can still affect the page's JavaScript process even after being deleted.

[0006] Traditional solutions for detecting client web pages by detecting changes in associated web page documents typically use only information sent back to the server, without using information displayed to the user on the client. In addition, current extension analysis may only look for specific code variables injected into the document. However, as the extension develops, these variables may be renamed, deleted, or new variables may be added. Although very accurate, tracking code variables may require a lot of effort to keep up to date and avoid false positives and false negatives. Therefore, traditional solutions do not provide tangible information about what functions the terminal user's extension performs, and when the terminal user replaces one of their extensions with another extension with the same purpose (which is a common behavior), a pattern that will not trigger a false positive cannot be clearly created from such information. For example, a deprecated extension may force the user to obtain a replacement extension. Therefore, extension analysis using existing technology is also unreliable.

[0007] There is a need for improved systems and methods for detecting client-side web page tampering. Summary of the invention

[0008] Certain exemplary embodiments of the disclosed technology may include methods for client-side web page tampering assessment and fraud prevention by detecting one or more events of user-specific behaviors without typical characteristics.

[0009] According to certain embodiments of the disclosed technology, a method is provided for monitoring a web document associated with a document object model (DOM) of a user's browsing session using a mutation observer (MutationObserver) instance, capturing one or more event-based changes of the web document, and retrieving user behavior metric history data from a file repository. In response to comparing the one or more event-based changes with the user behavior metric history data, the method may include refusing to continue the browsing session based on a predetermined similarity mismatch between the one or more event-based changes and entries in the user behavior metric history data, and outputting one or more indications of potential fraud. Certain embodiments may include authorizing the continuation of the browsing session based on a predetermined similarity match between the one or more event-based changes and entries in the user behavior metric history data.

[0010] According to certain embodiments of the disclosed technology, a system is provided, which is configured to evaluate client web page tampering and prevent fraud by detecting one or more events of user-specific behavior without typical characteristics. The system includes a processor and a memory on which programming instructions are stored. When the programming instructions are executed by the processor, the programming instructions cause the processor to monitor the web page document associated with the document object model (DOM) of the user's browsing session using a change observer instance, detect one or more event-based changes of the web page document, store one or more event-based changes in the memory, retrieve user behavior measurement history data from a file repository, compare one or more event-based changes with the user behavior measurement history data, and refuse to continue the browsing session based on a predetermined similarity mismatch between one or more event-based changes and entries in the user behavior measurement history data, and output one or more indications of potential fraud. Certain embodiments may include authorizing the continuation of the browsing session based on a predetermined similarity match between one or more event-based changes and entries in the user behavior measurement history data.

[0011] According to certain embodiments of the disclosed technology, a non-transitory computer-readable medium having software instructions stored thereon, when the software instructions are executed by a processor, causes the processor to perform a method that utilizes a change observer instance to monitor a web document associated with a document object model (DOM) of a user's browsing session, captures one or more event-based changes to the web document, and retrieves user behavior metric history data from a file repository. In response to comparing the one or more event-based changes to the user behavior metric history data, the method may include refusing to continue the browsing session based on a predetermined similarity mismatch between the one or more event-based changes and entries in the user behavior metric history data, and outputting one or more indications of potential fraud. Certain embodiments may include authorizing the continuation of the browsing session based on a predetermined similarity match between the one or more event-based changes and entries in the user behavior metric history data.

[0012] Certain embodiments of the disclosed technology will now be described with reference to the following figures and detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is an example block diagram illustration of a system according to certain implementations of the disclosed technology.

[0014] Figure 2 is an example block diagram of a system according to some exemplary embodiments of the disclosed technology, wherein a change observer can monitor the DOM of a web page to detect and prevent fraudulent tampering.

[0015] Figure 3is an example flow chart of terminating a browsing session based on a detected DOM change that is inconsistent with a user's previous behavioral input according to certain exemplary embodiments of the disclosed technology.

[0016] Figure 4 is a high-level block diagram of a computing device that can be used to implement embodiments of the disclosed technology.

[0017] Figure 5 is a flow chart of a method according to certain embodiments of the disclosed technology.

[0018] The technology of the present disclosure will now be described using the detailed description in conjunction with the accompanying drawings and the appended claims. DETAILED DESCRIPTION

[0019] The systems and methods disclosed herein can detect document modifications on the client side to identify web page tampering. Fraudsters can use this tampering to deceive victim users because it creates a difference between the visible content and the code of the web page. In some embodiments, the technology disclosed herein can be used to mitigate this attack.

[0020] According to certain exemplary embodiments of the disclosed technology, a change observer interface may be used to monitor a document object model (DOM) tree of a web page, for example, to receive notifications through its callback function when the DOM changes, as will be discussed in detail below.

[0021] Certain embodiments of the disclosed technology may also utilize files of user-specific behaviors modified by typical browser documents (such as enabling dark mode extensions, content translation, pop-up window suppression, etc.), thereby evaluating specific normal user settings and web page interaction behaviors associated with current browsing changes to reduce false alarms.

[0022] Certain embodiments of the disclosed technology can detect script injection in a document without pre-configuration. In addition, certain embodiments of the disclosed technology can be used to detect temporary script injection.

[0023] The disclosed techniques can be used to reduce fraud by detecting document changes (such as script injections or code-triggered field value changes), which can be evaluated to authorize or deny online sessions. In some embodiments, an event-based approach can be utilized to detect changes made to a document. For example, an event can be an action or change in a document, or can be associated with a page's JavaScript thread triggered by user interaction or the web page code itself, developer tools, extensions, etc. In some embodiments, such changes to a document or JavaScript thread can be monitored regardless of the source of the change.

[0024] In some embodiments, the change event can be used to detect any changes made to the DOM tree. In some embodiments, silent changes that may only affect the JavaScript thread of the page can be monitored to capture all script injections.

[0025] In some cases, the transaction value displayed to the user may be different from the actual value in the underlying code. In some embodiments, the technology of the present disclosure can detect such silent changes to the document.

[0026] In some implementations, advanced usage can be detected by matching patterns associated with document changes that are inaccessible to ordinary users who do not have advanced knowledge of browsers and code, for example.

[0027] The technology of the present disclosure can provide technical benefits for practical applications in detecting and reducing online fraud in a variety of ways, including but not limited to: (1) providing a list of changes made to web page documents and a timeline of the changes; (2) detecting remote access scenarios where fraudsters change the appearance of web pages presented to end users; (3) avoiding false positives by analyzing the online behavior of advanced users, for example, advanced users often use plug-ins that change web pages (e.g., plug-ins that force dark mode, add additional features to pages, remove website browsing information data (cookies), remove pop-ups, clear paywalls, etc.); (4) detecting other abnormal behavior (e.g., using browsers / plug-ins to translate pages); and / or (5) detecting script injection and addition and / or removal events (for temporary scripts) and a complete and accurate timeline of the script. In some embodiments, the process of script injection detection can be controlled to run at predetermined intervals or at specific user journey events. Certain embodiments of the technology of the present disclosure can be used to detect hidden and visible changes made to the DOM tree using an event-based approach. In some embodiments, changes within a millisecond time range can be detected and mitigated.

[0028] Further details of the disclosed technology will now be explained with reference to the accompanying drawings.

[0029] Figure 11 is an example block diagram illustration of a system 100 according to certain embodiments of the disclosed technology, which system can be used to assess client-side web page tampering, which system can be used to prevent associated fraud. In certain embodiments, the system 100 may include a client device 102 (such as a desktop computer, laptop computer, tablet computer, mobile device, etc.) that communicates with an enterprise server 108. During normal web browsing 103, the enterprise server 108 can "serve" one or more web pages to the client device 102 for the user to view and interact with. However, in some cases, a fraudster 106 can tamper 104 with the client device 102 (with or without the user's knowledge), such as by remote access and / or via script injection so that portions of the served web page appear different than what the enterprise server 108 expects.

[0030] As described above, there are situations where legitimate users can utilize plug-ins (or other advanced user tools) to change the appearance of their browsing sessions. In order to avoid or minimize situations where legitimate users are flagged for potential fraudulent activity associated with their normal behavior, the system 100 can utilize the behavioral biometric server 110 to build and use user files to catalog document changes consistent with normal usage by a particular user. In some embodiments, the system 100 can check user files based on DOM tree change entries (e.g., provided by a change observer) to distinguish between normal and potential fraudulent activity. In this way, the technology of the present disclosure can provide an enhanced user experience and protection while minimizing false positives.

[0031] Figure 2 is a more detailed example block diagram of the system 200, in which certain components such as the client device 102, the enterprise server 108, and / or the behavioral biometric server 110 may be similar to Figure 1 The system 100 discussed in detail is implemented as described above.

[0032] In some exemplary embodiments, the client device 102 may include an operating system 202, a clock 210, applications 216, and one or more of a touchpad 204, an accelerometer 206, a gyroscope sensor 208, and / or a microphone 212. Certain device information 221 may be stored in a memory of the client device 102. In some exemplary embodiments, user information 222 may be stored in a memory of a user's client device 102. According to some exemplary embodiments of the disclosed technology, a change observer 220 may be used to distinguish changes in the DOM 218.

[0033] In certain exemplary embodiments, the (user's) client device 102 , the enterprise server 108 , and / or the behavioral biometric server 110 may communicate with each other via a communication channel 240 , including, but not limited to, the Internet.

[0034] The behavioral biometrics server 110 may include various modules, such as a behavior scoring module 224 , a script and plug-in module 226 , a user file module 228 , a notification module 230 , etc., which may be used to implement various functions of the behavioral biometrics server 110 .

[0035] Certain exemplary embodiments of the behavioral biometric server 110 may communicate with a data repository 232, for example, the data repository 232 may be used to store user, device, and / or previous behavioral data, and may update and retrieve previous behavioral data for comparison with current behavioral data. In certain embodiments, the data repository 232 may retrieve device information 221 and / or user information 222 from the client device 102 via the behavioral biometric server 110 to update the data repository 232. In certain embodiments, the user profile module 228 may be used to retrieve, compare, and update user profile information stored in the data repository 232.

[0036] For example, the behavior scoring module 224 can be used to determine whether the (user's) client device 102 is interacting with the enterprise server 108 in a normal web browsing mode that is typically / in the past used on the client device 102, or to determine whether changes to the DOM 218 on the (user's) client device 102 (e.g., detected by the change observer 220) are from a different process, plug-in, script, etc. than those previously used on the client device 102. In some embodiments, user and / or device history file data can be stored in the user information 222, the device information 221, and / or the data repository 232.

[0037] In some embodiments, the behavior scoring module 224 may include a script and plug-in module 226 that can work in conjunction with the behavior scoring module 224 and / or the user file module 228 to classify known whitelist and / or blacklist scripts / plug-ins and / or known fraudster device information to further speed up the process of distinguishing legitimate browsing patterns from potential fraudulent patterns.

[0038] According to certain exemplary embodiments of the disclosed technology, when suspicious activity is detected, the notification module 230 can be used to generate and send an alert or notification to the enterprise server 108, the client device 102, and / or to generate and send an alternative communication channel (such as text or email) to a user associated with the client device 102. In certain embodiments, the alert or notification provided by the notification module 230 can be configured to interrupt further communication between the client device 102 and the enterprise server 108 when the change to the DOM 218 is determined to be above a predetermined fraud threshold. Therefore, in the system 200, the change observer 220 can monitor the DOM 218 associated with the web page to detect one or more events of user-specific behavior without typical characteristics, and the system 200 can be used to prevent fraudulent tampering.

[0039] In some embodiments, the change observer 220 can be implemented as an interface that provides the ability to observe all changes made to the DOM 218 tree. Any change made to the DOM 218 can result in an event that triggers the change observer 220. The event can provide information to the change observer 220 about what, when, and where the change occurred, as well as the value before the change. In some embodiments, the change observer 220 can be instantiated with custom code to enhance the information being collected.

[0040] In some embodiments, a mutation list variable may be declared to hold a list of all document mutations. For example, a mutation observer 220 may be instantiated in another variable called mObserver with a parameter or function called updateMutationsList that updates the mutation list (mutationsList) with all DOM mutations made to one or more elements of the page. Such a mutation may trigger a mutation observer 220 instance and add any other information that may be calculated on the fly and / or used to identify the source of the mutation.

[0041] In some embodiments, the observe() method of the change observer can be called with some or all options enabled, which can register some or all changes in the document. In one example embodiment, the change observer 220 and the observe() method can be used to observe changes in visible elements in a page known to be used in a fraud scenario. For example, in a scenario where a fraudster impersonates a technical support person and convinces the user to allow them to remotely control the user / client device, the fraudster may fill out an online transaction form and secretly change the value in the field (and the underlying code) in a way that does not change what is displayed to the user before the transaction is sent to the relevant server or redirected to a different server. This value change can occur in a millisecond and therefore may not be visible to the end user. The systems and methods disclosed herein can be used to detect and prevent such changes.

[0042] In another example scenario, a fraudster may alter the output of a form so that it does not match what is visible to the user. Such alterations may include multiplying a monetary value or registering another monetary transaction beneficiary to a form field. The systems and methods disclosed herein may be used to detect and prevent such alterations.

[0043] In another example scenario, the systems and methods disclosed herein can be used to detect injected scripts. Script injection in a document will be detected by adding <script>标签来使DOM变动，这将触发变动观察器。这样，如果使用脚本更改页面来运行改变输入字段值的函数(即使不到一毫秒)，改变可以会自动触发变动观察器，变动观察器可以会使用关于特定文档变动的信息更新变动列表，并列出脚本的内容、原来输入字段的值、新的值、修改的输入字段和改变的时间。所有这些信息可以被发送到行为生物识别服务器110进行分析和处理，这可以导致来自通知模块230的撤销访问的警告或通知，如上所述。

[0044] 在另一个涉及注入脚本的场景中，该脚本被编程为在运行后(即使是一毫秒)自行删除，变动观察器220仍然能够捕获脚本及其内容。

[0045] 在另一种场景中，恶意实体可以通过具有漏洞的浏览器扩展在受害者的计算机上运行自定义代码。在这种场景中，欺诈者可能试图通过向文档添加自定义脚本来收集受害者的凭据，该自定义脚本监听用户访问的网站上登录表单字段中的值变化。脚本执行后，它可能会自行删除，而不会清除页面JavaScript线程中的恶意逻辑。一旦脚本被添加到页面，甚至在其内容被执行之前，该脚本注入也会使DOM 218树变动，因此会被变动观察器捕获。注入脚本的全部内容可能会存储在变动列表中，即使在恶意脚本自行删除后也是如此。这种信息可以被传输到脚本和插件模块226以供行为生物识别服务器110分析。

[0046] 在另一个示例场景中，本公开技术的某些实施方式可以用于识别和允许用户通常采用的某些"高级用户”模式，如浏览器扩展的广泛使用，通过添加额外功能，如一次点击登录、具有特定页面快捷方式的新视觉界面、强制使用暗模式、广告拦截器、跟踪器移除、cookie清除程序等，可将文档变动注册为文档。由于这种扩展与网页的DOM 218树交互，所以所有这些变动都将被变动观察器捕获到，并且可以例如经由用户文件模块228和 / 或脚本和插件模块226根据特定用户数据进行检查，以确定这种功能对于特定用户是否被认为是正常的，使得浏览会话不会因误报而被中断。

[0047] 本公开技术的各种实施方式可以用于确定与特定用户的历史行为生物识别数据一致的在线交互模式。名称为"Behavioral authentication system using a behaviorserver for authentication of multiple users based on their behavior”的美国专利No.10,068,076中讨论了使用行为生物识别数据的某些实施方式，该专利的内容通过引用并入本文，就像完整地呈现一样。

[0048] 由于隐私模式、恶意软件和 / 或数据聚合可能会抑制行为数据的使用，因此可能会出现行为生物识别算法在不知情的情况下受到浏览器的隐私模式、恶意软件或某些类型的聚合器影响的情况。本公开技术的某些实施方式可以检测在线通信模式，其中行为数据可能受到隐私设置、恶意软件或聚合器的影响，从而可能不依赖行为生物识别来识别和 / 或跟踪用户。

[0049] 传统的行为生物识别系统无法处理失配或被操纵的行为数据(即，由于机器人、聚合器、恶意软件和 / 或浏览器隐私模式)，通常，由于与行为相关的时间分布发生变化，合法用户的会话可能会被标记为误报。相反，本公开的技术可以用于检测对DOM 218的改变，并且可以允许系统利用行为生物识别和用户文件来处理这种情况，而不是错误地将通信会话标记为欺诈 / 误报。本公开技术的某些示例性实施方式可以通过检测DOM 218的变化并结合对用户文件数据的相应检查来实现对行为生物识别的误报的抑制。

[0050] 图3是根据本公开技术的某些示例性实施方式的基于监控到的与用户先前行为输入不一致的DOM变化而终止浏览会话的方法300的示例流程图。在框302中，可以例如在客户端设备102和企业服务器108之间发起浏览会话。在框304中，可以监控和记录各种用户行为输入，例如建立用户文件和 / 或补充 / 更新现有用户文件。这种监控 / 记录的行为输入可以包括击键动力学、按键时间、按键飞行时间、鼠标移动、滑动压力、滑动位置、操作系统信息、浏览器类型信息、插件信息、设备信息、屏幕信息、文档修改等。这种用户行为信息可以用于为特定用户建立通常的浏览设置和行为，并且这种信息可以存储在用户文件中。与框304并行，如框306所示，方法300可以监控DOM变化。如框307所示，响应于检测到的DOM变化，方法300可以触发用户先前和当前行为输入的比较，如框308所示。在某些实施方式中，检测到的DOM变化可以触发评估，如决策框310中所示，以确定检测到的DOM变化是否与通常的用户行为一致。如果检测到的DOM变化与通常的用户行为一致，则如框312所示，可以继续浏览会话，并且可以继续监控DOM和用户行为输入。然而，如果检测到的DOM变化与通常的用户行为不一致，则可以终止浏览会话，如框314所示。在某些实施方式中，如框316所示，例如可以(经由替代通信信道)向用户、客户端设备102和 / 或企业服务器108中的一个或更多个输出指示。

[0051] 在某些示例性实施方式中，确定检测到的DOM变化是否与用户的通常和 / 或历史行为信息一致的过程可以包括根据记录的行为输入检查用户文件数据。在某些情况下，DOM变化可能源于典型的用户设置、插件等，这在用户浏览会话期间可能被认为是平常或正常的，并且可以通过根据用户文件检查当前DOM变化的来源以确定导致DOM变化的历史行为输入 / 条目 / 设置，但是对于特定用户来说被认为是无害和正常的。

[0052] 在一些实施例中，当前和 / 或历史行为输入可以由客户端设备102记录输入。在某些实施方式中，用户可能没有意识到行为输入正在被记录。在某些实施方式中，至少一些行为输入可以在使用设备的用户不知情的情况下在后台被记录。在一些其他实施例中，用户可以明确同意记录他 / 她的行为输入。

[0053] 在某些实施方式中，行为输入可以包括击键动力学(按键之间的强度和间隔)、鼠标移动(与其他输入相比的位置、速度、加速度和 / 或计时)、滑动压力、滑动位置。在某些实施方式中，行为输入可以包括例如可能故意改变网页的显示方式的用户设置、脚本、插件等。在某些实施方式中，可以使用一个或更多个统计测试将行为输入与先前记录的行为输入进行比较，以确定过去和现在行为输入之间的接近度阈值。出于本公开的目的，"统计测试”被定义为确定变量(例如，插件、任何 / 所有键或二元模型飞行时间等)的新行为样本与先前采样的分布(学习的文件)的距离。在一些实施方式中，这可以通过将样本与假设的基础分布(可以是例如高斯分布或对数正态分布)的平均值进行比较来实现，或者通过计算KL(Kullback-Leibler)散度来实现，KL散度是新样本对基础分布的"惊喜”或信息增益的度量，或者如果有足够的样本可用，则执行双样本柯尔莫可洛夫-斯米洛夫(Kolmogorov-Smirnov)或Cucconi检验来确定相似性。在上述每种方法中，可以设置合适的接受 / 拒绝阈值。

[0054] 根据本公开技术的某些示例性实施方式，授权继续浏览会话可以基于一个或更多个基于事件的变动与用户行为度量历史数据中的条目的预先确定的相似性匹配。过去和现在行为输入之间的接近度阈值可以用于确定当前和过去行为数据所需的最小匹配百分比，以授权继续浏览会话。百分比匹配可以是接收到多少输入的匹配、多少输入与已经记录的输入匹配和 / 或基于统计确定的匹配接近度。在某些实施方式中，可以用在监控客户端设备102时获取的数据更新先前存储的行为数据。

[0055] 图4描绘了可以用于实现本公开技术的某些方面的说明性计算设备400的框图。本文的各种实施方式和方法可以体现在非暂态计算机可读介质中以供处理器执行。应当理解，计算设备400仅出于示例目的而提供，并且不限制通信系统和方法的各种实施方式的范围。

[0056] 图4的计算设备400包括处理计算机指令的一个或更多个处理器。计算设备400可以包括CPU 402，或者它可以与图4所示的一个或更多个附加部件相结合。在某些情况下，计算设备可以是处理器、控制器或中央处理单元(CPU)。在其他情况中，计算设备可以是一组硬件部件。

[0057] 计算设备400可以包括作为通信接口并提供在显示器上呈现视频、图形、图像和文本的功能的显示器接口404。在本公开技术的某些示例实施方式中，显示器接口404可以直接连接到本地显示器。在另一示例实施方式中，显示器接口404可以被配置为向外部 / 远程显示器提供数据、图像和其他信息。在某些示例实施方式中，显示器接口404可以例如经由Wi-Fi信道或其他可用的网络连接接口412与外部 / 远程显示器无线通信。

[0058] 在示例实施方式中，网络连接接口412可以被配置为通信接口，并可以提供在显示器上呈现视频、图形、图像、文本、其他信息或其任意组合的功能。在示例中，通信接口可以包括串行端口、并行端口、通用输入和输出(GPIO)端口、游戏端口、通用串行总线(USB)、微型USB端口、高清多媒体(HDMI)端口、视频端口、音频端口、蓝牙端口、近场通信(NFC)端口、另一类似的通信接口或其任意组合。在一个示例中，显示器接口404可以可操作地耦接到本地显示器。在另一示例中，显示器接口404可以例如经由诸如Wi-Fi收发器的网络连接接口412与外部 / 远程显示器无线通信。

[0059] 计算设备400可以包括向键盘提供通信接口的键盘接口406。根据本公开技术的某些示例实施方式，存在敏感显示器接口408可以向诸如定点设备、触摸屏等各种设备提供通信接口。

[0060] 计算设备400可以被配置为通过一个或更多个输入 / 输出接口(例如，键盘接口406、显示器接口404、存在敏感显示器接口408、网络连接接口412、照相机接口414、声音接口416等)使用输入设备以允许用户将信息捕获到计算设备400中。输入设备可以包括鼠标、轨迹球、方向板、触控板、触摸验证触控板、存在敏感触控板、存在敏感显示器、滚轮、数码相机、数码摄像机、网络摄像机、麦克风、传感器、智能卡等。另外，输入设备可以与计算设备400集成在一起，或者可以是单独的设备。例如，输入设备可以是加速度计、磁力计、数码相机、麦克风和光学传感器。

[0061] 计算设备400的示例实施方式可以包括向天线提供通信接口的天线接口410、向网络提供通信接口的网络连接接口412。根据某些示例实施方式，天线接口410可以用来与蓝牙收发器通信。

[0062] 在某些实施方式中，可以提供相机接口414充当通信接口并提供从相机捕获数字图像的功能。在某些实施方式中，声音接口416被提供作为通信接口，用于使用麦克风将声音转换成电信号，以及使用扬声器将电信号转换成声音。根据示例实施方式，提供随机存取存储器(RAM)418，其中，计算机指令和数据可以存储在易失性存储器设备中以供CPU 402处理。

[0063] 根据示例实施方式，计算设备400包括只读存储器(ROM)420，用于基本系统功能(如基本输入输出(I / O)、启动或接收来自键盘的击键)的不变低级系统代码或数据存储在非易失性存储器设备中。根据示例实施方式，计算设备400包括存储介质422或其他合适类型的存储器(例如，诸如RAM、ROM、可编程只读存储器(PROM)、可擦除可编程只读存储器(EPROM)、电可擦除可编程只读存储器(EEPROM)、磁盘、光盘、软盘、硬盘、可移动暗盒、闪存驱动器)，其中，文件包括操作系统424、应用程序426(根据需要，包括例如网络浏览器应用、窗口小部件(widget)或小工具(gadget)引擎、和 / 或其他应用)和数据文件428。根据示例实施方式，计算设备400包括电源430，该电源430向电力部件提供适当的交流电(AC)或直流电(DC)。根据示例实施方式，计算设备400包括允许计算设备400通过电话网络发送和接收声音的电话子系统432。组成设备和CPU 402通过计算机总线434相互通信。

[0064] 根据示例实施方式，CPU 402具有作为计算机处理器的适当结构。在布置中，计算机CPU 402可以包括多于一个的处理单元。RAM 418与计算机总线434连接，以在执行软件程序(诸如操作系统应用程序和设备驱动程序)期间向CPU 402提供快速RAM存储。更具体地，CPU 402将计算机可执行的过程步骤从存储介质422或其他介质加载到RAM 418的字段中以执行软件程序。数据可以存储在RAM 418中，其中，数据可以在执行期间由计算机CPU 402访问。在示例配置中，计算设备400包括至少128MB的RAM和256MB的闪存。

[0065] 存储介质422本身可以包括多个物理驱动单元，如独立磁盘冗余阵列(RAID)、软盘驱动器、闪存、USB闪存驱动器、外置硬盘驱动器、拇指驱动器、随身碟、密钥驱动器、高密度数字多功能光盘(HD-DVD)光盘驱动器、内部硬盘驱动器、蓝光光盘驱动器或全息数字数据存储(HDDS)光盘驱动器、外置微型双列直插式存储模块(DIMM)、同步动态随机存取存储器(DIMM)或者外部微型DIMM SDRAM。这种计算机可读存储介质允许计算设备400访问存储在可移动和不可移动存储介质上的计算机可执行过程步骤、应用程序等，以从计算设备400卸载数据或将数据上传到计算设备400上。诸如利用通信系统的计算机程序产品可以有形地体现在存储介质422中，存储介质422可以包括机器可读存储介质。

[0066] 根据一个示例实施方式，本文所使用的术语"计算设备”可以是CPU，或概念化为CPU(例如，图4的CPU 402)。在该示例实施方式中，计算设备(CPU)可以与一个或更多个外围设备耦接、连接和 / 或通信。

[0067] 本领域技术人员还应理解，图1和 / 或图2所示的设备可以在如图4所示的计算设备400上实施。

[0068] 图5是通过检测无典型特征的用户特定行为的一个或更多个事件进行客户端网页篡改评估和欺诈预防的方法500的流程图。在框502中，方法500包括利用变动观察器实例监控与用户的浏览会话的文档对象模型(DOM)相关联的网页文档。在框504中，方法500包括捕获网页文档的一个或更多个基于事件的变动。在框506中，方法500包括从文件储存库中检索用户行为度量历史数据。在框508中，方法500包括响应于将一个或更多个基于事件的变动与用户行为度量历史数据进行比较，基于一个或更多个基于事件的变动与用户行为度量历史数据中的条目的预先确定的相似性匹配来授权继续浏览会话；或者基于一个或更多个基于事件的变动与用户行为度量历史数据中的条目的预先确定的相似性失配来拒绝继续浏览会话，并且输出潜在欺诈的一个或更多个指示。

[0069] 在某些实施方式中，一个或更多个基于事件的变动可以包括可见变动、隐藏变动、脚本注入和 / 或代码触发的字段值变化中的一个或更多个。

[0070] 在某些实施方式中，网页文档的一个或更多个基于事件的变动可以与JavaScript线程相关联。

[0071] 根据本公开技术的某些示例性实施方式，网页文档的一个或更多个基于事件的变动可以修改值而不改变显示给用户的可见内容。

[0072] 在某些实施方式中，响应于捕获一个或更多个基于事件的变动，变动观察器实例可以更新包含由用户交互或代码执行触发的文档变动列表的变量。

[0073] 在某些实施方式中，监控DOM不需要预配置或特定用户旅程事件。

[0074] 在某些实施方式中，一个或更多个基于事件的变动可以与用户欺骗有关。在某些实施方式中，输出一个或更多个指示以减少欺诈。

[0075] 本公开技术的某些实施方式还可以包括基于捕获的网页文档的基于事件的变化更新用户行为度量历史数据并将用户行为度量历史数据存储在文件储存库中，基于事件的变化是通常的用户特定文档修改。在某些实施方式中，通常的用户特定文档修改可以包括使用一个或更多个网络浏览器扩展在网页上进行弹出窗口隐藏、内容翻译和 / 或强制暗模式中的一项或更多项。

[0076] 根据本公开技术的某些示例性实施方式，捕获网页文档的一个或更多个基于事件的变动可以包括利用时间线记录对网页文档所做的可见变动和隐藏变动以检测用户特定行为并识别欺诈活动。

[0077] 在某些实施方式中，用户行为度量历史数据可以包括击键动力学、按键时间、按键飞行时间、鼠标移动、滑动压力、滑动位置、操作系统、浏览器类型、设备信息、屏幕刷新率和通常的用户特定文档修改中的一个或更多个。

[0078] 根据本公开技术的某些示例性实施方式，如果检测到浏览器处于私人模式或受到聚合器或恶意软件的影响，则响应于检测而采取的行动类型可以包括用适当的标志标记用户会话。在某些情况下，可能会向欺诈系统或人工操作员发出警报。根据本公开技术的某些示例性实施方式，隐私模式的检测可能不足以保证警报，然而，恶意软件的检测可以启动这种警报的生成和发送。

[0079] 本文描述的主题和功能操作的实施方式可以在各种系统、数字电子电路、计算机软件、固件或硬件中实施，包括本文公开的结构及其结构等效物或一个或更多个的组合。本文描述的主题的实施方式可以被实施为一个或更多个计算机程序产品，即编码在有形和非暂态计算机可读介质上的计算机程序指令的一个或更多个模块，用于由数据处理设备执行或控制数据处理设备的操作。计算机可读介质可以是机器可读存储设备、机器可读存储基底、存储设备、影响机器可读传播信号的物质的组合物，或者它们中的一个或更多个的组合。术语"数据处理单元”或"数据处理装置”包括用于处理数据的所有装置、设备和机器，包括例如可编程处理器、计算机或多个处理器或计算机。除了硬件之外，该装置可以包括为所讨论的计算机程序创建执行环境的代码，例如，构成处理器固件、协议栈、数据库管理系统、操作系统或它们中的一个或更多个的组合的代码。

[0080] 计算机程序(也称为程序、软件、软件应用、脚本或代码)可以以任何形式的编程语言(包括编译或解释语言)编写，并且可以以任何形式(包括独立程序或模块、部件、子程序或适用于计算环境的其他单元)部署。计算机程序不一定对应于文件系统中的文件。程序可以存储在保存其他程序或数据的文件的一部分(例如，存储在标记语言文档中的一个或更多个脚本)中，存储在专用于所讨论的程序的单个文档中，或者存储在多个协作文件(例如，存储一个或更多个模块、子程序或代码部分的文件)中。计算机程序可以被部署为在一台计算机或位于一个地点或分布在多个地点并通过通信网络互连的多台计算机上执行。

[0081] 本说明书中描述的过程和逻辑流程可以由执行一个或更多个计算机程序的一个或更多个可编程处理器通过对输入数据进行操作并产生输出来执行功能。过程和逻辑流程也可以由专用逻辑电路来执行，并且设备也可以被实施为专用逻辑电路，例如，FPGA(现场可编程门阵列)或ASIC(专用集成电路)。

[0082] 适于执行计算机程序的处理器包括通用和专用微处理器，以及任何类型的数字计算机的任何一个或更多个处理器。通常，处理器将从只读存储器或随机存取存储器或两者接收指令和数据。计算机的基本元件是用于执行指令的处理器和用于存储指令和数据的一个或更多个存储设备。通常，计算机还将包括或可操作地耦接到一个或更多个用于存储数据的大容量存储设备，例如磁盘、磁光盘或光盘，以从该大容量存储设备接收数据或向其传送数据，或两者兼有。然而，计算机不需要有这样的设备。适于存储计算机程序指令和数据的计算机可读介质包括所有形式的非易失性存储器、介质和存储设备，包括例如半导体存储设备(例如EPROM、EEPROM、闪存设备)。处理器和存储器可以由专用逻辑电路来补充或并入专用逻辑电路中。

[0083] 虽然本公开包括许多细节，但这些细节不应被解释为对任何本公开或可能要求保护的内容的范围的限制，而是对特定发明的特定实施例可能特有的特征的描述。在单独实施例的上下文中描述的某些特征也可以在单个实施方式中组合实施。相反，在单个实施方式的上下文中描述的各种特征也可以在多个实施例中单独实施或以任何合适的子组合实施。此外，尽管特征可能在上文被描述为在某些组合中起作用，并且甚至最初被如此要求保护，但是来自所要求保护的组合的一个或更多个特征在一些情况下可以从该组合中删除，并且所要求保护的组合可以针对子组合或子组合的变型。

[0084] 类似地，虽然图中以特定顺序描绘了操作，但不应理解为要求以所示特定顺序或依次顺序执行此类操作，或要求执行所有图示操作，以实现期望的结果。此外，本文描述的实施例中的各种系统部件的分离不应被理解为在所有实施例中都需要这种分离。

[0085] 虽然已具体参照上述实施例教导了本公开的技术，但本领域普通技术人员将认识到，在不脱离本公开技术的精神和范围的情况下，可以在形式和细节上进行改变。所描述的实施例在所有方面都仅被认为是说明性的而不是限制性的。在权利要求的等同物的含义和范围内的所有变化都包含在权利要求的范围内。上文描述的任何方法和设备的组合也是可以预期的，并且在本公开的技术的范围内。< / script>

Claims

1. A method for protecting a service by detecting tampering of a client web page, comprising: Monitoring a web document associated with a document object model (DOM) of a user's browsing session using a change observer instance; capturing one or more event-based changes of the web page document; Retrieving user behavior measurement history data from a file repository; as well as In response to comparing the one or more event-based changes with the user behavior metric historical data, refusing to continue the browsing session based on a mismatch in a predetermined similarity between the one or more event-based changes and entries in the user behavior metric historical data, and outputting one or more indications of potential fraud.

2. The method according to claim 1, wherein: The one or more event-based changes include one or more of visible changes, hidden changes, script injections, and / or code-triggered field value changes.

3. The method according to claim 1, wherein: The one or more event-based changes to the web page document are associated with a JavaScript thread.

4. The method according to claim 1, wherein: The one or more event-based changes to the web document modify values ​​without changing visible content displayed to the user.

5. The method according to claim 1, wherein: In response to capturing the one or more event-based changes, the change observer instance updates a variable containing a list of document changes triggered by user interaction or code execution.

6. The method according to claim 1, wherein: No pre-configuration or specific user journey events are required.

7. The method according to claim 1, wherein: The one or more event-based changes are associated with user fraud, wherein the one or more indicators are output to reduce fraud.

8. The method of claim 1 further comprising updating user behavior metric history data based on the captured event-based changes of the web page document and storing the user behavior metric history data in the document repository, and authorizing continuation of the browsing session based on a predetermined similarity match of the one or more event-based changes with entries in the user behavior metric history data, wherein Event-based changes to the web page document are typically user-specific document modifications.

9. The method according to claim 8, wherein: The typical user-specific document modifications include one or more of pop-up hiding, content translation, and / or forced dark mode on a web page using one or more web browser extensions.

10. The method according to claim 1, wherein: Capturing the one or more event-based changes to the web page document includes recording visible and hidden changes made to the web page document using a timeline to detect user-specific behaviors and identify fraudulent activities.

11. The method according to claim 1, wherein: The user behavior metric historical data includes one or more of keystroke dynamics, key press time, key flight time, mouse movement, slide pressure, slide position, operating system, browser type, device information, screen refresh rate, and typical user-specific document modifications.

12. A system for protecting services by detecting tampering of client web pages, comprising: processor; as well as A memory having stored thereon programming instructions which, when executed by the processor, cause the processor to: Monitoring a web document associated with a document object model (DOM) of a user's browsing session using a change observer instance; detecting one or more event-based changes to the web document; storing the one or more event-based changes in the memory; Retrieving user behavior measurement history data from a file repository; comparing the one or more event-based changes to the user behavior metric historical data; as well as The browsing session is refused to continue based on a mismatch between the one or more event-based variations and a predetermined similarity of entries in the user behavior metric history data, and one or more indications of potential fraud are output.

13. The system according to claim 12, wherein: The one or more event-based changes include one or more of visible changes, hidden changes, script injections, and / or code-triggered field value changes.

14. The system according to claim 12, wherein: The one or more event-based changes to the web page document are associated with a JavaScript thread.

15. The system of claim 12, wherein: The one or more event-based changes to the web document modify values ​​without changing visible content displayed to the user.

16. The system of claim 12, wherein: In response to capturing the one or more event-based changes, the change observer instance updates a variable containing a list of document changes triggered by user interaction or code execution.

17. The system of claim 12, wherein: The programming instructions also cause the processor to update user behavior metric history data based on the captured event-based changes of the web page document and store the user behavior metric history data in the file repository, and authorize continuation of the browsing session based on a predetermined similarity match of the one or more event-based changes with entries in the user behavior metric history data, wherein the event-based changes of the web page document are typical user-specific document modifications.

18. The system of claim 17, wherein: The typical user-specific document modifications include one or more of pop-up hiding, content translation, and / or forced dark mode on a web page using one or more web browser extensions.

19. The system of claim 12, wherein: The user behavior metric historical data includes one or more of keystroke dynamics, key press time, key flight time, mouse movement, slide pressure, slide position, operating system, browser type, device information, screen refresh rate, and typical user-specific document modifications.

20. A non-transitory computer readable medium having software instructions stored thereon, which, when executed by a processor, causes the processor to perform the following method: Monitoring a web document associated with a document object model (DOM) of a user's browsing session using a change observer instance; capturing one or more event-based changes of the web page document; Retrieving user behavior measurement history data from a file repository; as well as In response to comparing the one or more event-based changes with the user behavior metric historical data, refusing to continue the browsing session based on a mismatch in a predetermined similarity between the one or more event-based changes and entries in the user behavior metric historical data, and outputting one or more indications of potential fraud.

Images