API Device Masquerading Detection via Performance Challenge
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and mitigate automated attacks by scripts or bots that masquerade as legitimate devices, allowing fraudulent access and potential damage to websites and mobile applications.
Innovation Solution
The technique involves the client device performing specific computations requested by the server to reveal its actual processing capabilities, with the server analyzing the resulting performance statistics to determine the true device type and take appropriate defensive actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server relies on client-provided device type information (user-agent), then the API transaction is simple and fast, but the server cannot detect masquerading devices
Solution Approach 1:
The server performs preliminary actions by sending challenge code and script to the client before completing the API transaction. The client executes the script and returns performance statistics, allowing the server to verify device authenticity before granting full access. This preliminary verification step prevents masquerading while maintaining transaction flow.
Solution Approach 2:
A challenge-response mechanism acts as an intermediary between the server and client. The server sends a challenge (challenge code and script), the client responds with performance statistics, and the server verifies the response. This intermediary verification process enables reliable device type detection without requiring complex direct analysis of client claims.
2Reliability
If the server requests performance statistics from the client, then the server can detect masquerading, but the transaction process becomes more complex
Solution Approach 1:
The server creates a simplified copy of the verification process by sending a script that generates performance statistics. Instead of implementing complex direct detection mechanisms, the server copies the client's execution environment behavior through the script, analyzing the returned performance data to verify device authenticity. This copying approach maintains ease of operation while enabling detection.
3Measurement precision
If the server analyzes device performance statistics, then the true device type can be identified, but additional processing time is required
Solution Approach 1:
The server performs partial verification by analyzing specific performance statistics (CPU speed, memory capacity, storage capacity) rather than attempting to verify all possible device characteristics. This partial action approach achieves sufficient measurement precision for device type identification while minimizing the time required for verification, as the server only processes the essential performance metrics returned by the client.
Data Source
AI summary
This disclosure describes a technique to determine whether a client computing device accessing an API is masquerading its device type (i.e., pretending to be a device that it is not). To this end, and according to this disclosure, the client performs certain processing requested by the server to reveal its actual processing capabilities and thereby its true device type, whereupon—once the server learns the true nature of the client device—it can take appropriate actions to mitigate or prevent further damage. To this end, during the API transaction the server returns information to the client device that causes the client device to perform certain computations or actions. The resulting activity is captured on the client computing and then transmitted back to the server, which then analyzes the data to inform its decision about the true client device type. Thus, when the server detects the true client device type (as opposed to the device type that the device is masquerading to be), it can take appropriate action to defend the site.