Automated Browser for Cookie Stuffing Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting cookie stuffing in affiliate marketing systems are inadequate, as they fail to accurately identify and prevent fraudulent activities where cookies are issued without user consent, leading to illegitimate commissions.

Innovation Solution

A computer-implemented method and system that uses a server to analyze web resources for malicious activity by executing an automated browser application to access web resources, log cookie presence, and determine malicious activity through HTML source code analysis, enabling identification and prevention of cookie stuffing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If automated browser application is used to access web resources and log cookie presence, then measurement precision of malicious activity detection is improved, but device complexity increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

An automated browser application is introduced as an intermediary tool to access web resources and log cookie presence. This mediator executes predetermined actions on target websites and captures cookie data, enabling precise detection of cookie stuffing without requiring direct human intervention or complex manual analysis procedures.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The automated browser application creates a copy of the user browsing experience by executing the same predetermined actions that a real user would perform. It logs cookie presence in the same manner as a legitimate browser, allowing for accurate comparison and detection of fraudulent cookie placement while maintaining system scalability.

Inventive Principle:
Principle #26Copying

2Measurement precision

If HTML source code analysis is performed to determine malicious activity, then detection precision is improved, but loss of time increases

Engineering Contradiction:
Improvedetection precisionVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by having the automated browser application access web resources and log cookie presence before the actual detection analysis. This preparatory step captures relevant data in advance, so that subsequent HTML source code analysis can be performed more efficiently on pre-collected information rather than requiring real-time analysis during user browsing.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The detection process is segmented into distinct phases: (1) automated browser execution and cookie logging, (2) HTML source code retrieval, and (3) analysis of logged data against source code. This segmentation allows each phase to be optimized independently, reducing overall analysis time while maintaining detection precision.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS11444967B2Method and system for identifying malicious activity of pre-determined type
Publication Date: 2022.09.13 Y E HUB ARMENIA LLC
  • US11444967B2 patent drawing
  • US11444967B2 patent drawing
  • US11444967B2 patent drawing

AI summary

There is disclosed a method for identifying malicious activity of a pre-determined type. The method comprises acquiring, an indication of a plurality of web resources, each of the plurality of web resources being accessible via a communication network at a respective network address; analyzing, the plurality of web resources to identify a subset of web resources being candidates for being associated with the malicious activity; executing, an automated browser application, the automated browser application being configured to: access each of the web resources within the subset of web resources; and analyzing, by the server, a log associated with the automated browser application accessing each of the web resources, the log comprising an indication of a presence of a cookie unrelated to each of the web resources; determining, for a given web resource included within the subset of web resources, a presence of malicious activity based on the log.