Browser Object Model Login Validation for Bot False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distinguishing between legitimate and illegitimate bots on web applications is challenging due to the variability and evolution of browser configurations, leading to unreliable filtering and numerous false positives in automated browser attacks.
Innovation Solution
A system that tracks browser object model (BOM) identifiers in association with successful login attempts, using a clearance threshold to determine valid identifiers, reducing false positives by increasing the successful user login count, and clearing identifiers associated with legitimate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If browser configuration filtering is used to distinguish bots from legitimate users, then automated browser attacks can be detected, but false positives increase due to variability and evolution of browser configurations
Solution Approach 1:
The system pre-populates a database with known good browser object model identifiers before actual bot detection begins. This preliminary action establishes a baseline of legitimate browser configurations, allowing the system to quickly compare incoming identifiers against this pre-established knowledge base rather than evaluating each identifier in isolation.
Solution Approach 2:
The system implements a feedback mechanism where successful login attempts are monitored and used to update the database of known good identifiers. When a new identifier successfully logs in, it is added to the database, reinforcing the system's understanding of legitimate browsers. This continuous feedback loop improves detection accuracy over time while adapting to evolving browser configurations.
2Object-affected harmful factors
If traditional bot filtering methods are applied, then automated attacks can be blocked, but legitimate users are incorrectly flagged due to browser variability
Solution Approach 1:
The system dynamically adapts its filtering criteria by continuously updating the database of known good identifiers based on actual login success patterns. Rather than using static filtering rules, the system evolves its understanding of legitimate browsers through observed behavior, allowing it to adjust to browser configuration changes without increasing false positives.
Solution Approach 2:
The system changes the parameter of identifier validation from static pattern matching to dynamic success-based verification. Instead of relying on fixed browser configuration patterns that may become outdated, the system validates identifiers based on their actual performance in successful login attempts, fundamentally changing how legitimacy is determined.
Data Source
AI summary
A method may include: receiving, from a web browser on a computing device a login request with user credentials and browser object model (BOM) data of the web browser; querying an identifier database for an entry matching a portion of the BOM data; accessing a successful user login count for the entry; comparing the successful user login count to a clearance threshold; based on the comparison: determining that the successful user login count is below the clearance threshold; and modifying a login difficulty for the login request; processing, at the web server, the login request with the user credentials and the modified login difficulty; receiving an indication that the processing resulted in a successful user login; and in response to the indication, increasing the successful user login count for the entry.