Box Server Obfuscation for Man-in-the-Browser Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus software and security measures are ineffective in counteracting Man-in-the-Browser, Man-in-the-Middle, and Bot attacks, as they fail to securely monitor and protect Web browsers from malware-induced changes in HTML and JavaScript codes, allowing unauthorized access and fraudulent transactions.
Innovation Solution
A method involving a box server that generates and processes HTTP/HTTPS requests, performs encryption and obfuscation on DOM codes, and compares service page codes with rendered codes to detect and prevent alterations, using unique authorization codes and single-use cryptographic keys to secure Web browser interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software is used to counteract computer security attacks, then some level of protection is provided, but the software fails to detect Man-in-the-Browser attacks because malware interacts with browser memory to redirect system calls, making attack detection difficult
Solution Approach 1:
The patent introduces a service page as an intermediary between the user and the web browser. This service page includes a service code that acts as a mediator to monitor and verify the integrity of DOM code, detecting malware-induced alterations without requiring direct access to browser memory or system call redirection points.
Solution Approach 2:
The patent implements a feedback mechanism where the service code continuously monitors DOM code integrity and compares it against expected values. When alterations are detected (indicating malware presence), the system generates alerts and takes countermeasures, creating a closed-loop security system that responds to detected threats.
2Object-generated harmful factors
If malware is installed on the computer to carry out Man-in-the-Browser attacks, then the attacker can manipulate Web browser contents, but this makes the Web browser and Web application unable to identify altered contents
Solution Approach 1:
The patent performs preliminary actions by embedding the service code into the web page before it reaches the user's browser. This service code is positioned in advance to monitor DOM code integrity from the moment the page loads, enabling detection of malware alterations before they can execute harmful actions.
Solution Approach 2:
The patent uses cryptographic hashing to transform DOM code into a verified format. The service code generates and verifies hash values of DOM code, effectively 'changing the appearance' of the code into a verifiable cryptographic representation that can identify any alterations made by malware.
3Adaptability or versatility
If the service page code is sent to the user's Web browser, then the user's computer environment can be tested to identify Internet attacks, but this requires additional communication steps between the box server and Web server
Solution Approach 1:
The service page serves multiple functions simultaneously: it acts as a security monitoring mechanism, a communication vehicle between servers, and a user interface element. By combining these functions into a single web page structure, the patent reduces the need for separate communication protocols and simplifies the overall system architecture.
Solution Approach 2:
The patent merges the security verification functionality with the existing web page delivery mechanism. The service code is embedded within the normal web page content, combining the security monitoring function with the information delivery function, thereby avoiding the need for separate dedicated security communication channels.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to a method of identifying and counteracting Internet attacks, of Man-in-the-Browser and/or Man-in-the-Middle and/or Bot attack types, comprising the steps of: generating a request by a Web browser, concerning a Web application residing in a Web server; sending the request by the Web browser to a box server, which is in signal communication with the Web server; receiving a server DOM code by the box server, which code has been automatically generated by the Web server according to the request; sending a service page code by the box server to the Web browser, in response to the request, the service page code comprising an obfuscated and polymorphic javascript code and/or HTML code; receiving and processing the javascript code and/or HTML code, by the Web browser, to automatically generate an asynchronous request, such that environment data of the Web server may be transmitted to the box server; processing the environment data by the box server, to identify Internet attacks; performing an encryption function on the server DOM code by the box server to generate an obfuscated DOM code, and sending the obfuscated DOM code to the Web browser in response to the asynchronous request; performing a decryption function on the obfuscated DOM code by the service page code, to obtain the server DOM code; rendering the server DOM code by the Web browser.