Browser DOM Manipulation for Automated Web Threat Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser security systems struggle to prevent the insertion of malicious code or malware into HTML documents before user interaction, as human judgment is often required, making complete prevention difficult.
Innovation Solution
A browser extension that inserts observer and manipulation scripts to analyze webpage content, assess risk, and automatically modify the webpage by displaying UI elements or blocking content to mitigate potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If browser security systems rely on human judgment to identify malicious content, then users can make informed decisions about what to click, but complete prevention of malware installation cannot be achieved
Solution Approach 1:
The system performs preliminary analysis of webpage content by inserting observer scripts that monitor and evaluate DOM elements before the user interacts with them. The sensor computer assesses risk values in advance, and corrective actions are prepared beforehand, enabling automated prevention without requiring human judgment at the moment of interaction.
Solution Approach 2:
The system introduces an intermediary sensor computer that acts as a mediator between the browser and malicious content. The sensor computer receives webpage data, performs security analysis, and returns risk assessments and corrective actions, thereby automating the security evaluation process that previously required human judgment.
2Difficulty of detecting and measuring
If observer scripts are inserted into webpage content to analyze security risks, then automated threat detection is improved, but the complexity of the browser extension increases
Solution Approach 1:
The browser extension is segmented into distinct functional components: observer scripts that monitor DOM elements, manipulation scripts that execute corrective actions, and a sensor computer that performs risk analysis. This segmentation allows each component to specialize in specific tasks, improving detection capability while organizing complexity into manageable modules.
Solution Approach 2:
The observer scripts and sensor computer are designed to handle multiple types of security threats and webpage elements through a unified interface. The system can assess various risk types (malicious scripts, phishing content, drive-by downloads) using the same core infrastructure, reducing overall system complexity despite enhanced detection capabilities.
3Reliability
If the sensor computer analyzes all webpage content before user interaction, then security risk assessment is improved, but processing time and computational resources increase
Solution Approach 1:
The observer scripts selectively monitor specific DOM elements and webpage characteristics that are most indicative of security risks, rather than analyzing every single element. The sensor computer focuses computational resources on high-risk areas identified by the observer scripts, achieving reliable security assessment with reduced processing time and resource consumption.
Data Source
AI summary
A computer-implemented method executed using a browser extension that is associated with a web browser of a client computer, the method comprising: detecting that the web browser of the client computer has initiated loading a web page into computer memory of the client computer; inserting one or more browser-executable scripts into the web page in the computer memory; using the one or more browser-executable scripts, obtaining data on one or more aspects of the web page; sending the data on the one or more aspects of the web page to a second computer for analysis; receiving from the second computer a risk value corresponding to a potential security risk associated with the one or more aspects of the web page; based on the risk value, selecting a corrective action from among a plurality of different corrective actions, wherein each different corrective action in the plurality of different corrective actions corresponds to a different risk value associated with the potential security risk; executing the corrective action by modifying the web page in the computer memory.