Browser Extension Vetting via Source Code Rewriting

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Marketplaces face challenges in ensuring the quality and security of web applications and browser extensions, as existing methods lack efficient automated vetting processes to detect malicious or unreliable digital goods before they are made available to users.

Innovation Solution

A computer-implemented method that rewrites the source code of digital goods to include tracking code, allowing for automatic evaluation of their behavior during execution, determining whether they violate predetermined conditions, and deciding whether to discourage their download or execution based on the results.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If automatic vetting processes are implemented to detect malicious digital goods, then security and reliability of users are improved, but device complexity and processing time increase

Engineering Contradiction:

Improvesecurity of digital goodsVSAvoidvetting process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs static analysis of digital goods before they are distributed to users. By analyzing the code structure, dependencies, and potential malicious patterns in advance, the system can identify security issues prior to execution, reducing the need for complex runtime analysis and improving overall vetting efficiency

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary analysis layer between the digital good distribution and user execution. This intermediary component intercepts digital goods, performs automated security analysis using multiple techniques, and only allows approved goods to proceed to users, thereby isolating security risks without blocking legitimate functionality

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If dynamic execution analysis is performed to evaluate behavior during runtime, then detection accuracy of malicious behavior is improved, but processing time and computational resources increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidvetting processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies partial dynamic analysis by executing the digital good in a controlled sandbox environment with limited resources and time constraints. This partial execution captures critical behavioral patterns while avoiding the computational burden of full runtime analysis, achieving sufficient detection accuracy without excessive processing time

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If manual review processes are used to ensure quality standards, then reliability of vetting is improved, but productivity and time to market decrease

Engineering Contradiction:

Improvevetting reliabilityVSAvoiddigital good listing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system implements self-service automated vetting where the digital good analysis system independently evaluates each submission against predefined security criteria and quality standards. The automated system performs code analysis, dependency checking, and behavior simulation without requiring human intervention, thereby maintaining high reliability while dramatically improving processing speed

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system incorporates feedback mechanisms where the automated analysis results are immediately fed back into the vetting decision process. Based on the automated assessment, the system can either approve digital goods for immediate listing or flag them for additional review, creating a rapid iterative process that maintains both speed and reliability

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9219719B1Automatic dynamic vetting of browser extensions and web applications

Publication Date: 2015.12.22 GOOGLE LLC

AI summary

A digital good offered for downloading from a first computing system to a client computing device for execution by a browser executing on the client is identified. The digital good is received at a third computing system, where source code for the received digital good includes scripting language code. The code is re-written to include tracking code to track behavior of the digital good during execution of the digital good, and the re-written digital good is executed in a browser run by the third computing system. Based on evaluation of results of executing the re-written digital good, it is automatically determined, by the third computer system, whether the digital good violates one or more predetermined conditions, and based on the determination of whether the digital good violates a predetermined conditions, it is automatically determined whether to discourage downloading the digital good to, or executing the digital good by, the client.