Browser Malware Detection via DOM and JS Namespace Inspection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Sophisticated malware, such as 'man in the browser' (MITB) attacks, compromise web interfaces to facilitate fraudulent transactions by altering HTML code, making it difficult to detect and prevent unauthorized access to sensitive information.

Innovation Solution

Implementing a system with a DOM inspector and a JS namespace inspector that detects anomalous elements and objects on webpages rendered on user devices, comparing them to known standards to identify and report compromised webpages, thereby reducing the risk of data theft.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional web interface monitoring is used, then system resource usage remains low, but detection capability against MITB malware is insufficient

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The inspection system is divided into separate modules: a DOM inspector that analyzes HTML structure and a JS namespace inspector that monitors JavaScript execution. Each inspector operates independently with specialized detection logic, allowing the system to achieve comprehensive coverage without requiring a monolithic complex architecture

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces intermediary inspection mechanisms that act as mediators between the web interface and the user. The DOM inspector and JS namespace inspector serve as intermediate layers that monitor and analyze web content without directly interfering with the core browser functionality, enabling detection while maintaining system simplicity

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If comprehensive web interface inspection is implemented, then detection accuracy improves, but processing time increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary inspections by checking for known malicious patterns and anomalies in DOM structure and JS namespace definitions before full webpage rendering completes. This early detection approach allows the system to identify compromised pages quickly without waiting for complete page load and analysis

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The inspection mechanism applies partial analysis by focusing on critical detection points such as DOM element anomalies and JavaScript namespace injections. Rather than analyzing every single element and script, the system targets specific high-risk areas where MITB malware typically manifests, achieving effective detection with reduced processing overhead

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10015191B2Detection of man in the browser style malware using namespace inspection

Publication Date: 2018.07.03 PAYPAL INC

AI summary

Methods and systems for detecting fraudulent activity are described. A user types in a web address in his or her browser to request a webpage from a server, and the server communicates the webpage to the user. The communicated webpage includes a document object model (DOM) inspector and/or a JavaScript (JS) namespace inspector. The DOM inspector and JS namespace inspector detect anomalous DOM elements and anomalous JS namespace elements respectively. The DOM inspector and JS namespace inspector discover objects on the rendered webpage that should not be there.