Browser Port Scanning for Remote Fraud Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fraud detection systems in digital banking are vulnerable to remote access trojans (RATs) and automated programs (BOTs) that are difficult to detect and can compromise authenticated data, necessitating improved methods to identify and prevent fraudulent behavior.
Innovation Solution
A method involving port scanning on end-user devices using instructions from a server to detect fraudulent behavior by scanning additional ports, collecting behavioral characteristics, and modifying data delivery based on the presence of RATs or BOTs, while minimizing CPU and network usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If port scanning is performed on end-user devices to detect fraudulent behavior, then detection capability is improved, but device resource consumption (CPU and network usage) increases
Solution Approach 1:
The system performs port scanning on only certain ports that are most relevant to detecting RATs and BOTs, rather than scanning all possible ports. This partial action approach maintains effective detection capability while significantly reducing the CPU and network resources consumed by the scanning operation.
Solution Approach 2:
Port scanning is performed periodically at specific intervals rather than continuously. The scanning operation is triggered at defined moments in the session lifecycle, which reduces overall resource consumption while maintaining the ability to detect fraudulent behavior when it occurs.
2Measurement precision
If behavioral analysis and port scanning are implemented on end-user devices, then fraud detection accuracy is improved, but system complexity increases
Solution Approach 1:
The server acts as an intermediary that manages the complexity of fraud detection. It sends instructions to the end-user device about which ports to scan and when to perform behavioral analysis, then processes the collected data centrally. This distributes the system complexity away from the resource-constrained end-user device while maintaining high detection accuracy.
Solution Approach 2:
The fraud detection system is segmented into multiple components: behavioral characteristic collection on the end-user device, port scanning functionality, and central analysis on the server. This segmentation allows each component to be optimized independently and reduces the complexity burden on any single device.
3Reliability
If secure data transmission is maintained while implementing fraud detection measures, then security is improved, but data delivery time increases
Solution Approach 1:
Behavioral characteristics are collected and port scanning is performed in advance during the session establishment phase, before actual data transmission begins. This preliminary fraud detection allows the system to establish security measures upfront, so that subsequent data transmission can proceed without repeated detection overhead, reducing overall delivery time while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Detecting unauthorized access to a device is detected in embodiments of the disclosed technology. After downloading a webpage, code is executed in a browser to scan network ports and determine which ports are open. Further webpage content sent from a web server is determined and/or modified in embodiments of the disclosed technology based on which ports are open. In some embodiments, when a particular port or ports are already in use it is determined that a malfeasant actor has access to the end user device and as such, sensitive data or secure data which is intended for a specific user is no longer sent to the end user device.