Browser Protection Script for Malicious Client-Side Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective methods to detect and prevent malicious code injected by client-side vectors from executing unwanted actions on user computing devices, leading to security vulnerabilities and unauthorized browser actions.
Innovation Solution
A system and method that involves executing a protection script in the browser to detect and intercept malicious code received from malicious client-side injection vectors, using a combination of behavioral sandboxes and interceptors to monitor and prevent the execution of unwanted actions, thereby enhancing control over third-party JavaScript code executed on websites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ads are allowed to run with full access to first party domain, then ad functionality is improved, but security risk increases due to potential malicious code execution
Solution Approach 1:
The patent introduces an intermediary protection script that runs between the ad and the first party domain. This protection script monitors and controls what the ad can do, allowing legitimate ad functionality while blocking malicious actions. The protection script acts as a mediator that permits safe operations but intercepts and prevents harmful code execution, thus resolving the contradiction between ad access capability and security risk.
2Reliability
If protection scripts are implemented to detect malicious code, then security is improved, but device complexity increases
Solution Approach 1:
The protection script is designed to be self-executing and self-managing within the browser environment. Once deployed, it automatically monitors ad behavior, detects malicious code patterns, and blocks harmful actions without requiring continuous external intervention or complex configuration. The script serves itself by maintaining its own execution context and autonomously making security decisions, thus improving security while minimizing the increase in device complexity.
3Object-affected harmful factors
If malicious code detection is implemented, then harmful factors are reduced, but ease of operation decreases due to additional monitoring overhead
Solution Approach 1:
The protection script performs preliminary actions by establishing its monitoring framework before any ad content is loaded or executed. It pre-defines the rules and interceptors for detecting malicious code, so that when ads are displayed, the detection mechanisms are already in place and operational. This preliminary setup allows the system to automatically block harmful actions without requiring real-time user intervention or complex runtime decisions, thus reducing harmful factors while maintaining ease of operation.
Data Source
AI summary
There are disclosed devices, system and methods for detecting malicious scripts received from malicious client side vectors. First, a script received from a client side injection vector and being displayed to a user in a published webpage is detected. The script may have malicious code configured to cause a browser unwanted action without user action. The script is wrapped in a java script (JS) closure and/or stripped of hyper-text markup language (HTML). The script is then executed in a browser sandbox that is capable of activating the unwanted action, displaying execution of the script, and stopping execution of the unwanted action if a security error resulting from the unwanted action is detected. When a security error results from this execution in the sandbox, executing the malicious code is discontinued, displaying the malicious code is discontinued, and execution of the unwanted action is stopped.