Browser Sandbox Monitoring for Malicious Ad Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet advertisements often contain malicious code that can execute unwanted actions on users' devices without their knowledge, leading to security risks and loss of control for website owners, as existing browser sandbox attributes and cryptographic measures are insufficient to prevent sophisticated malicious actors from causing harm.
Innovation Solution
A system for detecting malicious code in internet advertisements through ongoing sandbox monitoring, which includes a user device equipped with protection code that intercepts, stops, and refuses to load malicious code, using interceptors to monitor and prevent unwanted actions such as redirects, pop-ups, and data access, thereby isolating potentially harmful code within a behavioral sandbox.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If ads are allowed to run in the trusted scope of the user browsing session with access to first party domain, then ad functionality and user experience are improved, but security risks and potential malicious code execution are increased
Solution Approach 1:
The patent segments the ad execution environment by creating a separate sandboxed context for third-party ad code. The sandbox isolates ad JavaScript from the main browsing session, allowing ads to function while preventing them from accessing the first party domain or performing unwanted actions. This segmentation resolves the contradiction by enabling ad functionality within the trusted scope while containing security risks through environmental separation.
Solution Approach 2:
The patent introduces a sandbox as an intermediary layer between the ad code and the browsing session. This intermediary controls and restricts what the ad code can do, blocking access to sensitive resources while still allowing legitimate ad operations. The sandbox acts as a mediator that permits useful ad functionality while preventing harmful actions, thus resolving the security-trust contradiction.
2Reliability
If browser sandbox attributes and cryptographic service provider measures are used, then security control is improved, but sophisticated malicious actors can still bypass these controls
Solution Approach 1:
The patent applies preliminary action by proactively blocking unwanted actions before they can execute. The system preemptively prevents ad code from performing redirects, accessing sensitive data, or executing other harmful operations by establishing restrictive sandbox policies in advance. This preliminary blocking approach strengthens security controls against sophisticated malware that might otherwise bypass traditional CSP measures.
Solution Approach 2:
The patent implements feedback mechanisms that monitor ad code behavior within the sandbox and enforce policy violations. When malicious or unwanted actions are detected, the system responds by blocking those actions and potentially reporting them. This continuous monitoring and enforcement loop enhances security control reliability, making it more difficult for sophisticated malware to succeed compared to static CSP measures alone.
3Object-affected harmful factors
If ads are completely restricted from accessing first party domain, then security risks are reduced, but ad effectiveness and website owner control are diminished
Solution Approach 1:
The patent applies dynamics by making the sandbox environment configurable and adaptable to different ad policies. Website owners can define what actions are permitted or blocked within the sandbox, allowing legitimate ads to function while preventing malicious ones. This dynamic control approach provides versatility in ad management while maintaining security, resolving the contradiction between restriction and flexibility.
Data Source
AI summary
There are disclosed devices, system and methods for detecting malicious code existing in an internet advertisement (ad) requested by a published webpage viewed by a user. First, receipt of malicious code of the ad is detected, where that code may be malicious code that causes a browser unwanted action without user action. If the internet ad is an SCR type document, the malicious code may be wrapped in a java script (JS) closure to detect an unwanted action requested by the malicious code. The malicious code is executed a browser sandbox that activates the unwanted action, that displays execution of the internet ad and that allows execution of the unwanted action. When a security error resulting from the unwanted action is detected, executing the malicious code in the browser sandbox is discontinued, displaying of the internet ad on the display is discontinued, and execution of the unwanted action is stopped.