Browser Tab Correlation for Fraudulent Session Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current state-of-the-art user behavioral mapping solutions fail to accurately detect and track the number of open browser tabs or windows, which can indicate fraudulent behavior, due to the inability to share information between sandboxed processes and the ease of manipulation of device information like userAgent strings.
Innovation Solution
The technology utilizes the BroadcastChannel interface and sessionStorage property in web browsers to associate foreground and background processes, enabling the detection and analysis of multiple browser tabs and windows, and compares this data to normal and fraudulent use patterns to authorize or deny online sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing is used to track online behaviors and prevent viruses, then security is improved, but the ability to share information between processes is lost, making it difficult to detect multiple views
Solution Approach 1:
The patent introduces a mediator mechanism using BroadcastChannel and sessionStorage that enables controlled information sharing between sandboxed browser processes. The sessionStorage serves as an intermediary storage space where one process can write data and another process can read it, while BroadcastChannel acts as a communication bridge that allows processes to subscribe to and receive updates about each other's activities. This resolves the contradiction by maintaining sandbox isolation while enabling necessary information exchange for detecting multiple views.
2Ease of manufacture
If conventional methods using session date and userAgent string are used to detect multiple views, then implementation is simple, but the information can be easily manipulated and does not provide accurate determination of user behavior
Solution Approach 1:
The patent creates a more reliable copy of user behavior data by utilizing browser's inherent sessionStorage and BroadcastChannel mechanisms that are difficult to manipulate compared to userAgent strings. Instead of relying on easily spoofed conventional identifiers, the system captures and correlates actual browsing context information (tabs, windows, frames) through these more secure browser APIs, thereby improving measurement precision while maintaining implementation feasibility.
3Quantity of substance
If current state-of-the-art solutions combine IP, userAgent, DateTime and other device information are used to correlate view information, then more data is collected, but the information can still be spoofed and does not provide sufficient information for accurate assessment
Solution Approach 1:
The patent extracts and focuses on the most reliable indicators of multiple views by utilizing BroadcastChannel and sessionStorage directly, rather than attempting to correlate multiple spoofable data points. This extraction approach isolates the critical signaling mechanism (BroadcastChannel messages and sessionStorage data) that directly reflects actual browser context state, removing the noise and vulnerability of combining multiple manipulatable data sources.
Data Source
AI summary
Systems and methods are provided for detecting potentially fraudulent online behavior, and for assessing advanced user patterns by the detection of the use of multiple windows or tabs. The method includes collecting behavioral data of a user across windows and/or tabs of a browser of a user device running on or accessing a website, determining the use of multiple browser tabs and/or windows running on the website by associating a foreground process of the browser to a background process of the browser, comparing the collected behavioral data and the determined use of the multiple browser tabs and/or windows running on the website to normal use patterns and fraudulent use patterns, and authorizing the online session based on the comparing indicating a match with normal use patterns or denying the online session based on the comparing indicating a match with one or more fraudulent use patterns.