Client Device Input Analysis for Malware Protection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Previous technologies for providing access to hosted applications on client devices are ineffective in detecting user input generated by malware, leading to unauthorized access and compromising the security of remotely hosted applications.

Innovation Solution

The client device collects and analyzes user input to detect machine behavior simulating human inputs, preventing further access to the hosted application if such behavior is detected, and may display verification queries to confirm human input, modifying training datasets to improve detection accuracy over time.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the client device allows all user inputs to reach the hosted application, then ease of operation is maintained, but security reliability deteriorates due to malware-generated inputs

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidease of operation
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary input analysis component that sits between the user input interface and the hosted application. This intermediary analyzes incoming inputs to distinguish between human-generated and machine-generated inputs, allowing legitimate inputs to pass through while blocking malicious ones. The intermediary maintains ease of operation for legitimate users while improving security reliability by filtering out malware-generated inputs.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary analysis of user inputs before they reach the hosted application. The input analysis component performs preliminary detection of machine-generated inputs and prevents them from reaching the application. This preliminary action ensures that security checks are completed in advance, maintaining both security reliability and ease of operation for legitimate users.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If the hosted application implements attack detection, then security reliability improves, but device complexity and resource consumption increase

Engineering Contradiction:
Improvesecurity reliabilityVSAvoiddevice complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the attack detection functionality from the hosted application and relocates it to the client device's input analysis component. This extraction reduces the complexity and resource burden on the server while maintaining security reliability. The client device handles the complex task of analyzing input patterns, allowing the hosted application to remain simple and resource-efficient.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If malware-generated inputs are allowed to traverse the network, then network throughput is maintained, but security reliability deteriorates

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidnetwork resource waste
Core Design Contradiction:
ReliabilityVSLoss of energy

Solution Approach 1:

The patent implements preliminary filtering of inputs at the client device before they are transmitted over the network. The input analysis component identifies and blocks malware-generated inputs in advance, preventing them from consuming network resources. This preliminary action ensures that only legitimate inputs traverse the network, maintaining security reliability while avoiding network resource waste.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS11347842B2Systems and methods for protecting a remotely hosted application from malicious attacks
Publication Date: 2022.05.31 CITRIX SYSTEMS INC
  • US11347842B2 patent drawing
  • US11347842B2 patent drawing
  • US11347842B2 patent drawing

AI summary

User input is collected that is received by a client device, where the client device provides access to a remotely hosted application. The client device analyzes the collected user input received by the client device in order to detect collected user input indicative of machine behavior that simulates inputs provided by a user. The client device prevents subsequent access to the hosted application through the client device in response to detection of collected user input received by the client device indicative of machine behavior that simulates inputs provided by a user, in order to protect the remotely hosted application from malicious attacks.