Decoy Code for MitB Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for combating Man-in-the-Browser (MitB) attacks can be easily disabled and only detect, rather than prevent, malicious code injections in web browsers, allowing sensitive information to be stolen.
Innovation Solution
Modifying web page code by adding decoy code with characteristics of known malware injection points, which is obscured from users and monitored for injected code, using obfuscation techniques and monitoring code to detect and notify of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If decoy code is added to web page code to combat MitB attacks, then detection capability is improved, but web page complexity increases
Solution Approach 1:
The web page code is segmented into functional code and decoy code. The decoy code is isolated in specific locations (such as comments sections or hidden divs) and can be independently monitored without affecting the main functionality of the web page. This segmentation allows the detection system to operate separately from the core application logic.
Solution Approach 2:
Monitoring code acts as an intermediary between the decoy code and the detection system. The monitoring code embeds itself in the decoy code and automatically detects injected malicious code, then reports findings without requiring direct user intervention or complex analysis of the entire web page structure.
2Reliability
If monitoring code is added to detect injected code, then security is improved, but processing overhead increases
Solution Approach 1:
The monitoring code is pre-installed in the decoy code during web page generation. This preliminary action ensures that detection capabilities are already in place before any attack occurs, allowing immediate detection of injected code without requiring additional processing resources during the attack itself.
Solution Approach 2:
The monitoring code performs self-detection by automatically identifying injected malicious code within the decoy code structure. It uses simple pattern matching and integrity checks that require minimal processing power, allowing the system to monitor itself without external assistance or heavy computational resources.
3Reliability
If decoy code is obscured from users, then security is improved, but code complexity increases
Solution Approach 1:
Different portions of the web page code have different properties: functional code is visible and executable, while decoy code is obscured and non-executable. The decoy code is placed in specific locations such as HTML comments or hidden CSS divs where it remains invisible to users but accessible to monitoring mechanisms. This local differentiation allows security improvements without affecting user experience.
Data Source
AI summary
Methods and apparatus are described for automatically modifying web page code. Specific implementations relate to the modification of web page code for the purpose of combatting Man-in-the-Browser (MitB) attacks.