Client-Side Web Page Tampering Detection via DOM Mutation Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are inadequate in detecting and preventing fraudulent client-side web modifications that are uncharacteristic of a particular user, particularly due to limitations in detecting ephemeral scripts and false positives from legitimate user behavior.
Innovation Solution
The use of a MutationObserver instance to monitor a web page Document associated with a DOM, capturing event-based mutations, and comparing them to user behaviometric history data to identify and prevent fraudulent tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional script injection detection methods are used, then detection can be performed at specific points in the user journey, but detection reliability deteriorates and user experience is severely impacted due to millisecond-level checks
Solution Approach 1:
The system performs preliminary configuration by establishing a baseline profile of legitimate user interactions with the web page before actual tampering detection begins. This baseline captures normal DOM manipulation patterns, allowing the system to later compare suspicious activities against established legitimate behavior without requiring continuous millisecond-level monitoring during user interaction.
Solution Approach 2:
The system implements feedback mechanisms where detected DOM mutations are continuously compared against the established baseline profile. When anomalies are detected, the system provides feedback by flagging suspicious activities while allowing legitimate user actions to proceed uninterrupted, thus maintaining user experience while improving detection reliability through iterative comparison.
2Measurement precision
If extension profiling is used to detect specific code variables, then precise detection can be achieved, but substantial effort is required to stay up-to-date and false positives occur when users replace extensions with equivalent ones
Solution Approach 1:
The system transitions from detecting specific code variables (which require constant updating) to analyzing behavioral parameters and interaction patterns. By focusing on how users interact with the web page rather than specific extension code variables, the system maintains detection precision while eliminating the need for continuous maintenance of variable lists, as behavioral patterns remain consistent even when extensions are replaced.
3Reliability
If continuous monitoring is performed to detect ephemeral scripts, then detection capability improves, but system resource consumption and false positives increase
Solution Approach 1:
The system performs preliminary configuration by establishing a baseline profile of legitimate user interactions with the web page before actual tampering detection begins. This baseline captures normal DOM manipulation patterns, allowing the system to later compare suspicious activities against established legitimate behavior without requiring continuous millisecond-level monitoring during user interaction.
Solution Approach 2:
The system applies partial monitoring by focusing only on specific DOM mutation events that are indicative of potential tampering, rather than continuously monitoring all DOM changes. This selective approach allows detection of ephemeral scripts while minimizing system resource consumption by avoiding excessive monitoring of normal user interactions.
Data Source
AI summary
System and methods are provided for client-side web page tampering assessment and fraud prevention by detection of one or more events that are uncharacteristic of user-specific behavior. A method is provided for monitoring a web page Document associated with a Document Object Model (DOM) of a browsing session of a user, capturing one or more event-based mutations of the web page Document, and retrieving, from a profile repository, user behaviometric history data. Responsive to comparing the one or more event-based mutations to the user behaviometric history data, the method can include denying continuation of the browsing session based on a predetermined similarity mismatch of the one or more event-based mutations to entries in the user behaviometric history data and output one or more indications of potential fraud.