Dynamic Polymorphism Script Injection for Bot Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security techniques struggle to effectively differentiate between legitimate user requests and malicious bot activities in browser-executed script code, as bots can mimic human interactions and evade static polymorphism-based defenses.

Innovation Solution

Implementing dynamic polymorphism by injecting obfuscated script code into web pages, which transforms HTML form attributes randomly and periodically, making it difficult for bots to analyze and reverse-engineer, while allowing legitimate users to access the content without interruption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static polymorphism is used to transform HTML form field attributes, then malicious scripts relying on static attributes are defeated, but the polymorphism can be reverse-engineered and evaded

Engineering Contradiction:

Improvesecurity effectivenessVSAvoidresistance to reverse engineering

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent transforms static polymorphism into dynamic polymorphism by introducing JavaScript code that continuously changes form field attributes during page execution. The attributes are no longer fixed but evolve over time, making reverse-engineering attempts ineffective since the target keeps changing during the attack window.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The form field attributes are transformed periodically through JavaScript execution cycles. The patent uses setInterval or similar mechanisms to repeatedly randomize and update form field names, IDs, and other attributes, creating a periodic transformation pattern that prevents bots from capturing stable targets for automation.

Inventive Principle:

Principle #19Periodic action

2Reliability

If form field transformation is applied to each client access, then static attribute-based attacks are prevented, but the transformation must be re-implemented for every page load

Engineering Contradiction:

Improveattack preventionVSAvoidtransformation implementation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent embeds the transformation logic directly into the HTML page during server-side rendering. The JavaScript code for dynamic polymorphism is pre-injected into the page template, so when the page loads in the browser, the transformation mechanism is already in place and begins executing immediately without requiring separate setup steps.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The form field transformation is made self-executing through JavaScript that automatically runs when the page loads. The transformation logic is embedded in the page itself, allowing it to self-activate and self-maintain without external intervention, eliminating the need for repeated manual or server-side transformation actions on each page load.

Inventive Principle:

Principle #25Self-service

3Difficulty of detecting and measuring

If dynamic polymorphism with JavaScript injection is implemented, then reverse-engineering difficulty increases, but the system complexity increases

Engineering Contradiction:

Improvereverse-engineering difficultyVSAvoidsystem complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The patent introduces JavaScript code as an intermediary layer between the static HTML and the browser's form field access. This intermediary dynamically transforms the form field attributes, adding a layer of complexity that intercepts and modifies attribute access, thereby increasing reverse-engineering difficulty while maintaining a relatively simple underlying HTML structure.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If continuous transformation of form attributes is performed, then bot automation is disrupted, but legitimate user experience may be affected

Engineering Contradiction:

Improvebot filtering effectivenessVSAvoiduser interaction smoothness

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent applies dynamic polymorphism selectively to specific form field attributes that are critical for bot automation (such as form field names, IDs, and action URLs) while leaving other page elements unchanged. This localized application disrupts bot automation targets without affecting the overall user interface and interaction flow for legitimate users.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS9438625B1Mitigating scripted attacks using dynamic polymorphism

Publication Date: 2016.09.06 SHAPE SECURITY INC

AI summary

In an embodiment, a data processing system comprises one or more processors; script analysis logic coupled to the one or more processors and configured to obtain a particular electronic document from a server computer; script injection logic coupled to the one or more processors and configured to insert a set of script code into source code of the electronic document to result in producing a modified electronic document prior to providing the modified electronic document to a client computer; wherein the script code is configured to improve resistance of the client computer to attacks by running upon loading in the client computer and to cause transforming, when running in the client computer, one or more values of one or more elements of the source code of the electronic document into obfuscated values of the one or more elements. As a result, the system and method herein improve resistance of the client computer to attacks.