Dynamic Web Code Modification for Bot Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems are ineffective in preventing malicious activities such as Man-in-the-Browser attacks, credential stuffing, and website scraping, as they rely on predictable web code structures that can be exploited by malicious parties.
Innovation Solution
Modifying web code (HTML, CSS, JavaScript) served to client computers in random and unpredictable ways, creating a moving target that makes it difficult for malicious code to interact with the content in a predictable manner, while also instrumenting the code to detect and report abnormal interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web code structures are made predictable and stable for ease of operation, then ease of operation is improved, but security against malicious activities deteriorates
Solution Approach 1:
The patent applies dynamics by making web code structures changeable and unpredictable. Specifically, it randomizes DOM element properties, attribute names, and code structures between different page loads and user sessions. This dynamic transformation ensures that while the web application remains functional for legitimate users, malicious bots cannot rely on predictable code patterns to exploit vulnerabilities or perform unauthorized actions.
2Object-affected harmful factors
If web code is modified in random and unpredictable ways to improve security, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent applies local quality by selectively randomizing only specific portions of the web code that are critical for security, while maintaining the functional integrity of the application. Different elements and attributes are randomized with different degrees of unpredictability based on their security importance, allowing the system to enhance security in critical areas without completely disrupting the user experience or application functionality.
3Difficulty of detecting and measuring
If instrumentation code is added to detect abnormal interactions, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary detection layer that monitors interactions between users and the randomized web code. This instrumentation code acts as a mediator, observing abnormal patterns such as automated bot behavior, unauthorized modifications, or suspicious interaction sequences. By placing detection logic between the user agent and the web application, the system can identify malicious activities without fundamentally altering the core application architecture or requiring complete system redesign.
Data Source
AI summary
Techniques for code modification for detecting abnormal activity are described. Web code is obtained. Modified web code is generated by changing a particular programmatic element to a modified programmatic element throughout the web code. Instrumentation code is generated configured to monitor and report on one or more interactions with versions of the particular programmatic element. The instrumentation code is caused to be provided in association with the modified web code to the first client device in response to the first request from the first client device. Report data generated by the instrumentation code is received. The report data describes abnormal activity at the first client device, the abnormal activity comprising an interaction with a version of the particular programmatic element that does not exist in the modified web code. Based on the report, it is determined that the first client device is likely controlled by malware.