Dynamic Web Code Obfuscation for Malware Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security measures are inadequate in preventing malicious activities, such as Man-in-the-Browser attacks, where malware intercepts and alters legitimate communications by exploiting predictable web server structures, making it difficult to detect and deflect unauthorized transactions.
Innovation Solution
A system that modifies legitimate web code served to clients by changing function and variable names randomly each time, adding instrumentation code to detect abnormal behavior, and reversing modifications in client requests to maintain a moving target for malicious code, thereby preventing exploitation and identifying potential malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web code is modified randomly each time it is served to create a moving target, then security against malware exploitation is improved, but code complexity and difficulty of maintenance increase
Solution Approach 1:
The patent applies dynamics by making the web code mutable and time-dependent. Instead of serving static code, the system dynamically modifies code elements (variable names, function names, attributes) on each request or session basis. This creates a moving target that prevents malware from reliably exploiting predictable code structures, directly resolving the contradiction between security and complexity by accepting controlled complexity to achieve dynamic security.
Solution Approach 2:
The patent changes parameters of the code by randomly transforming identifiers, names, and attributes of web elements. Rather than changing the fundamental logic or structure, it modifies surface-level parameters (names, labels, identifiers) that malware typically targets. This approach improves security by making exploitation difficult while minimizing the impact on code complexity, as the core functionality remains unchanged.
2Difficulty of detecting and measuring
If code modifications are applied to prevent exploitation, then detection capability is improved, but false positives from legitimate code changes increase
Solution Approach 1:
The patent implements feedback mechanisms where the system monitors how clients interact with the modified code and uses this information to adjust future modifications. By observing legitimate user behavior patterns and comparing them against expected interactions with modified code elements, the system can distinguish between genuine exploitation attempts and legitimate code adaptations, thereby reducing false positives while maintaining high detection capability.
Solution Approach 2:
The patent performs preliminary actions by pre-modifying code before serving it to clients, and pre-establishing monitoring rules for detecting exploitation attempts. The system prepares detection signatures and modification patterns in advance, allowing it to quickly identify malicious activity without having to analyze every interaction in real-time. This preliminary preparation reduces the likelihood of false positives by establishing baseline expectations for legitimate versus malicious behavior.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
In one implementation, a computer-implemented method can identify abnormal computer behavior. The method can receive, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet. The method can also modify the computer code to obscure operational design of the web server system that could be determined from the computer code, and supplement the computer code with instrumentation code that is programmed to execute on the computing client. The method may serve the modified and supplemented computer code to the computing client.