Form Data Transmission Blocking for Untrusted Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems fail to detect and prevent malicious code from transmitting electronic form data to untrusted domains, especially when the code is client-side and uses advanced obfuscation techniques, leading to potential identity theft and fraud.
Innovation Solution
A computer-implemented method and system that identifies web pages with forms, detects multiple data transmissions to different destinations, determines untrusted destinations, and blocks data from being sent to those destinations, using modules for identification, detection, determination, and blocking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware programs are used to detect malicious code, then server protection is improved, but detection capability deteriorates because the malicious code is client-side and uses advanced obfuscation techniques
Solution Approach 1:
Instead of analyzing malicious code on the server side (traditional approach), the system inverts the approach by analyzing data transmissions from the client side. The system monitors POST requests and form data submissions at the network level, detecting malicious transmissions before they reach the server, thereby overcoming the limitation of server-based anti-malware programs unable to detect client-side obfuscated code.
Solution Approach 2:
The system introduces an intermediary layer (network monitoring system) between the client and server. This intermediary monitors and analyzes data transmissions, acting as a mediator that can detect malicious code without requiring server-based anti-malware programs to analyze obfuscated client-side code directly.
2Difficulty of detecting and measuring
If data transmission monitoring is implemented to detect malicious code, then detection capability is improved, but false positives increase due to legitimate form submissions
Solution Approach 1:
The system applies local quality analysis by examining specific characteristics of data transmissions rather than blocking all transmissions uniformly. It analyzes the destination domain reputation, transmission pattern (multiple destinations from same form), and data content to distinguish legitimate from malicious transmissions, thereby reducing false positives while maintaining detection capability.
Solution Approach 2:
The system changes the parameters for detection by monitoring multiple attributes simultaneously: destination domain reputation score, number of destinations, transmission method (POST requests), and form field data. This multi-parameter analysis enables accurate differentiation between legitimate forms and malicious submissions, reducing false positives.
3Difficulty of detecting and measuring
If multiple data transmissions are monitored to detect formjacking attacks, then attack detection is improved, but system complexity increases
Solution Approach 1:
The system implements multi-functionality by using a single network monitoring component to perform multiple tasks: identifying forms, monitoring POST requests, analyzing destination domains, checking reputation scores, and blocking malicious transmissions. This universal approach consolidates multiple security functions into one system, reducing overall complexity while improving attack detection.
Data Source
AI summary
A computer-implemented method for preventing electronic form data from being electronically transmitted to untrusted domains may include (i) identifying a web page that includes an electronic form with field for data entry, (ii) detecting that the web page is electronically sending first and second messages that each include data from the field of the electronic form and that are directed to first and second destinations, respectively, (iii) determining that the first destination includes an untrusted destination, and (iv) blocking the web page from electronically sending the data from the field of the electronic form to the untrusted destination by blocking the first message from being electronically sent. Various other methods, systems, and computer-readable media are also disclosed.