Fraud Detection Network System for MITB Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods are ineffective in detecting Man In The Browser (MITB) attacks, where malware hijacks a web browser to perform unauthorized operations, making it difficult for users and virus detection software to recognize the attack, especially since the malware operates within an authorized site connection.
Innovation Solution
A fraud detection network system and method that involves transmitting web content information with a call script from a web server to a user terminal, where the script acquires and executes a fraud detection script to search for detection target data, detecting unauthorized operations, and performing fraud measures, while preventing user input for authentication and using obfuscated scripts to evade detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods are used, then authentication process is simple, but they cannot detect MITB attacks where malware operates within authorized site connections
Solution Approach 1:
The patent introduces a fraud detection server as an intermediary between the web server and user terminal. This server receives web content, analyzes it for malicious scripts, and provides fraud detection scripts to terminals. The intermediary approach allows detection of MITB attacks without fundamentally changing the authentication protocol, thus improving security while maintaining system simplicity.
Solution Approach 2:
The fraud detection server performs preliminary analysis of web content before it reaches the user terminal. By pre-processing and analyzing web pages for malicious scripts, the system identifies potential threats in advance. This preliminary action enables the system to detect MITB attacks before they can compromise authentication, improving reliability without adding complexity to the authentication flow itself.
2Reliability
If fraud detection scripts are transmitted to user terminals, then unauthorized operations can be detected, but network traffic and processing load increase
Solution Approach 1:
The fraud detection server extracts only the essential fraud detection scripts from the complete web content and transmits them separately to user terminals. This extraction approach allows the system to provide detection capabilities without transmitting entire web pages multiple times. The separation of detection scripts from main content reduces redundant network traffic while maintaining fraud detection functionality.
Solution Approach 2:
Instead of transmitting and analyzing complete web content on user terminals, the system creates simplified copies in the form of fraud detection scripts that contain only the necessary analysis logic. These compact script copies enable local fraud detection without requiring substantial network bandwidth for content transmission, thus reducing energy loss while maintaining detection reliability.
3Speed
If web content is analyzed in real-time on user terminals, then fraud detection is immediate, but terminal device resources are consumed
Solution Approach 1:
The fraud detection server acts as an intermediary that performs the resource-intensive web content analysis centrally rather than on user terminals. By concentrating the analytical workload on the server side, the system achieves fast fraud detection through efficient server processing while minimizing energy consumption on mobile terminal devices. The server returns simplified detection results or scripts to terminals, maintaining speed without terminal resource exhaustion.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Problem: A fraud detection network system and a fraud detection method are provided which efficiently detect the behavior of malware performing an unauthorized operation, which are easily introduced and which are unlikely to be attacked. Solution: In a fraud detection network system, a web server device transmits web content information including a call script to a user terminal device, the user terminal device displays the web content and performs the call script. The user terminal device acquires a fraud detection script from a fraud detection server based on the call script, searches detection target data included in the web content information based on the fraud detection script and transmits the result of the search to the fraud detection server device. Then, a predetermined fraud measure operation is performed based on a fraud detection result received from the fraud detection server.