Intercepting Cross-Origin Malicious Code in Web Ads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet advertisements often contain malicious code that can execute unwanted actions on users' devices without their consent, compromising security and privacy, as current browser controls are insufficient to prevent such malicious activities.
Innovation Solution
A system and method for detecting and intercepting cross-origin malicious code in internet advertisements, using a protection code that monitors and intercepts the execution of ads, preventing harmful actions by employing a behavioral sandbox and interceptors to block unwanted redirects and content downloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If internet advertisements are allowed to execute freely in the browser, then advertising functionality and user experience are maintained, but malicious code can perform harmful actions such as unwanted redirects and data access
Solution Approach 1:
The patent introduces a protection code as an intermediary layer between the advertisement code and the browser environment. This protection code wraps the advertisement code and intercepts its execution, allowing legitimate advertising functionality to proceed while blocking harmful actions. The protection code acts as a mediator that filters and controls what the advertisement code can do, preventing malicious activities without completely blocking advertising operations.
Solution Approach 2:
The patent implements preliminary action by wrapping the advertisement code with protection code before execution. The protection code is installed in advance and sets up interception mechanisms that monitor and control the advertisement code's actions. This preliminary setup allows the system to prevent harmful actions before they occur, rather than reacting to them after execution.
2Reliability
If browser sandbox attributes and CSP are used to restrict ad execution, then some security control is achieved, but sophisticated malicious actors can still bypass these controls
Solution Approach 1:
The patent implements feedback mechanisms where the protection code continuously monitors the execution of advertisement code and dynamically responds to detected malicious behaviors. When harmful actions are detected, the protection code adjusts its interception and blocking behavior in real-time. This feedback loop enables the system to adapt to sophisticated malware techniques that try to evade static sandbox restrictions.
Solution Approach 2:
The patent transforms the static browser sandbox attributes into a dynamic protection system. Instead of relying on fixed CSP rules that malware can bypass, the protection code dynamically wraps and controls advertisement execution, adapting its behavior based on what it detects during runtime. This dynamic approach makes it much harder for sophisticated malware to find and exploit static vulnerabilities.
3Reliability
If advertisement code is thoroughly vetted and reviewed before execution, then security is improved, but processing time and system complexity increase
Solution Approach 1:
The patent applies preliminary action by wrapping advertisement code with protection code during the ad serving process, before actual execution. This wrapping happens as part of the normal ad delivery workflow, avoiding the need for separate, time-consuming security review processes. The protection code is installed in advance, so when the advertisement executes, the security controls are already in place and operational.
Solution Approach 2:
The protection code enables self-service security by automatically monitoring and controlling advertisement execution without requiring external security review processes. The system protects itself by implementing interception and validation mechanisms that operate autonomously during ad execution, eliminating the need for manual or external vetting processes that would add time delays.
Data Source
AI summary
There are disclosed devices, system and methods for detecting cross-origin malicious code existing in an internet advertisement (ad) requested by a published webpage viewed by a user. First, receipt of the ad is detected, where that ad includes cross-origin malicious code that causes a browser cross-origin unwanted action without user action. The ad is then executed in a browser sandbox that displays the cross-origin malicious code and intercepts the cross-origin unwanted action. When a cross-origin security error results from this execution, the cross-origin malicious code is discontinued and the cross-origin unwanted action is intercepted.