Real-time Behavioral Blocking of Overlay Identity Stealers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions, particularly signature-based detection methods, are ineffective against overlay-type identity stealers as they do not require high proliferation and can adapt to specific web pages, making it difficult to detect and prevent these threats effectively.
Innovation Solution
A computer-implemented method and system that detects initiation of transactional web page sessions, evaluates window properties to identify potential overlay-type identity stealer threats, and blocks malicious behavior during the session using a behavioral blocking engine with detection, evaluation, and blocking modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then malware detection is possible, but overlay-type identity stealers cannot be effectively detected because they do not require high proliferation and can adapt to specific web pages
Solution Approach 1:
The system performs preliminary actions by establishing a baseline model of legitimate web page behavior before the malware can execute. It pre-configures monitoring rules for window properties, input field characteristics, and session behavior patterns. When a transactional web page session is detected, the system has already prepared the evaluation framework to immediately assess any overlay windows against established security criteria, preventing adaptive malware from evading detection.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a behavioral evaluation system. Instead of relying on static binary pattern matching, it uses dynamic evaluation of window properties, process behaviors, and session characteristics. The system substitutes rigid signature-based mechanics with flexible behavioral analysis that can identify malware based on its operational patterns rather than its code structure.
2Reliability
If real-time behavioral blocking is implemented, then overlay-type identity stealers are prevented, but system complexity increases due to continuous monitoring and evaluation requirements
Solution Approach 1:
The system segments the security monitoring task into distinct modular components: a detection module that identifies transactional web page sessions, an evaluation module that assesses window properties and process behaviors, and a blocking module that executes security actions. Each module operates independently with defined interfaces, allowing the complex real-time blocking function to be implemented through coordinated simple modules rather than a monolithic complex system.
Solution Approach 2:
The patent introduces an intermediary evaluation layer between the web page session and the blocking action. This intermediary module acts as a mediator that receives data from the detection module, evaluates it against security criteria, and then triggers blocking actions only when threats are identified. This intermediary structure simplifies the overall system by centralizing the complex evaluation logic in a dedicated component rather than distributing complexity throughout the entire system.
3Speed
If continuous monitoring of window properties is performed, then malicious behavior is detected in real-time, but processing time and computational resources increase
Solution Approach 1:
The system applies local quality by focusing monitoring resources specifically on transactional web page sessions rather than continuously monitoring all system activities. When a transactional session is detected, the system intensifies monitoring of window properties, process behaviors, and input field characteristics only during that specific session. This localized approach maintains high detection speed for critical sessions while reducing overall computational resource consumption by not continuously monitoring non-critical system operations.
Solution Approach 2:
The patent implements partial monitoring by selectively evaluating specific window properties and process characteristics rather than analyzing every system event in detail. The system performs comprehensive evaluation only for properties relevant to overlay-type identity stealer detection (such as window overlay positions, input field coordinates, process parent-child relationships) while using lighter monitoring for other system activities. This partial action approach achieves sufficient detection capability with reduced computational overhead.
Data Source
AI summary
Behavioral blocking of overlay-type identity stealers is achieved by detecting a transactional web page session, evaluating a property of a window corresponding to a process running on the computer system, and then, based on a result of the evaluation, blocking a behavior of the process for a duration of the transactional web page session. The evaluation of the property window involves determining whether the window exhibits one or more characteristics representing activity of an overlay-type identity stealer.