Polymorphic Web Code Encoding for Malware Deterrence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web traffic from malware bots poses a significant challenge, as they can exploit web sites to steal user data and disrupt operations, and existing solutions are inadequate in preventing such malicious activities.
Innovation Solution
Modifying web code (HTML, CSS, JavaScript) before serving it to client devices, using techniques like polymorphism to create a dynamic and random encoding that makes it difficult for malware to predict and interact with the code predictably, thereby preventing malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web code is modified using polymorphism to create dynamic and random encoding, then malware interaction difficulty increases and security improves, but code complexity increases
Solution Approach 1:
The patent applies dynamics by transforming static web code into dynamic, polymorphic code that changes its structure and encoding randomly with each execution. The code modifications are made so that the same web page delivers different encoded versions to different users or even to the same user across different sessions, making malware analysis and prediction extremely difficult while maintaining the same functional output.
Solution Approach 2:
The patent changes code parameters by systematically modifying various aspects of the web code including variable names, function names, control flow structures, and data encoding. These parameter changes are applied in a polymorphic manner where the same logical functionality is preserved but the syntactic representation changes randomly, increasing security without altering the underlying business logic.
2Object-affected harmful factors
If different code is served to different clients or sessions, then predictability for malware decreases, but code management complexity increases
Solution Approach 1:
The patent segments the code modification process into distinct components: identification of target code elements, selection of transformation rules, application of polymorphic changes, and verification of functional equivalence. This segmentation allows the system to manage the complexity of serving different code versions by breaking down the transformation process into reusable, independently managed modules.
Solution Approach 2:
The patent introduces an intermediary layer between the original web code and the delivered code that automatically applies polymorphic transformations. This intermediary component handles the complexity of code management by acting as a mediator that translates static code into dynamic, randomized versions without requiring manual intervention for each code delivery, thus reducing management overhead.
3Object-affected harmful factors
If code modifications are made to encode sensitive data, then data theft prevention improves, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-compiling and caching transformation rules and polymorphic code templates before they are needed during runtime. The system prepares multiple encoded versions of critical code segments in advance and stores them for rapid retrieval, reducing the processing time overhead during actual code delivery while maintaining strong encoding protection for sensitive data.
Data Source
AI summary
A computer-implemented method, the method includes identifying a piece of data to be served from a server system to a client device that is remote from the server system; creating a plurality of expressions that, when executed, provide a result that corresponds to the piece of data; and providing the plurality of expressions to the client device with code for executing the plurality of expressions.