Polymorphic Web Content Security Countermeasures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems are inadequate in effectively detecting and deflecting malware, particularly in ecommerce environments, where 'Man in the Browser' attacks can intercept sensitive information, and existing countermeasures are not dynamic enough to adapt to evolving threats.
Innovation Solution
Implementing a system that serves transcoded and polymorphically updated content with embedded security countermeasures, including persistent tokens and instrumentation code, which continuously monitors and adapts to malware interactions, using a combination of countermeasures to maintain a moving target for malicious actors and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static security countermeasures are deployed, then implementation simplicity is maintained, but effectiveness against evolving malware deteriorates
Solution Approach 1:
The patent implements dynamic security countermeasures that automatically update and adapt to evolving malware threats. The system transitions from static defensive code to dynamically generated countermeasures that respond to detected malware behavior, ensuring continuous effectiveness against new threats while maintaining manageable complexity through automated update mechanisms.
Solution Approach 2:
The system changes parameters of security countermeasures based on detected malware characteristics. By modifying countermeasure behavior and parameters in response to malware detection, the system adapts its defensive strategy without requiring complete system redesign, balancing effectiveness improvement with implementation feasibility.
2Reliability
If multiple security countermeasures are layered, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments security countermeasures into multiple functional layers that operate independently but coordinate together. This segmentation allows each layer to specialize in specific detection tasks, improving overall detection capability while managing complexity through modular design and clear separation of security functions.
Solution Approach 2:
The system merges multiple security countermeasures into a coordinated defense system where layered countermeasures work together synergistically. By combining detection, analysis, and response functions into an integrated multi-layered approach, the system achieves superior malware detection capability while managing complexity through unified coordination mechanisms.
3Reliability
If web code is modified before serving, then security against client-side attacks is improved, but code delivery complexity increases
Solution Approach 1:
The patent applies security countermeasures to web code before the code is served to clients. By preemptively embedding defensive measures into the delivered code, the system protects against client-side attacks including Man in the Browser attacks without requiring complex runtime modification infrastructure, simplifying the code serving architecture.
Solution Approach 2:
The system introduces an intermediary code modification layer between the web server and client delivery. This intermediary component handles the insertion and configuration of security countermeasures, isolating the complexity of code modification from both the web server and the delivered code, thereby managing system complexity while maintaining strong security protection.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A computer-implemented security method includes receiving, at a server sub-system, reports from a plurality of clients that were served content served by a web server system, the different versions of content varying from each other by polymorphic transformation that inserts varying content at common locations in the content; determining, with the server sub-system, an effectiveness level of security countermeasures applied to the content, using the received reports; selecting an updated security countermeasure package determined to address malware identified using data from the reports; and providing to the web server system information causing the web server system to switch to the updated security countermeasure package.