Script-Based Scan Engine for Web Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web threat protection methods, such as reputation databases and URL filtering, are ineffective against sophisticated web threats that adapt to users and locations, making it difficult to detect malicious content delivered through advertisement networks.
Innovation Solution
Embedding a script-based scan engine, such as a JavaScript scan engine, into webpages to scan for web threats within the client computer, allowing the webpage to be rendered only when deemed safe, thereby leveraging client computing resources and providing location-independent threat detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If URL filtering and reputation databases are used to protect against web threats, then known malicious web servers can be blocked, but sophisticated web threats that adapt to users and locations cannot be effectively detected
Solution Approach 1:
The patent embeds a scan engine directly into webpages, enabling the webpage itself to perform self-scanning for malicious content. This self-service approach allows the content to be analyzed in its native context without requiring external reputation databases or URL filtering, thereby detecting adaptive threats that change based on user location or profile.
Solution Approach 2:
The patent transitions from server-side URL filtering to client-side embedded scanning, adding a new dimension of threat detection. By embedding the scan engine within the webpage content and executing it in the user's browser, the system can analyze the actual rendered content rather than just filtering based on URL reputation, enabling detection of threats that adapt to user characteristics.
2Reliability
If centralized web threat scanning is performed on security devices, then threat detection can be centralized, but computational burden on security devices increases significantly
Solution Approach 1:
The scan engine is embedded into webpages and executed in the user's browser, enabling the client device to perform its own threat scanning. This eliminates the need for centralized security devices to perform computationally intensive scanning operations, as each user's browser independently scans the webpage content it receives.
Solution Approach 2:
The patent segments the threat detection function from centralized security devices and distributes it to individual client browsers through embedded scan engines. Each browser instance independently executes the scanning function for its own webpage content, dividing the computational burden across many distributed client devices rather than concentrating it in centralized security appliances.
3Adaptability or versatility
If advertisement networks deliver malicious content randomly by geographic location or user profile, then targeted attacks can be delivered, but detection becomes difficult with traditional methods
Solution Approach 1:
The embedded scan engine enables the webpage to self-analyze its own content in the context of the user's browser environment. This allows detection of malicious content that adapts to geographic location or user profile, as the scanning occurs after the content has been personalized and rendered, capturing the final state that the user actually sees.
Solution Approach 2:
The scan engine is embedded into the webpage before delivery to the user, and executes automatically when the webpage is loaded. This preliminary scanning action occurs before the user interacts with potentially malicious content, enabling proactive detection of adaptive threats regardless of how they are personalized based on user characteristics.
Data Source
AI summary
A script-based scan engine is embedded in a webpage requested by a client computer from a web server. The script-based scan engine may be embedded in the webpage by injecting the script-based scan engine in a header of the webpage in a computer security device between the client computer and the web server, or by integrating the script-based scan engine in the webpage as a library. The script-based scan engine executes in the client computer when the webpage is received by the client computer. The script-based scan engine scans the webpage for web threats, which may include malicious codes, exploits, and phishing, for example. The webpage is allowed to be rendered by a web browser in the client computer when the webpage is deemed safe by the script-based scan engine.