Server-Based Frame Detection for Affiliate Fraud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Affiliate programs in internet commerce are susceptible to frauds like cookie stuffing and history stuffing, where affiliates illegitimately update user cookies or browsing history without the user's knowledge, making it difficult for merchants to accurately track referrals and compensate affiliates fairly.
Innovation Solution
A server-based frame detection system that detects the use of child frames in web pages without relying on client-side scripting, using a server-based frame detection system with modules like a web server module and a frame detection module, and employing techniques such as the X-Frame-Options header to prevent illegitimate referrals by ensuring frames are only loaded from the same domain, and using nonce values to verify legitimate referrals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If client-side scripting (JavaScript) is used to detect fraudulent practices, then detection capability is improved, but reliability deteriorates when scripting is disabled
Solution Approach 1:
The patent introduces a server-based frame detection system that acts as an intermediary between the web server and client browser. This server-side component analyzes HTTP requests and responses to detect child frames without requiring client-side scripting, thereby maintaining detection capability while ensuring reliability across all browsers regardless of JavaScript settings.
Solution Approach 2:
The patent replaces the mechanical system of client-side JavaScript execution with a server-based HTTP header analysis system. By using the X-Frame-Options header and server-side request analysis, the system substitutes the need for client-side scripting while maintaining or improving detection reliability.
2Ease of operation
If child frames are used to load merchant web pages, then ease of operation is improved for affiliates, but harmful factors increase due to fraudulent practices
Solution Approach 1:
The patent applies preliminary anti-action by implementing the X-Frame-Options header on merchant web pages before any fraudulent activity can occur. This header preemptively blocks child frames from loading external content, preventing cookie stuffing and history stuffing attacks before they can execute, while still allowing legitimate affiliate operations through approved channels.
Solution Approach 2:
The server-based frame detection system acts as an intermediary that monitors and controls frame loading behavior. It allows legitimate affiliate use of child frames while blocking fraudulent attempts, thereby maintaining ease of operation for valid purposes while eliminating harmful factors through intelligent filtering.
3Measurement precision
If cookie tracking is used to monitor referrals, then measurement precision is improved, but loss of information increases due to fraudulent cookie updates
Solution Approach 1:
The patent implements feedback mechanisms where the server-based detection system continuously monitors cookie setting events and frame loading behavior. When fraudulent patterns are detected (such as unexpected cookie updates from child frames), the system provides feedback by blocking further fraudulent activity and adjusting tracking parameters, thereby maintaining measurement precision while preventing information loss from fraud.
Solution Approach 2:
The server-based frame detection system serves as an intermediary between the cookie tracking mechanism and fraudulent attempts. It validates cookie setting events against frame loading context, ensuring that only legitimate referral tracking occurs while blocking fraudulent cookie updates, thus preserving the integrity of referral information.
Data Source
AI summary
Methods and systems for framing detection are disclosed. A web page comprising a child frame is generated. The child frame comprises an instruction to load a component from a merchant. The child frame comprises a header option restricting a loading of the component from within a parent frame associated with a domain external to the merchant. The web page is sent from the merchant to a client browser. It is determined that the web page is loaded within the parent frame in the client browser if a request for the component is not received by the merchant. It is determined that the web page is not loaded within the parent frame in the client browser if a request for the component is received by the merchant.