Client-Side Snapshot Proxy for Low-Latency Phishing Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing proxy servers interfere with client-side JavaScript code in web browser applications, creating network bottlenecks and high resource utilization, and are unable to timely detect and mitigate phishing attacks due to resource-intensive parsing and hooking operations.

Innovation Solution

Employing a client-side proxy component to capture snapshots or screen recordings of user interactions, analyze enriched-contextual event data, and perform threat assessments to generate security mitigation scores or logs, while leveraging proxy server functionality for caching and content filtering.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing proxy servers parse and hook client-side JavaScript code to detect phishing attacks, then threat detection capability is improved, but system resource utilization increases and latency increases

Engineering Contradiction:

Improvephishing detection capabilityVSAvoidsystem resource utilization

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent extracts only the essential visual snapshot data from the web browser application without requiring full JavaScript parsing or code hooking. By capturing screenshots and analyzing visual elements directly, the system achieves phishing detection while avoiding the resource-intensive code analysis processes that burden traditional proxy servers.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces the mechanical process of parsing and hooking JavaScript code with a visual analysis approach using screenshots and image processing. This substitution eliminates the need for complex code interpretation while maintaining detection effectiveness, thereby reducing CPU and memory resource utilization.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If existing proxy servers perform comprehensive JavaScript parsing and hooking operations, then security policy enforcement is improved, but detection latency increases

Engineering Contradiction:

Improvesecurity policy enforcementVSAvoiddetection latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary snapshot capture and visual analysis before full security policy enforcement is required. By pre-processing and analyzing the visual state of the browser, the system prepares detection data in advance, enabling faster real-time decision-making without waiting for complete JavaScript execution and parsing.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent substitutes the time-consuming JavaScript parsing and hooking mechanism with direct visual screenshot analysis. This approach eliminates the sequential dependency on script execution completion, allowing parallel processing of security checks and significantly reducing detection latency.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If proxy servers capture and analyze all user engagement data, then threat detection accuracy is improved, but network bandwidth consumption increases

Engineering Contradiction:

Improvethreat detection accuracyVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The patent extracts only the critical visual snapshot data and essential engagement metrics from user interactions, rather than transmitting complete data sets. By selecting and sending only the most relevant information (screenshots, key event data, contextual metadata), the system maintains high detection accuracy while minimizing network bandwidth consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent implements partial data capture by focusing on specific visual elements and engagement events that are most indicative of phishing attempts. Rather than analyzing all possible data points, the system targets key indicators such as URL visibility, form field presence, and suspicious UI elements, achieving effective detection with reduced data transmission.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12513190B2Snapshot for activity detection and threat analysis

Publication Date: 2025.12.30 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input using a client-side proxy component and a proxy server. Embodiments disclosed herein provide systems, methods, and computer-storage media for employing proxy server capabilities in conjunction with a snapshot capturing an image or video recording of a target action input by a user into a software application. Certain embodiments disclosed herein employ proxy server capabilities to capture a snapshot and/or screen recording based on a user authorization or approval. For example, the proxy server proactively captures the snapshot or screen recording prior to, during, and after the user performing a target action. From the snapshot, certain embodiments extract snapshot features or determine enriched-contextual event data that is used to perform a mitigation action, generate a security mitigation score, or update an administrator portal activity log for an authorized administrator.