Web Application Profiling via JavaScript Extraction and Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications delivered via the internet often lack vetting processes, posing privacy and security risks due to potential malware, spyware, and phishing threats, as they can access user devices without authorization and lack security checks.
Innovation Solution
A method and system for profiling web applications by crawling and analyzing JAVASCRIPT, simulating user interactions, and tracking access requests to identify security vulnerabilities and unauthorized API usage, using mock objects and symbolic execution to assess potential risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web applications are delivered without a vetting process, then ease of delivery and accessibility is improved, but security risks and privacy concerns worsen
Solution Approach 1:
The system performs preliminary analysis of web applications by extracting and analyzing JavaScript code before the application is fully executed by users. This proactive approach identifies potential security threats and privacy concerns in advance, allowing the system to warn users or block malicious applications before they can cause harm.
Solution Approach 2:
The patent introduces an intermediary analysis system that sits between the web application delivery mechanism and the user's device. This intermediary automatically analyzes JavaScript code, extracts API calls, and evaluates security risks without preventing the free delivery of web applications. It mediates between ease of delivery and security by providing transparent security assessments.
2Reliability
If JavaScript code is analyzed to detect security threats, then security detection capability is improved, but analysis time and computational resources worsen
Solution Approach 1:
The system extracts only the JavaScript code portion from web applications for analysis, separating it from other components like HTML and CSS. This extraction focuses computational resources on the most security-relevant part of the application, reducing overall analysis time while maintaining detection capability.
Solution Approach 2:
The patent employs partial analysis by focusing on specific JavaScript patterns, API calls, and code structures that are most indicative of security threats. Rather than analyzing every single line of code in depth, the system identifies and flags suspicious patterns, achieving effective security detection with reduced computational overhead and faster processing.
3Measurement precision
If automated simulation of JavaScript is executed, then accuracy of security profiling is improved, but processing complexity and computational load worsen
Solution Approach 1:
The system creates simplified copies or models of JavaScript execution behavior rather than running the full application in a complex simulation environment. By analyzing static code patterns, API call structures, and data flow relationships, the system achieves accurate security profiling without the computational burden of complete automated simulation.
Solution Approach 2:
The patent segments the JavaScript analysis into distinct components: syntax analysis, API call extraction, data flow tracking, and threat pattern matching. This segmentation allows each component to be processed independently with appropriate optimization, reducing overall processing complexity while maintaining comprehensive security profiling accuracy.
Data Source
AI summary
A computer-implemented method for profiling a web application. A web page containing JavaScript (JS) is crawled. At least a portion of the JS is extracted from the crawled web page. An automated simulation of the extracted JS is executed.