Web Code Obfuscation for Anti-Automation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing computer security measures are inadequate in preventing malware from exploiting web content and intercepting user communications, particularly through 'Man in the Browser' attacks, which trick users into providing confidential information by exploiting predictable web code structures.

Innovation Solution

Modifying web code (HTML, CSS, JavaScript) before serving it to clients by changing implicit references and injecting distractor fields randomly, creating a moving target that malicious code cannot predict, and using instrumentation to detect and report abnormal interactions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If web code is served with fixed predictable names and structures, then ease of operation and development is improved, but vulnerability to automated malicious attacks increases

Engineering Contradiction:
Improveease of web code developmentVSAvoidvulnerability to automated attacks
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent applies dynamics by transforming static web code names and structures into dynamic, randomly changing elements. Each time web code is served, names of software objects, fields, and functions are randomized through transformations such as name obfuscation and structure modification. This creates a moving target that prevents automated malicious code from reliably identifying and exploiting specific code elements, while legitimate users experience no difference in functionality.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent changes parameters of web code by applying random transformations to code names, structures, and configurations each time the code is served. Parameters such as object names, field names, and function identifiers are modified using techniques like hashing, encoding, or random string generation. This parameter randomization maintains functional equivalence for legitimate operations while preventing automated attacks that rely on predictable code patterns.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If web code is modified randomly each time it is served, then resistance to malicious attacks is improved, but complexity of code management increases

Engineering Contradiction:
Improveresistance to malicious attacksVSAvoidcomplexity of code management
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary layer between the original web code and the served code. This intermediary system applies automated transformations to randomize code names and structures while maintaining a mapping between original and transformed elements. The intermediary handles the complexity of code management internally, allowing the original code to remain unchanged and manageable while the served code exhibits randomized properties that resist automated attacks.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates transformed copies of the original web code rather than modifying the original directly. Each served instance is a copy with randomized names and structures, but the original code remains intact and manageable. This copying approach allows multiple randomized versions to be generated from a single manageable source, reducing code management complexity while maintaining attack resistance.

Inventive Principle:
Principle #26Copying

3Productivity

If automated bots are used to interact with web content, then productivity and data collection are improved, but susceptibility to credential stuffing and scraping attacks increases

Engineering Contradiction:
Improveefficiency of data interactionVSAvoidsusceptibility to credential stuffing and scraping
Core Design Contradiction:
ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent applies dynamics by continuously changing the names and structures of web code elements that automated bots rely on for data collection and interaction. Each page load or session can present differently named and structured code, preventing bots from using automated scripts to reliably identify credentials, scrape data, or manipulate forms. Legitimate users experience no difference, but automated productivity gains from malicious bots are eliminated.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentUS10205742B2Stateless web content anti-automation
Publication Date: 2019.02.12 SHAPE SECURITY INC
  • US10205742B2 patent drawing
  • US10205742B2 patent drawing
  • US10205742B2 patent drawing

AI summary

A computer-implemented method for coordinating content transformation includes receiving, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet; modifying the computer code to obscure operation of the web server system that could be determined from the computer code; generating transformation information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system; and serving to the computing client the modified code and the reverse transformation information.