Web Code Obfuscation for Anti-Automation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security measures are inadequate in preventing malware from exploiting web content and intercepting user communications, particularly through 'Man in the Browser' attacks, which trick users into providing confidential information by exploiting predictable web code structures.
Innovation Solution
Modifying web code (HTML, CSS, JavaScript) before serving it to clients by changing implicit references and injecting distractor fields randomly, creating a moving target that malicious code cannot predict, and using instrumentation to detect and report abnormal interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If web code is served with fixed predictable names and structures, then ease of operation and development is improved, but vulnerability to automated malicious attacks increases
Solution Approach 1:
The patent applies dynamics by transforming static web code names and structures into dynamic, randomly changing elements. Each time web code is served, names of software objects, fields, and functions are randomized through transformations such as name obfuscation and structure modification. This creates a moving target that prevents automated malicious code from reliably identifying and exploiting specific code elements, while legitimate users experience no difference in functionality.
Solution Approach 2:
The patent changes parameters of web code by applying random transformations to code names, structures, and configurations each time the code is served. Parameters such as object names, field names, and function identifiers are modified using techniques like hashing, encoding, or random string generation. This parameter randomization maintains functional equivalence for legitimate operations while preventing automated attacks that rely on predictable code patterns.
2Reliability
If web code is modified randomly each time it is served, then resistance to malicious attacks is improved, but complexity of code management increases
Solution Approach 1:
The patent introduces an intermediary layer between the original web code and the served code. This intermediary system applies automated transformations to randomize code names and structures while maintaining a mapping between original and transformed elements. The intermediary handles the complexity of code management internally, allowing the original code to remain unchanged and manageable while the served code exhibits randomized properties that resist automated attacks.
Solution Approach 2:
The patent creates transformed copies of the original web code rather than modifying the original directly. Each served instance is a copy with randomized names and structures, but the original code remains intact and manageable. This copying approach allows multiple randomized versions to be generated from a single manageable source, reducing code management complexity while maintaining attack resistance.
3Productivity
If automated bots are used to interact with web content, then productivity and data collection are improved, but susceptibility to credential stuffing and scraping attacks increases
Solution Approach 1:
The patent applies dynamics by continuously changing the names and structures of web code elements that automated bots rely on for data collection and interaction. Each page load or session can present differently named and structured code, preventing bots from using automated scripts to reliably identify credentials, scrape data, or manipulate forms. Legitimate users experience no difference, but automated productivity gains from malicious bots are eliminated.
Data Source
AI summary
A computer-implemented method for coordinating content transformation includes receiving, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet; modifying the computer code to obscure operation of the web server system that could be determined from the computer code; generating transformation information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system; and serving to the computing client the modified code and the reverse transformation information.


