Pre-filtering Web Form Domain Analysis for Formjacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Formjacking attacks, where malicious scripts are injected into webpages to steal sensitive user information, are becoming prevalent, with existing solutions requiring significant processing power and time to detect and mitigate, often resulting in high false positives and inefficiencies.
Innovation Solution
A computer-implemented method that pre-filters detection of injected scripts by comparing current and historical network domains associated with web form requests, identifying suspicious activity, and initiating security actions such as blacklisting or isolating the webpage, using a browser extension, kernel module, or remote web proxy to reduce the number of domains analyzed and enhance detection speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive analysis of all network domains is performed to detect formjacking attacks, then detection accuracy is improved, but processing time and computational resources increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-filtering network domains before comprehensive analysis. It identifies and prioritizes domains associated with web forms, which are the primary vectors for formjacking attacks. This pre-filtering step reduces the volume of domains requiring full analysis, enabling faster detection while maintaining high accuracy for the most relevant targets.
Solution Approach 2:
The patent segments the domain analysis process into multiple stages: initial filtering based on web form associations, priority ranking of domains, and then comprehensive analysis only on high-priority domains. This segmentation allows the system to process domains in order of relevance, achieving fast detection of critical threats while reducing overall computational burden.
2Reliability
If comprehensive analysis of all network domains is performed to detect formjacking attacks, then detection accuracy is improved, but computational resources and processing power increase significantly
Solution Approach 1:
The patent performs preliminary filtering to identify only those domains associated with web forms before conducting resource-intensive analysis. This pre-screening eliminates domains that are unlikely to contain formjacking scripts, significantly reducing the computational resources required for detection while maintaining high accuracy for relevant domains.
Solution Approach 2:
The patent applies partial action by performing comprehensive analysis only on a subset of domains that are most likely to contain formjacking attacks (those associated with web forms). Rather than analyzing all domains equally, it focuses computational resources on the critical subset, achieving effective detection with reduced resource consumption.
3Reliability
If all network domains are analyzed without pre-filtering, then thorough detection is achieved, but false positives increase and efficiency decreases
Solution Approach 1:
The patent applies preliminary filtering based on web form associations to prioritize domains that are actual targets of formjacking attacks. This pre-filtering reduces false positives by eliminating domains unrelated to web forms from comprehensive analysis, while maintaining thorough detection of genuine threats through focused examination of high-priority domains.
Data Source
AI summary
Pre-filtering detection of an injected script on a webpage accessed by a computing device. The method may include receiving an indication of access to the webpage at a web browser of the computing device; identifying a web form associated with the webpage; determining that the webpage has been previously visited by the computing device; recording at least one current domain associated with at least one current object request made by the web form; determining a difference of a count of the at least one current domain associated with the at least one current object request and a count of at least one historical domain associated with at least one historical object request previously made by the webpage; identifying the webpage as suspicious based on determining that the difference is greater than zero and less than a domain threshold; and initiating a security action on the webpage based on the identifying.