Web Form Tampering Detection via Telemetry Field Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting malware that injects malicious fields into legitimate web forms often fail to identify new or morphed threats, relying on signature-based scanning and heuristic analysis that are ineffective against novel or modified malware.
Innovation Solution
A tampered web form detection system that collects telemetry data from client computers to identify expected fields on web pages, adjudicating suspicious pages by comparing actual fields to expected ones, and taking corrective actions such as warning users or blocking data entry into fraudulent fields, based on user hygiene ratings and field correlations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based scanning is used to detect malware, then previously identified threats can be detected, but new or morphed malware cannot be identified
Solution Approach 1:
The system dynamically adapts its detection approach by transitioning from static signature-based scanning to dynamic behavior analysis. The malware analysis unit executes malware in a controlled environment and observes its actual runtime behavior, allowing the system to detect both known and new threats based on their actions rather than fixed signatures.
Solution Approach 2:
The system performs preliminary analysis by collecting telemetry data and establishing baseline behavior patterns of legitimate software before malware execution. This preliminary understanding of normal behavior enables more accurate detection of anomalous malware activities when they occur.
2Reliability
If heuristic analysis is used to detect malware, then malware confirming with known patterns can be detected, but new or modified threats outside these patterns cannot be identified
Solution Approach 1:
The system implements feedback loops where malware execution results and telemetry data are continuously analyzed to refine detection heuristics. The behavior analysis unit learns from observed malware patterns and adjusts detection rules, enabling the system to adapt to new threats while maintaining detection of known patterns.
Solution Approach 2:
The system performs self-updating of detection capabilities by automatically analyzing malware behavior and generating new detection rules without requiring manual intervention. The telemetry analysis and behavior observation processes enable the system to self-improve its detection accuracy for both known and emerging threats.
3Reliability
If conventional malware detection techniques are used, then some malware can be detected and removed, but injection of malicious fields into legitimate forms remains undetected
Solution Approach 1:
The system introduces a telemetry analysis intermediary that sits between malware execution and detection. This intermediary captures and analyzes telemetry data, field correlations, and behavior patterns to identify malicious field injections that conventional techniques miss, while legitimate forms are identified through their characteristic field structures and behaviors.
Data Source
AI summary
Telemetry data concerning web pages that users attempt to access containing fields prompting entry of personal information is received from many client computers over time. Based on the telemetry data, it is determined which fields prompting entry of personal information are expected to be present on specific web pages. The fields prompting entry of personal information on web pages users attempt to access are compared to the fields expected to be present. When a specific user attempts to access a specific web page in real-time, it can be adjudicated on-the-fly that the web page is suspicious, based on the web page containing at least one unexpected field. Correlations between web pages containing specific unexpected fields and the hygiene ratings of the users attempting to access the web pages when the unexpected fields are encountered can be tracked and taken into account in the adjudication of web pages.