Web Page Code Instrumentation for Malicious Activity Detection

The patent applies preliminary action by pre-modifying web page code with instrumentation code before it is executed by the client browser. The code is instrumented in advance to include detection capabilities for anomalous actions, allowing the system to automatically monitor and report malicious activities without requiring complex real-time analysis infrastructure. This pre-prepared instrumentation reduces the computational burden during runtime while maintaining high detection precision.

The patent applies dynamics by making the web page code dynamic and variable each time it is served to a client. Random modifications are introduced into the code structure, variable names, or control flow to create a moving target that prevents malicious actors from reliably analyzing or exploiting the code. Despite these dynamic changes, the core functionality and detection capabilities remain consistent through the use of instrumentation code that adapts to the modified structure.

The patent applies the taking out principle by extracting the heavy computational workload of analyzing and detecting alien content from the client device and relocating it to a centralized server. The instrumentation code on the client device only performs lightweight tasks such as collecting data about anomalous actions and transmitting this information to the server. The server then performs the energy-intensive analysis to identify malicious activities, significantly reducing the energy consumption and computational burden on client devices while maintaining high detection accuracy.