Browser Webinject Detection via HTML Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting webinjects in web browsers are limited, particularly in remote detection without installed software, and often require specific configurations like P2P networks or sinkholes, which may not cover all software installations effectively.
Innovation Solution
A system and method involving a detection webpage with embedded detection code that inspects HTML components for webinjects, generates fingerprints, and transmits them to an external server for classification, allowing for remote detection and identification of webinjects across various software types, including those injected through browser extensions or advertising networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If remote detection is performed without installed software, then ease of operation is improved, but measurement precision deteriorates
Solution Approach 1:
The patent introduces a browser extension as an intermediary component that bridges the gap between remote detection requirements and accurate webinject detection. The extension acts as a mediator between the detection system and the browser environment, enabling precise detection of webinjects through programmatic access to browser internals without requiring full installation of detection software on the target system.
Solution Approach 2:
The detection system employs a nested structure where a lightweight detection module is embedded within the browser extension, which itself is nested within the browser environment. This nested doll approach allows the system to operate at multiple levels: the outer browser extension provides the deployment interface, while the inner detection module performs the actual precise detection of webinjects through access to browser DOM and script injection points.
2Measurement precision
If detection code inspects all HTML components, then measurement precision is improved, but use of energy deteriorates
Solution Approach 1:
The detection system applies local quality by focusing inspection efforts on specific high-risk HTML components and script injection points rather than uniformly inspecting all HTML elements. The browser extension identifies and targets only those DOM elements and script tags that are likely to contain webinject code, such as dynamically injected scripts, event handlers, and components from untrusted sources, thereby reducing overall inspection overhead while maintaining high detection accuracy.
Solution Approach 2:
The system employs partial action by implementing selective inspection of HTML components based on risk assessment. Rather than inspecting every HTML element, the detection code focuses on partial sets of components that are most susceptible to webinject injection, such as script tags, iframe elements, and dynamically loaded content, achieving effective detection with reduced computational energy consumption.
3Measurement precision
If fingerprints are transmitted for every detection, then measurement precision is improved, but loss of information deteriorates
Solution Approach 1:
The system applies partial action by transmitting fingerprints selectively rather than for every detection event. The browser extension analyzes detected webinjects and transmits fingerprints only for novel or high-confidence detections, filtering out duplicate or obviously benign cases. This approach maintains classification accuracy by ensuring relevant data is transmitted while reducing data transmission overhead through intelligent sampling and filtering of fingerprint submissions.
Data Source
AI summary
Computer-implemented methods and systems are provided for the detection of software presence remotely through the web browser by detecting the presence of webinjects in a web browser that visits a detection webpage. The methods can include delivering a detection webpage to a web browser, in which the detection webpage has detection code configured to detect a presence of the webinject in the detection webpage; and inspecting, by the detection code, rendering of content of the detection webpage in the browser to detect webinject content in the detection webpage by the webinject, the webinject content including one or more Hypertext Markup Language (HTML) components. The method can further include, if webinject content is detected, generating a fingerprint for each of the one or more HTML components; transmitting the one or more fingerprints to an external server; and classifying, by the external server, the webinject based on the one or more fingerprints.