Client-side attack detection in web applications
AssigneeSap SE
InventorsMartin Johns, Martin Haerterich, Christoph Haefner
Life of this patent
Estimating the term…
Abstract
A client comprising a web browser is provided. The client is configured to: run an application in the web browser, the application comprising a sensor including sensor JavaScript code, wherein running the application comprises executing the sensor JavaScript code as the first JavaScript code in the web browser to activate the sensor; and wherein the sensor is configured to: gather data with respect to the application at runtime; and check predetermined application-specific rules against the gathered data for detecting client-side attacks at runtime.
Claims18
A client system comprising at least one item of computer hardware to implement a web browser, wherein the client system is configured to:
- run an application in the web browser, wherein the application comprising a sensor including executable script code, wherein running the application comprises executing the executable script code as a first executed code in the web browser to activate the sensor;
- and
- wherein the sensor is configured to:
- gather data with respect to the application at runtime;
- and
- check predetermined application-specific rules against the gathered data for detecting client-side attacks at runtime, wherein the application-specific rules are configured to specify particular attack detection patterns for specific features of the application, the application- specific rules being defined by a library of the script code, wherein the predetermined application-specific rules define an expected behavior of the application and an expected behavior of the user of the application.
A computer network comprising:
- at least one client system, the client system comprising at least one item of computer hardware to implement a web browser, wherein the client system is configured to:
- run an application in the web browser, the application comprising a sensor including executable script code, wherein running the application comprises executing the executable script code as first executed code in the web browser to activate the sensor;
- and
- wherein the sensor is configured to:
- gather data with respect to the application at runtime;
- and
- send the gathered data to at least one server at runtime;
- and
- at least one server, wherein the at least one server is configured to analyze the gathered data for detecting client-side attacks at runtime based on predetermined application-specific rules, wherein the application-specific rules are configured to specify particular attack detection patterns for specific features of the application, the application-specific rules being defined by a library of the script code, wherein the predetermined application-specific rules define an expected behavior of the application and an expected behavior of the user of the application.
A computer-implemented method comprising:
- running, by a client, an application in a web browser, the application comprising a sensor including sensor script code, wherein running the application comprises executing the sensor script code as first script code in the web browser to activate the sensor;
- gathering, by the sensor, data with respect to the application at runtime;
- and
- detecting client-side attacks in the web browser by performing, at runtime:
- checking, by the sensor, predetermined application-specific rules against the gathered data, wherein the application-specific rules are configured to specify particular attack detection patterns for specific features of the application, the application-specific rules being defined by a library of the sensor script code, wherein the predetermined application-specific rules define an expected behavior of the application and an expected behavior of the user of the application.
Dependencies are inferred from the claim text.