Back to results
US 11,770,385 B2Granted
Systems and methods for malicious client detection through property analysis
AssigneePaypal, Inc.
InventorBlake Morgan Butler
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting malicious clients through inspecting application properties are described. These may include requesting application properties from a client application, receiving a digital fingerprint from the client device, determining whether the digital fingerprint indicates that the client application is likely a malicious client, and taking a mitigation action based on determining that the client application is likely a malicious client.
Claims20
A system comprising:
- a non-transitory memory;
- and
- one or more hardware processors coupled with the non-transitory memory and configured to execute instructions from the non-transitory memory to cause the system to perform operations comprising:
- requesting a plurality of application properties from a client application operable to view web pages on a client device over a network, the plurality of application properties comprising a window name, a window location, a window size, a view port size, or a pixel depth;
- receiving a digital fingerprint from the client device based on an order that the plurality of application properties is returned by the client application;
- determining, at least in part by comparing a first order associated with the digital fingerprint to a second order associated with one or more stored digital fingerprints, whether the digital fingerprint indicates that the plurality of application properties do not appear in an expected order wherein the determining further comprises determining whether a predetermined one of the application properties appears at an end of a list of the plurality of application properties returned by the client application;
- and
- taking a mitigation action based on a determination that the plurality of application properties do not appear in the expected order.
5 more elements
A method comprising:
- requesting a plurality of application properties from a client application operable to view web pages on a client device over a network, the plurality of application properties comprising window properties or screen properties, the windows properties or screen properties comprising a window name, a window location, a window size, or a view port size;
- receiving the plurality of application properties from the client application;
- generating a digital fingerprint based on an order that the plurality of application properties is returned by the client application;
- determining whether the digital fingerprint matches a stored digital fingerprint based on an expected order that the plurality of application properties should be returned by the client application, including determining whether a specified one of the application properties appears at a predefined location of a list of the plurality of application properties returned by the client application;
- and
- taking a mitigation action based on determining that the digital fingerprint does not match the stored digital fingerprint.
3 more elements
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- requesting a plurality of application properties from a client application operable to view web pages on a client device over a network, the plurality of application properties comprising a window name, a window location, a window size, or a view port size;
- receiving a client application type based on one or more application properties of the plurality of application properties;
- receiving a digital fingerprint from the client device based on an order that the plurality of application properties is returned by the client application;
- determining an expected order of application properties of the plurality of application properties based on the client application type;
- comparing a first order associated with the digital fingerprint to a second order associated with one or more stored digital fingerprints;
- determining, based at least in part on the comparing, that the digital fingerprint indicates that a predetermined one of the application properties appears at a specified portion of a list of the plurality of application properties returned by the client application;
- and
- taking a mitigation action based on determining that the predetermined one of the application properties appears at the specified portion of the list of the plurality of application properties returned by the client application.
5 more elements
Dependencies are inferred from the claim text.