# US 12,015,627 B2 · Webpage integrity monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,627 B2 - Document ID: US12015627B2 - Status: Granted - Kind: B2 - Application number: 18/355,634 - Filed: 2023-07-20 - Published: 2024-01-18 - Granted: 2024-06-18 - Earliest claimed: 2019-05-13 - Assignees: SecurityMetrics, Inc. - Applicants: SecurityMetrics, Inc. - Inventors: Aaron Willis - Web page: https://patentgrep.com/patent/US12015627B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/321: {involving a third party or a trusted authority} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method to monitor integrity of webpages. The method may include obtaining a destination of outgoing network traffic resulting from rendered code of a webpage. The rendered code may be generated using source code of the webpage that is obtained in response to a request to a webserver that hosts the webpage. The method may also include obtaining a previous destination of previous outgoing network traffic resulting from previous rendered code of the webpage. The previous rendered code may be generated before the request is sent to the webserver for the source code used to generate the rendered code. The method may also include comparing the destination and the previous destination to determine a change in integrity of security of the webpage. In response to the change in the integrity of security of the webpage, an alert regarding the integrity of security of the webpage may be generated. ## Claims ### Claim 1 A method to monitor integrity of webpages, the method comprising: obtaining, at a computing system, a final network destination of outgoing network traffic resulting from rendered code of a webpage, the rendered code generated using source code of the webpage that is obtained in response to a request to a webserver that hosts the webpage and using remotely called code referenced in the source code, wherein the rendered code is finalized instructions to layout presentation of the webpage, the rendered code includes elements not represented in the remotely called code and the source code without parsing and/or executing the remotely called code and the source code, and a portion of the rendered code that causes the outgoing network traffic to the final network destination results from the remotely called code; obtaining, at the computing system, one or more network destinations previously obtained; comparing, at the computing system, the final network destination and the one or more network destinations to determine a change in integrity of security of the webpage; and in response to the change in the integrity of security of the webpage, generating an alert regarding the integrity of security of the webpage. ### Claim 2 (depends on 1) The method of claim 1, wherein obtaining the final network destination of the outgoing network traffic further comprises: capturing the outgoing network traffic resulting from the rendered code of the webpage; and parsing the outgoing network traffic to determine the final network destination. ### Claim 3 (depends on 2) The method of claim 2, wherein the outgoing network traffic is captured by a proxy computing system separate from the computing system. ### Claim 4 (depends on 1) The method of claim 1, wherein obtaining the one or more network destinations comprises: capturing previous outgoing network traffic resulting from previous rendered code of the webpage, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code; and parsing the previous outgoing network traffic to determine the one or more network destinations. ### Claim 5 (depends on 1) The method of claim 1, wherein obtaining the one or more network destinations comprises analyzing previous rendered code of the webpage to determine the one or more network destinations, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code. ### Claim 6 (depends on 1) The method of claim 1, wherein a device separate from the computing system generates the rendered code. ### Claim 7 (depends on 1) The method of claim 1, wherein the final network destination includes a plurality of final network destinations and the one or more network destinations includes a plurality of network destinations and the plurality of final network destinations are different from the plurality of network destinations based on the plurality of final network destinations including more final network destinations than the plurality of network destinations. ### Claim 8 (depends on 1) The method of claim 1, wherein the change in the integrity of the webpage is determined based on the portion of the rendered code that causes the outgoing network traffic to the final network destination resulting from the remotely called code. ### Claim 9 A system comprising: at least one non-transitory computer-readable media configured to store one or more instructions; and at least one processor coupled to the at least one non-transitory computer-readable media, the at least one processor configured to execute the instructions to cause or direct the system to perform operations, the operations comprising: obtain, at a computing system, a final network destination of outgoing network traffic resulting from rendered code of a webpage, the rendered code generated using source code of the webpage that is obtained in response to a request to a webserver that hosts the webpage and using remotely called code referenced in the source code, wherein the rendered code is finalized instructions to layout presentation of the webpage, the rendered code includes elements not represented in the remotely called code and the source code without parsing and/or executing the remotely called code and the source code, and a portion of the rendered code that causes the outgoing network traffic to the final network destination results from the remotely called code; obtain, at the computing system, one or more network destinations previously obtained; compare, at the computing system, the final network destination and the one or more network destinations to determine a change in integrity of security of the webpage; and in response to the change in the integrity of security of the webpage, generate an alert regarding the integrity of security of the webpage. ### Claim 10 (depends on 9) The system of claim 9, wherein obtaining the final network destination of the outgoing network traffic further includes operations including: capture the outgoing network traffic resulting from the rendered code of the webpage; and parse the outgoing network traffic to determine the final network destination. ### Claim 11 (depends on 10) The system of claim 10, wherein the outgoing network traffic is captured by a proxy computing system separate from the system. ### Claim 12 (depends on 9) The system of claim 9, wherein obtaining the one or more network destinations further includes operations including: capture previous outgoing network traffic resulting from previous rendered code of the webpage, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code; and parse the previous outgoing network traffic to determine the one or more network destinations. ### Claim 13 (depends on 9) The system of claim 9, wherein obtaining the one or more network destinations further includes operations including: analyze previous rendered code of the webpage to determine the one or more network destinations, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code. ### Claim 14 (depends on 9) The system of claim 9, wherein a device separate from the system generates the rendered code. ### Claim 15 (depends on 9) The system of claim 9, wherein the final network destination includes a plurality of final network destinations and the one or more network destinations includes a plurality of network destinations and the plurality of final network destinations are different from the plurality of network destinations based on the plurality of final network destinations including more final network destinations than the plurality of network destinations. ### Claim 16 (depends on 9) The system of claim 9, wherein the change in the integrity of the webpage is determined based on the portion of the rendered code that causes the outgoing network traffic to the final network destination resulting from the remotely called code. ### Claim 17 One or more non-transitory computer-readable media configured to store one or more instructions that when executed cause or direct a system to perform operations, the operations comprising: obtain, at a computing system, a final network destination of outgoing network traffic resulting from rendered code of a webpage, the rendered code generated using source code of the webpage that is obtained in response to a request to a webserver that hosts the webpage and using remotely called code referenced in the source code, wherein the rendered code is finalized instructions to layout presentation of the webpage, the rendered code includes elements not represented in the remotely called code and the source code without parsing and/or executing the remotely called code and the source code, and a portion of the rendered code that causes the outgoing network traffic to the final network destination results from the remotely called code; obtain, at the computing system, one or more network destinations previously obtained; compare, at the computing system, the final network destination and the one or more network destinations to determine a change in integrity of security of the webpage; and in response to the change in the integrity of security of the webpage, generate an alert regarding the integrity of security of the webpage. ### Claim 18 (depends on 17) The one or more non-transitory computer-readable media of claim 17, wherein obtaining the one or more network destinations further includes operations including: capture previous outgoing network traffic resulting from previous rendered code of the webpage, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code; and parse the previous outgoing network traffic to determine the one or more network destinations. ### Claim 19 (depends on 17) The one or more non-transitory computer-readable media of claim 17, wherein obtaining the one or more network destinations further includes operations including: analyze previous rendered code of the webpage to determine the one or more network destinations, the previous rendered code generated before the request is sent to the webserver for the source code used to generate the rendered code. ### Claim 20 (depends on 17) The one or more non-transitory computer-readable media of claim 17, wherein the final network destination includes a plurality of final network destinations and the one or more network destinations includes a plurality of network destinations and the plurality of final network destinations are different from the plurality of network destinations based on the plurality of final network destinations including more final network destinations than the plurality of network destinations.