# US 12,603,918 B2 · Security system for detecting malicious actor's observation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,918 B2 - Document ID: US12603918B2 - Status: Granted - Kind: B2 - Application number: 18/477,658 - Filed: 2023-09-29 - Published: 2024-01-18 - Granted: 2026-04-14 - Earliest claimed: 2020-06-08 - Assignees: Target Brands, Inc. - Applicants: Target Brands, Inc. - Inventors: Paul Melson; Chris Carlson; Eric Brandel; Caleb Walch - Web page: https://patentgrep.com/patent/US12603918B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A website vulnerability test is performed by automatically checking that a website has not been compromised by malicious third party scripts. A system can test a dynamic behavior of a website that indicates a functional user flow through the website. A set of rules are applied against a log of dynamic behavior of the website, as well as static code of the website, to identify potential compromise by malicious scripts. Some rules can be configured for detecting modification of a third party script, or modified behavior of a third party script, in an attempt to detect security monitoring activity against the script and hide its presence from the security monitoring activity. ## Claims ### Claim 1 A method for testing a website vulnerability, the method comprising: retrieving website code of a website, the website code including a script; debugging the website code; searching for an indicator of malicious action during the debugging, wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are modified in a console log; determining presence of a potential malicious script based on the indicator; and returning an alert of the presence of the potential malicious script in the website. ### Claim 2 (depends on 1) The method of claim 1, wherein retrieving the website code includes retrieving the website code on a browser, the method further comprising: running a code evaluation tool on the browser. ### Claim 3 (depends on 1) The method of claim 1, wherein the indicator is indicative of binding events to timing events. ### Claim 4 (depends on 1) The method of claim 1, wherein the indicator is indicative of accessing event calls for timing-related functions. ### Claim 5 (depends on 1) The method of claim 1, wherein the indicator is indicative of binding events to start and stop timings of an operation. ### Claim 6 (depends on 1) The method of claim 1, wherein based on retrieving the website code of the website, the method further comprises: simulating a functional user flow on the website; recording dynamic behavior of the website during simulation of the functional user flow; retrieving malicious actor detection rules; applying the retrieved rules to the recorded dynamic behavior of the website; and detecting, based on applying the retrieved rules, the presence of the potential malicious script in the website. ### Claim 7 (depends on 6) The method of claim 6, wherein simulating the functional user flow on the website comprises: applying a website test wrapper to the website code including the script; and automatically executing, based on applying the wrapper to the website code including the script, an automation script that provides simulated user inputs to interact with the website. ### Claim 8 (depends on 7) The method of claim 7, further comprising: generating, by the wrapper, a dynamic website log that records behavior of the website in response to the simulated user inputs provided by the automation script. ### Claim 9 (depends on 1) The method of claim 1, wherein searching for the indicator of malicious action during the debugging comprises detecting that a browser for the website is operating slower than an expected speed. ### Claim 10 (depends on 1) The method of claim 1, wherein searching for the indicator of malicious action during the debugging comprises detecting an unexpected crash of a browser for the website. ### Claim 11 (depends on 1) The method of claim 1, further comprising: aggregating the indicator with a plurality of indicators; and transmitting the aggregated indicators to a computing device of a security analyst. ### Claim 12 A client computing device for testing a website vulnerability, comprising: a data processing apparatus; and a memory device storing instructions that when executed by the data processing apparatus cause the client computing device to perform operations comprising: retrieving website code of a website on a browser, the website code including a script; running a code evaluation tool on the browser; debugging the website code; searching for an indicator of malicious action during the debugging; determining presence of a potential malicious script based on the indicator; and returning an alert of the presence of the potential malicious script in the website. ### Claim 13 (depends on 12) The client computing device of claim 12, wherein the indicator is indicative of at least one of: binding events to timing events; accessing event calls for timing-related functions; or binding events to start and stop timings of an operation. ### Claim 14 (depends on 12) The client computing device of claim 12, wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are removed from a console log. ### Claim 15 (depends on 12) The client computing device of claim 12, wherein based on retrieving the website code of the website, the operations further comprising: simulating a functional user flow on the website; recording dynamic behavior of the website during simulation of the functional user flow; retrieving malicious actor detection rules; applying the retrieved rules to the recorded dynamic behavior of the website; and detecting, based on applying the retrieved rules, the presence of the potential malicious script in the website. ### Claim 16 (depends on 15) The client computing device of claim 15, wherein simulating the functional user flow on the website comprises: applying a website test wrapper to the website code including the script; and automatically executing, based on applying the wrapper to the website code including the script, an automation script that provides simulated user inputs to interact with the website. ### Claim 17 (depends on 16) The client computing device of claim 16, the operations further comprising: generating, by the wrapper, a dynamic website log that records behavior of the website in response to the simulated user inputs provided by the automation script. ### Claim 18 A method for testing a website vulnerability, the method comprising: retrieving website code of a website, the website code including a script; debugging the website code; searching for an indicator of malicious action during the debugging, wherein searching for the indicator of malicious action during the debugging comprises identifying that one or more messages are removed in a console log; determining presence of a potential malicious script based on the indicator; and returning an alert of the presence of the potential malicious script in the website. ### Claim 19 (depends on 18) The method of claim 18, wherein the indicator is indicative of at least one of: binding events to timing events; accessing event calls for timing-related functions; or binding events to start and stop timings of an operation. ### Claim 20 (depends on 18) The method of claim 18, wherein retrieving the website code includes retrieving the website code on a browser, the method further comprising: running a code evaluation tool on the browser.