US 12,755,004 B2 · System and method for unauthorized access mitigation through instantiating a security interface

Abstract

A system to instantiate a security interface for a software application is disclosed. The system receives a request to clone the software application. In response, the system parses the source code of the software application to detect user interface elements and operations. The system instantiates the clone software application that emulates the interface and operations of the software application. The system deploys the clone software application to a computing device and tracks user interactions with the clone software application. The system derives an interaction pattern from the user interactions and compares the derived interaction pattern with previously known interaction pattern. If the derived interaction pattern deviates from the previously known interaction pattern, the system classifies the interaction session as anomalous. In response, the system displays pseudo data on the clone software application instead of expected data. The system invokes a countermeasure protocol to address the anomalous session.

A system comprising:

a memory configured to store a first software application, wherein:
the first software application comprises a first user interface comprising a first web page, wherein the first web page comprises a first set of user interface elements;
and
the first software application is associated with a first source code to render the first user interface and perform a first operation;
a processor, operably coupled to the memory, and configured to:
electronically receive a request to clone the first software application;
in response to receiving the request, parse the first source code, wherein parsing the first source code comprises:
detecting a programming language in which the first source code is written based at least in part upon a syntax rule associated with the programming language;
detecting a set of characters within the first source code, wherein the set of characters comprises a set of words and a set of operators;
detecting a dependency between two or more characters in each portion of the first source code according to the syntax rule, wherein each portion of the first source code comprises one or more lines of code;
and
determining an operation of each portion of the first source code based at least in part upon the detected dependency within each portion of the first source code;
detect the first set of user interface elements and the first operation, wherein detecting the first set of user interface elements and the first operation comprises:
detecting, from among the set of words, a set of tags that are predefined, according to the syntax rule, to be indicative of the first set of user interface elements, wherein each tag from among the set of tags is indicative of a respective user interface element;
and
for at least a first tag, detecting a set of visual attributes associated with a first user interface element, wherein the set of visual attributes comprises at least one of a size, color, or a location associated with the first user interface element;
instantiate a second software application as a clone of the first software application,
wherein instantiating the second software application comprises:
invoking a second user interface that corresponds to the first user interface, wherein the second user interface comprises a second set of user interface elements;
and
configuring each of the second set of user interface elements to operate as a counterpart user interface element from among the first set of user interface elements;
electronically receive a request message to access the first software application that is hosted on a computing device, wherein the request message comprises a credential associated with a first user;
in response to receiving the request message, deploy the second software application to the computing device;
autonomously capture a set of user interactions on the second software application, wherein the captured set of user interactions indicates navigating on the second user interface;
derive an interaction pattern from the captured set of user interactions;
evaluate the derived interaction pattern against a previously known interaction pattern associated with the credential associated with the first user;
detect a deviation between the derived interaction pattern and the previously known interaction pattern;
establish that the deviation between the derived interaction pattern and the previously known interaction pattern is more than a threshold percentage;
and
in response to establishing that the deviation between the derived interaction pattern and the previously known interaction pattern is more than the threshold percentage:
classify a first user interaction session associated with the derived interaction pattern as anomalous;
facilitate an execution of the first operation on the second software application;
display, on the second user interface, pseudo data in response to the captured set of user interactions, wherein the pseudo data reflects an expected format of an output of the first operation on the first software application;
and
automatically invoke a countermeasure protocol through a system-level command code, wherein:
the system-level command code is preconfigured, when executed by the processor, causes the processor to invoke a set of application-level command code to invoke the countermeasure protocol;
the system-level command code comprises software instructions that are interpreted by an operating system (OS) library to invoke system-level operations;
and
the application-level command code comprises software instructions that are interpreted by the second software application to invoke application-specific operations comprising the countermeasure protocol.

36 more elements

System and method for unauthorized access mitigation through instantiating a security interface

Life of this patent

System and method for unauthorized access mitigation through instantiating a security interface

Life of this patent

Abstract

Claims20