Back to results
US 12,755,007 B2Granted
Browser in the browser attack protection employing artificial intelligence
AssigneeAT&T Intellectual Property I, L.P.
InventorJoseph Soryal
Life of this patent
Estimating the term…
Abstract
Aspects of the subject disclosure may include, for example, capturing an image of information displayed on a display screen of the device, identifying in the image a pop-up, the pop-up prompting entry of user credentials of a user for an authenticator website, the pop-up generating an authorization request from the device to the authenticator website, identifying in the image a network address for a target website, and communicating with the authenticator website at the network address for verification of the authorization request. Other embodiments are disclosed.
Claims20
A device, comprising:
- a processing system including a processor;
- and
- a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising:
- capturing an image of information displayed on a display screen of the device, wherein the capturing is initiated in response to detecting that data is being transmitted or received via a communications interface of the device over a network, and wherein communications between a web browser of the device and the network are encrypted, preventing applications outside of the web browser from reading a uniform resource locator (URL), network address, or destination identifier for the network;
- identifying in the image a pop-up, the pop-up prompting entry of user credentials of a user for an authenticator website, the pop-up generating an authorization request from the device to the authenticator website;
- identifying from the pop-up, the authorization request from an authenticator website;
- responsive to the identifying the authorization request in the pop-up, applying image recognition to identify the authenticator website displayed in the pop-up, wherein the image recognition includes using an artificial intelligence module to compare features of the image with known pop-ups used in conjunction with an OAuth process or an SSO process and to detect a browser-in-the-browser (BiTB) attack based on characteristics of the pop-up, wherein the applying image recognition comprises analyzing (i) the pop-up and (ii) a displayed address line of the web browser, without analyzing contents of other portions of the image captured from the display screen of the device;
- associating the authenticator website with a database of verified network addresses;
- identifying in the image a network address for a target website;
- and
- communicating with the authenticator website at a verified network address selected from the database for verification of the authorization request, wherein the communicating is via a second communications path and excludes access to content of communications between the web browser and the network.
8 more elements
A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
- from time to time, in a background process of the processing system, capturing a screenshot of an image displayed by a web browser on a display screen of a user device, wherein the capturing is initiated in response to detecting that data is being transmitted or received via a communications interface of the user device over a network, and wherein communications between the web browser and the network are encrypted, preventing applications outside of the web browser from reading a uniform resource locator (URL), network address, or destination identifier for the network;
- in the background process, identifying in the screenshot a pop-up, the pop-up prompting entry of user credentials of a user for an authenticator website, the pop-up generating an authorization request from the user device to the authenticator website;
- in the background process, identifying from the pop-up the authorization request from the authenticator website;
- in the background process, responsive to the identifying the authorization request in the pop-up, applying image recognition to identify the authenticator website displayed in the pop-up, wherein the image recognition includes using an artificial intelligence module to compare features of the image with known pop-ups used in conjunction with an OAuth process or an SSO process and to detect a browser-in-the-browser (BiTB) attack based on characteristics of the pop-up, wherein the applying image recognition comprises analyzing (i) the pop-up and (ii) a displayed address line of the web browser, without analyzing contents of other portions of the image captured from the display screen of the device;
- in the background process, associating the authenticator website with a database of verified network addresses;
- in the background process, analyzing the screenshot of the image to identify a network address for a target website to be accessed by the web browser;
- in the background process, identifying an authenticator website from the database of verified network addresses to be used to provide access credentials for access to the target website by the web browser;
- and
- in the background process, communicating with the authenticator website at a verified network address to verify an authentication request, the authentication request seeking authentication in a foreground process of the processing system to access the target website, wherein the communicating is via a second communications path and excludes access to content of communications between the web browser and the network.
6 more elements
A method, comprising:
- identifying, by a processing system including a processor of a device, an attempt by a web browser operating on the processing system to interact with a website over a network, wherein the attempt to interact with the website over the network is based on a prompt from a pop-up, the pop-up prompting entry of user credentials of a user for the website, the pop-up generating an authorization request from the web browser to the website, and wherein communications between the web browser and the network are encrypted, preventing applications outside of the web browser from reading a uniform resource locator (URL), network address, or destination identifier for the network;
- identifying, by a background process of the processing system, from the pop-up the authorization request from a website;
- responsive to the identifying the authorization request in the pop-up, applying, by the background process of the processing system, image recognition to identify the website identified in the pop-up, wherein the image recognition includes using an artificial intelligence module to compare features of the image with known pop-ups used in conjunction with an OAuth process or an SSO process and to detect a browser-in-the-browser (BiTB) attack based on characteristics of the pop-up, wherein the applying image recognition comprises analyzing (i) the pop-up and (ii) a displayed address line of the web browser, without analyzing contents of other portions of the image captured from a display screen of the device;
- associating, by the background process of the processing system, the website with a database of verified website network addresses;
- communicating with the website at a verified network address selected from the database, by the background process of the processing system, wherein the communicating comprises inquiring if the website has received the attempt by the web browser to interact with the website, wherein the inquiring is based on a network address of the web browser for the website, wherein the communicating is via a second communications path and excludes access to content of communications between the web browser and the network;
- and
- receiving, by the background process of the processing system, an indication from the website confirming that the website has received the attempt by the web browser to interact with the website.
4 more elements
Dependencies are inferred from the claim text.