# US 2017/0048272 A1 · Fraud detection network system and fraud detection method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0048272 A1 - Document ID: US20170048272A1 - Status: Published application - Kind: A1 - Application number: 15/306,685 - Filed: 2015-02-20 - Published: 2017-02-16 - Earliest claimed: 2014-04-25 - Assignees: Securebrain Corporation; Hitachi Systems, Ltd. - Applicants: Securebrain Corporation; Hitachi Systems, Ltd. - Inventors: Motoaki Yamamura; Masata Nishida; Kazuo Kawamorita - Web page: https://patentgrep.com/patent/US20170048272A1 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation - G06F 21/54: by adding security routines or objects to programs - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2103: Challenge-response - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract [Problem] A fraud detection network system and a fraud detection method are provided which efficiently detect the behavior of malware performing an unauthorized operation, which are easily introduced and which are unlikely to be attacked. [Solution] In a fraud detection network system, a web server device transmits web content information including a call script to a user terminal device, the user terminal device displays the web content and performs the call script. The user terminal device acquires a fraud detection script from a fraud detection server based on the call script, searches detection target data included in the web content information based on the fraud detection script and transmits the result of the search to the fraud detection server device. Then, a predetermined fraud measure operation is performed based on a fraud detection result received from the fraud detection server. ## Claims ### Claim 1 A fraud detection network system in which a web server device transmits a question that is randomly selected from combinations of a plurality of questions previously allocated for each user and correct answers therefor, in which the correct answer is returned from a user terminal device that is connected with a network such that authentication processing is performed, in which a service is thereafter provided and in which a fraud detection sever device connected to the network detects an unauthorized operation in the user terminal device, wherein the web server device includes: a storage means which stores web content information used for the provision of the service and a call script for calling the fraud detection server device; and a content transmission means which transmits, after secure communication with the user terminal device is established, to the user terminal device, the web content information including the call script, the user terminal device includes: a content reception means which receives, after secure communication with the web server device is established, the web content information including the call script; a web browser processing means which displays the web content, which receives an information input from the user and which performs the call script; and a fraud detection server communication means which communicates with the fraud detection server device, based on the call script, a fraud detection script is acquired from the fraud detection server, based on the fraud detection script, detection target data included in the web content information is searched, a result of the search is transmitted to the fraud detection server device and a predetermined fraud measure operation is performed based on a fraud detection result received from the fraud detection server device, and the fraud detection server device includes: a fraud detection script storage means which stores the fraud detection script corresponding to the call script; a user terminal communication means which communicates with the user terminal device; and a fraud detection means which detects, on the result of the search by the fraud detection script, whether or not the unauthorized operation is present. ### Claim 2 (depends on 1) The fraud detection network system according to claim 1, wherein the web content is changed such that the web browser processing means is prevented from receiving an input of information related to authentication from the user based on the fraud detection script. ### Claim 3 (depends on 1) The fraud detection network system according to claim 1, wherein the detection target data is a tag and attribute information on the tag in a markup language. ### Claim 4 (depends on 1) The fraud detection network system according to claim 1, wherein the detection target data is text related to the authentication processing. ### Claim 5 (depends on 1) The fraud detection network system according to claim 1, wherein secure communication is established between the web server device and an authentication means of the user terminal device, first authentication processing is thereafter performed between an authentication means of the web server device and the authentication means of the user terminal device and the web server device transmits, to the user terminal device, the web content script information including the call. ### Claim 6 (depends on 1) The fraud detection network system according to claim 1, wherein in the fraud detection server device, at least any one of the result of the search transmitted from the user terminal device and a result of the detection by the fraud detection means is recorded by a log recording means. ### Claim 7 The fraud detection network system according to clain 1, wherein the web server device includes an obfuscation means which obfuscates the call script, and the content transmission means transmits the web content information including the obfuscated call script. ### Claim 8 A fraud detection network system in which a web server device transmits a question that is randomly selected from combinations of a plurality of questions previously allocated for each user and correct answers therefor, in which the correct answer is returned from a user terminal device that is connected with a network such that authentication processing is performed, in which a service is thereafter provided and in which a fraud detection sever device connected to the network detects an unauthorized operation in the user terminal device, wherein the web server device includes: a storage means which stores web content information used for the provision of the service and a fraud detection script; and a content transmission means which transmits, after secure communication with the user terminal device is established, to the user terminal device, the web content information including the fraud detection script, the user terminal device includes: a content reception means which receives, after secure communication with the web server device is established, the web content information including the call script; a web browser processing means which displays the web content, which receives an information input from the user and which performs the fraud detection script; a fraud detection server communication means which communicates with the fraud detection server device, based on the fraud detection script, detection target data included in the web content information is searched, a result of the search is transmitted to the fraud detection server device and a predetermined fraud measure operation is performed based on a fraud detection result received from the fraud detection server device, and the fraud detection server device includes: a user terminal communication means which communicates with the user terminal device; and a fraud detection means which detects, on the result of the search by the fraud detection script, whether or not the unauthorized operation is present. ### Claim 9 A fraud detection method in a fraud detection network system in which a web server device transmits a question that is randomly selected from combinations of a plurality of questions previously allocated for each user and correct answers therefor, in which the correct answer is returned from a user terminal device that is connected with a network such that authentication processing is performed, in which a service is thereafter provided and in which a fraud detection sever device connected to the network detects an unauthorized operation in the user terminal device, the fraud detection method comprising at least: a content transmission step of, by a content transmission means of the web server device, transmitting, after secure communication with the user terminal device is established, to the user terminal device, web content information used for the provision of the service including a call script for calling the fraud detection server device; a content reception step of, in the user terminal device, by a content reception means, after secure communication with the web server device is established, receiving the web content information including the call script; a fraud detection script acquisition step of, in the user terminal device, by a web browser processing means, acquiring a fraud detection script from the fraud detection server based on the call script; a search result transmission step of, in the user terminal device, searching detection target data included in the web content information based on the fraud detection script and transmitting a result of the search to the fraud detection server device; a fraud detection step of, in the fraud detection server device, by a fraud detection means, detecting on the result of the search whether or not the unauthorized operation is present and transmitting a fraud detection result to the user terminal device; and a fraud measure operation step of, in the fraud detection server device, by the web browser processing means of the user terminal device, performing a predetermined fraud measure operation based on the fraud detection result. ### Claim 10 (depends on 9) The fraud detection method according to claim 9, wherein after the fraud detection script acquisition step, the web content is changed such that the web browser processing means is prevented from receiving an input of information related to authentication from the user based on the fraud detection script. ### Claim 11 (depends on 9) The fraud detection method according to claim 9, wherein the detection target data is a tag and attribute information on the tag in a markup language. ### Claim 12 (depends on 9) The fraud detection method according to claim 9, wherein the detection target data is text related to the authentication processing. ### Claim 13 (depends on 9) The fraud detection method according to claim 9, wherein before the content transmission step, the fraud detection method includes: a secure communication establishment step of establishing secure communication between the web server device and the user terminal device; and a first authentication step of performing first authentication processing between an authentication means of the web server device and an authentication means of the user terminal device. ### Claim 14 (depends on 9) The fraud detection method according to claim 9, wherein after the search result transmission step or the fraud detection step, the fraud detection method includes: a log recording step of, by a log recording means of the fraud detection server device, recording at least any one of the result of the search transmitted from the user terminal device and a result of the detection by the fraud detection means. ### Claim 15 (depends on 9) The fraud detection method according to claim 9, wherein before the content transmission step, the fraud detection method includes: an obfuscation step of, by an obfuscation means of the web server device, obfuscating the call script. ### Claim 16 A fraud detection method in a fraud detection network system in which a web server device transmits a question that is randomly selected from combinations of a plurality of questions previously allocated for each user and correct answers therefor, in which the correct answer is returned from a user terminal device that is connected with a network such that authentication processing is performed, in which a service is thereafter provided and in which a fraud detection sever device connected to the network detects an unauthorized operation in the user terminal device, the fraud detection method comprising at least: a content transmission step of, after secure communication with the user terminal device is established, by a content transmission means of the web server device, transmitting, to the user terminal device, web content information used for the provision of the service including a fraud detection script; a content reception step of, in the user terminal device, after secure communication with the web server device is established, by a content reception means, receiving the web content information including the call script; a search result transmission step of, in the user terminal device, by a web browser processing means, searching detection target data included in the web content information based on the fraud detection script and transmitting a result of the search to the fraud detection server device; a fraud detection step of, in the fraud detection server device, by a fraud detection means, detecting on the result of the search whether or not the unauthorized operation is present and transmitting a fraud detection result to the user terminal device; and a fraud measure operation step of, in the fraud detection server device, by the web browser processing means of the user terminal device, performing a predetermined fraud measure operation based on the fraud detection result.