# US 2021/0240856 A1 · Methods, systems, and media for detecting alteration of a web page

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240856 A1
- Document ID: US20210240856A1
- Status: Published application
- Kind: A1
- Application number: 17/238,109
- Filed: 2021-04-22
- Published: 2021-08-05
- Earliest claimed: 2018-12-14
- Assignees: Wayne TAYLOR; Synergex Group; Pham Holdings
- Applicants: Synergex Group; Pham Holdings Inc.
- Inventors: Thien Van Pham
- Web page: https://patentgrep.com/patent/US20210240856A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- G06F 16/2358: {Change logging, detection, and notification (replication G06F16/27)}
- G06F 16/955: using information identifiers, e.g. uniform resource locators [URL]
- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- G06F 2221/2119: Authenticating web pages, e.g. with suspicious links
- G06F 2221/2149: Restricted operating environment
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods, systems, and media for detecting alteration of a web page are provided. In some embodiments, a method for detecting alteration of a web page is provided, the method comprising: analyzing a web page; generating a forensic footprint associated with the web page based on the analyzing; determining whether the forensic footprint matches reference information associated with the web page; and in response to determining that the forensic footprint does not match the reference information, blocking at least a portion of the web page from being presented.

## Claims

### Claim 1

A method for detecting alteration of a web page, comprising:
requesting, using a hardware processor of a user device, a web page;
receiving, using the hardware processor of the user device, the web page;
generating, using the hardware processor of the user device, a forensic footprint associated with the web page;
requesting a reference footprint using an identifier corresponding to the web page from a server;
receiving the reference footprint from the server;
determining, using the hardware processor of the user device, whether the forensic footprint matches the reference footprint associated with the web page; and
in response to determining that the forensic footprint does not match the reference footprint, blocking, using the hardware processor of the user device, at least a portion of the web page.

### Claim 2 (depends on 1)

The method of claim 1, wherein the forensic footprint comprises at least one of a size of the web page, a number of scripted files included in the web page, a number of user input fields included in the web page, a number of selectable icons included in the web page, a number of images included in the web page, and information indicating content of the web page.

### Claim 3 (depends on 1)

The method of claim 1, wherein the reference footprint is generated prior to the receiving.

### Claim 4 (depends on 1)

The method of claim 1, further comprising at least one of redirecting a browser to another web page and presenting a notification to a user.

### Claim 5 (depends on 1)

The method of claim 1, further comprising, in response to determining that the forensic footprint matches the reference footprint, iteratively performing the generating and the determining after a predetermined amount of time.

### Claim 6

A system for detecting alteration of a web page, comprising:
a hardware processor of a user device configured to:
request a web page;
receive the web page;
generate a forensic footprint associated with the web page;
request a reference footprint using an identifier corresponding to the web page from a server;
receive the reference footprint from the server;
determine whether the forensic footprint matches reference footprint associated with the web page; and
in response to determining that the forensic footprint does not match the reference footprint, blocking at least a portion of the web page.

### Claim 7 (depends on 6)

The system of claim 6, wherein the forensic footprint comprises at least one of a size of the web page, a number of scripted files included in the web page, a number of user input fields included in the web page, a number of selectable icons included in the web page, a number of images included in the web page, and information indicating content of the web page.

### Claim 8 (depends on 6)

The system of claim 6, wherein the reference footprint is generated prior to the receiving.

### Claim 9 (depends on 6)

The system of claim 6, wherein the hardware processor is further configured to perform at least one of redirecting a browser to another web page and presenting a notification to a user.

### Claim 10 (depends on 6)

The system of claim 6, wherein the hardware processor is further configured to, in response to determining that the forensic footprint matches the reference footprint, iteratively perform the generating and the determining after a predetermined amount of time.

### Claim 11

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor of a user device, cause the processor to perform a method for detecting alteration of a web page, the method comprising:
requesting a web page;
receiving, at the user device, the web page;
generating a forensic footprint associated with the web page;
requesting a reference footprint using an identifier corresponding to the web page from a server;
receiving the reference footprint from the server;
determining at the user device whether the forensic footprint matches reference footprint associated with the web page; and
in response to determining at the user device that the forensic footprint does not match the reference footprint, blocking at least a portion of the web page.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the forensic footprint comprises at least one of a size of the web page, a number of scripted files included in the web page, a number of user input fields included in the web page, a number of selectable icons included in the web page, a number of images included in the web page, and information indicating content of the web page.

### Claim 13 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the reference footprint is generated prior to the receiving.

### Claim 14 (depends on 11)

The non-transitory computer-readable medium of claim 11, further comprising at least one of redirecting a browser to another web page and presenting a notification to a user.

### Claim 15 (depends on 11)

The non-transitory computer-readable medium of claim 11, the method further comprising, in response to determining that the forensic footprint matches the reference footprint, iteratively performing the generating and the determining after a predetermined amount of time.