# US 2022/0046031 A1 · Client-side attack detection via simulation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0046031 A1 - Document ID: US20220046031A1 - Status: Published application - Kind: A1 - Application number: 16/985,737 - Filed: 2020-08-05 - Published: 2022-02-10 - Earliest claimed: 2020-08-05 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: George Chen Kaidi - Web page: https://patentgrep.com/patent/US20220046031A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 21/554: {involving event detection and direct action} - G06V 10/82: using neural networks - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 8/36: Software reuse - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract Client-side attack detection via simulation for detecting and mitigating cross-site script code client-side attacks is disclosed. A system can receive, through a network interface from a web server, a first response having a first payload that includes an action based on a request to the web server and a second response having a corresponding payload that is received concurrently with the first response on a signal path from the web server that is different from that of the first response. The system can invoke the action from the first payload and detect malicious activity in the invoked action. The system can verify the detecting of the malicious activity and issue a message indicating a security incident relating to the malicious activity. The system can either allow or restrict passage of the second response to a network based on a mode of the system when the malicious activity is verified. ## Claims ### Claim 1 A method, comprising: receiving, at a simulation engine of a network device through a first application programming interface from a network, a request directed to a web server for invoking at least one of a plurality of actions at a client device; receiving, at the simulation engine through a second application programming interface from the web server, a first response comprising a first payload that includes the one of the plurality of actions based on the request; receiving, at the simulation engine through the second application programming interface from the web server, a second response concurrently with the first response on a signal path from the web server to the simulation engine that is different from that of the first response, the second response comprising a second payload that corresponds to the first payload; invoking, at the simulation engine, the one of the plurality of actions from the first payload; detecting, at a detection engine of the network device, malicious activity in the one of the plurality of actions; receiving, at the simulation engine from a validation engine of the network device, a validation input indicating that the detecting of the malicious activity is verified; and issuing, by the validation engine to a remediation engine of the network device, a message indicating a security incident relating to the malicious activity, wherein the second response is bypassed to or restricted passage to the network based on a mode of the simulation engine when the detecting is verified. ### Claim 2 (depends on 1) The method of claim 1, wherein the message comprises an indication of the first payload included in the first response, information indicating an attack vector and a source associated with the request, or an indication of an endpoint for remediation that is vulnerable to an attack by the one of the plurality of actions. ### Claim 3 (depends on 1) The method of claim 1, further comprising: selecting at least one of a plurality of prediction engines; and training the at least one of the plurality of prediction engines with a training dataset to generate the detection engine. ### Claim 4 (depends on 1) The method of claim 1, further comprising: verifying, using the validation engine, the malicious activity in the one of the plurality of actions based at least in part on a set of criteria to reduce a rate of false positive detections. ### Claim 5 (depends on 4) The method of claim 4, further comprising: selecting at least one of a plurality of prediction engines; and training the at least one of the plurality of prediction engines with a training dataset to generate the validation engine. ### Claim 6 (depends on 1) The method of claim 1, wherein the invoking the one of the plurality of actions comprises invoking, at the simulator engine, at least one of a plurality of cross-site scripts. ### Claim 7 (depends on 1) The method of claim 1, wherein: the second response is bypassed from the web server to the network through the simulation engine when the simulation engine is set to a detection mode, and the second response is restricted passage from the web server to the network by the simulation engine when the simulation engine is set to a block mode. ### Claim 8 (depends on 7) The method of claim 7, further comprising: applying, using the simulation engine in the block mode, a blocking operation on the second response to restrict passage of the second response from the web server to the network based on detection of the malicious activity in the first response. ### Claim 9 (depends on 1) The method of claim 1, further comprising: comparing the first response to the request or a predetermined response associated with the request using a set of predefined rules; and detecting one or more parameters in the first response that deviate from the request or the predetermined response based on the comparing with the set of predefined rules, wherein the issuing the message comprises: issuing the message indicating the security incident based on the detecting of the one or more parameters in the first response that deviate from the request or the predetermined response. ### Claim 10 (depends on 1) The method of claim 1, wherein the invoking the one of the plurality of actions comprises: selecting at least one of a plurality of virtual machines of the simulation engine; and invoking, using the at least one of the plurality of virtual machines, the one of the plurality of actions. ### Claim 11 (depends on 1) The method of claim 1, further comprising: determining, using the detection engine, an offset between a time at which the first response is actually received at the simulation engine and a predetermined time at which the first response is expected to be received at the simulation engine, wherein the detecting the malicious activity comprises determining that the offset corresponds to the malicious activity. ### Claim 12 A system comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: receiving, through an application programming interface from a web server, a first response comprising a first payload that includes one of a plurality of actions based on a request to the web server and a second response concurrently with the first response on a signal path from the web server to the system that is different from that of the first response, the second response comprising a second payload that corresponds to the first payload; invoking the one of the plurality of actions from the first payload; detecting malicious activity in the one of the plurality of actions; verifying the detecting of the malicious activity in the one of the plurality of actions; and issuing a message indicating a security incident relating to the malicious activity, wherein the second response is bypassed to or restricted passage to a network based on a mode of the system when the malicious activity is verified. ### Claim 13 (depends on 12) The system of claim 12, wherein the message comprises an indication of the first payload included in the first response, information indicating an attack vector and a source associated with the request, or an indication of an endpoint for remediation that is vulnerable to an attack by the one of the plurality of actions. ### Claim 14 (depends on 12) The system of claim 12, wherein the operations further comprise: applying a blocking operation on the second payload to restrict passage of the second response from the web server to the network based on detection of the malicious activity in the first payload. ### Claim 15 (depends on 12) The system of claim 12, wherein the invoking the one of the plurality of actions comprises: selecting at least one of a plurality of virtual machines; and invoking, using the at least one of the plurality of virtual machines, the one of the plurality of actions. ### Claim 16 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: receiving, at a simulation engine through an application programming interface to a web server, a first response comprising a first payload that includes one of a plurality of actions based on a request to the web server and a second response concurrently with the first response on a signal path from the web server to the simulation engine that is different from that of the first response, the second response comprising a second payload that corresponds to the first payload; simulating, at the simulation engine, the one of the plurality of actions from the first payload; detecting, at a detection engine, malicious activity in the one of the plurality of actions based on the simulating; determining, at a validation engine, whether the detecting of the malicious activity in the one of the plurality of actions is verified; and issuing, by the detection engine to a remediation engine, a message indicating a security incident relating to the malicious activity when the detecting is determined to be valid, wherein the second response is bypassed to or restricted passage to a network based on a mode of the simulation engine when the detecting is verified. ### Claim 17 (depends on 16) The non-transitory machine-readable medium of claim 16, wherein the determining whether the detecting of the malicious activity in the one of the plurality of actions is verified comprises: analyzing, using the validation engine, the malicious activity in the first response based at least in part on a set of criteria to verify the detecting and reduce a rate of false positive detections. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein: the simulating the one of the plurality of actions comprises: invoking, at the simulation engine, the one of the plurality of actions, and the detecting the malicious activity comprises: detecting, at the detection engine, the malicious activity in the one of the plurality of actions. ### Claim 19 (depends on 16) The non-transitory machine-readable medium of claim 16, wherein the message comprises an indication of the first payload included in the first response, information indicating an attack vector and a source associated with the request, or an indication of an endpoint for remediation that is vulnerable to an attack by the one of the plurality of actions. ### Claim 20 (depends on 16) The non-transitory machine-readable medium of claim 16, wherein the operations further comprise: applying, at the simulation engine in a block mode, a blocking operation on the second payload based on detection of the malicious activity in the first payload to restrict passage of the second response from the web server to the network.