Detecting the introduction of alien content
AssigneeShape Security, Inc.
InventorsJustin D. Call, Subramanian Varadarajan, Xiaohan Huang, Xiaoming Zhou, Marc R. Hansen
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for identifying abnormal computer behavior includes receiving, at a computer server subsystem, data that characterizes subsets of particular document object models for web pages rendered by particular client computers; identifying clusters from the data that characterize the subsets of the particular document object models; and using the clusters to identify alien content on the particular client computers, wherein the alien content comprises content in the document object models that is not the result of content that is the basis of the document object model served.
Claims24
A computer-implemented method for identifying abnormal computer behavior, the method comprising:
- identifying, at a computer server subsystem, electronic content that has been served in one or more electronic resources to particular client computers for rendering web pages;
- receiving, at the computer server subsystem, data that characterizes subsets of particular document object models for the web pages rendered by the particular client computers;
- identifying clusters from the data that characterize the subsets of the particular document object models;
- and
- analyzing the clusters to identify alien content on the particular client computers, the alien content including content that is determined to be present, in the subsets of the particular document object models, not as a result of the electronic content that was served to the particular client computers for rendering the web pages.
A computer system for identifying abnormal computer behavior comprising:
- one or more computing devices having one or more computer processors and one or more storage devices;
- an instrumentation module, on the one or more computing devices, configured to supplement web code that is to be served to client computing devices with instrumentation code, the instrumentation code programmed (i) to collect information about execution of the supplemented web code at the client computing devices, the information including representations of at least portions of document object models of the supplemented web code executed at the client computing devices, and (ii) to report the collected information about execution of the supplemented web code at the client computing devices to the computer system;
- a security monitoring module, on the one or more computing devices, configured to analyze information reported from the client computing devices to identify alien content on the client computing devices by generating clusters of the representations of the at least portions of the document object models, and by determining from the clusters that the at least portions of the document object models include content that does not result from the supplemented web code served to the client computing devices.
A computer-implemented method for identifying abnormal computer behavior, the method comprising:
- receiving, at a security server system, data that characterizes execution of one or more web resources by a plurality of client computing devices, the data having been generated by instrumentation code that was injected into initial web code for the one or more web resources, the data including representations of at least portions of document object models rendered by the plurality of client computing devices while executing the one or more web resources;
- identifying, based on the representations of the at least portions of the document object models, a subset of executions of the one or more web resources on particular ones of the plurality of client computing devices that deviated from expected executions of the one or more web resources;
- and
- using information from the subset of executions of the one or more web resources to identify alien content on the particular ones of the plurality of client computing devices that correspond to the subset of executions of the one or more web resources.
Dependencies are inferred from the claim text.