# US 9,438,625 B1 · Mitigating scripted attacks using dynamic polymorphism > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,625 B1 - Document ID: US9438625B1 - Status: Granted - Kind: B1 - Application number: 14/481,835 - Filed: 2014-09-09 - Granted: 2016-09-06 - Earliest claimed: 2014-09-09 - Assignees: Shape Security, Inc. - Applicants: Shape Security, Inc. - Inventors: Siying Yang - Web page: https://patentgrep.com/patent/US9438625B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/54: by adding security routines or objects to programs - H04L 63/168: {above the transport layer} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 2209/16: Obfuscation or hiding, e.g. involving white box - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In an embodiment, a data processing system comprises one or more processors; script analysis logic coupled to the one or more processors and configured to obtain a particular electronic document from a server computer; script injection logic coupled to the one or more processors and configured to insert a set of script code into source code of the electronic document to result in producing a modified electronic document prior to providing the modified electronic document to a client computer; wherein the script code is configured to improve resistance of the client computer to attacks by running upon loading in the client computer and to cause transforming, when running in the client computer, one or more values of one or more elements of the source code of the electronic document into obfuscated values of the one or more elements. As a result, the system and method herein improve resistance of the client computer to attacks. ## Claims ### Claim 1 A data processing system configured to improve resistance of a client computer to attacks and comprising: one or more hardware processors; script analysis logic coupled to the one or more processors and configured to obtain a particular electronic document from a server computer; script injection logic coupled to the one or more processors and configured to insert a set of script code into source code of the electronic document to result in producing a modified electronic document prior to providing the modified electronic document to a client computer; wherein the script code is configured to: improve resistance of the client computer to attacks by running upon loading in the client computer and to cause transforming, when running in the client computer, one or more values of one or more elements of the source code of the electronic document into obfuscated values of the one or more elements, repeatedly periodically execute in the client computer after loading in the client computer, and cause the transforming in a different manner at each time that the script code repeatedly periodically executes in the client computer. ### Claim 2 (depends on 1) The data processing system of claim 1, wherein the script code is configured to cause the transforming using a pseudo-random transformation of the values of the elements. ### Claim 3 (depends on 1) The data processing system of claim 1, wherein the script code comprises two or more segments of a particular obfuscated value, and wherein the script code is configured to cause transforming a particular value of a particular element of the source code into a particular combination of the two or more segments. ### Claim 4 (depends on 3) The data processing system of claim 3, wherein the script code is configured to cause transforming the particular value of the particular element of the source code into a pseudo-randomly selected combination of the two or more segments. ### Claim 5 (depends on 3) The data processing system of claim 3, wherein the script code is configured to cause transforming the particular value of the particular element of the source code into a randomly selected combination of the two or more segments. ### Claim 6 (depends on 1) The data processing system of claim 1, wherein the script code is configured to repeatedly periodically execute in the client computer at time intervals specified using a time interval value in the script code, and wherein the script injection logic is configured to periodically update the time interval value in the script code to a different time interval value. ### Claim 7 (depends on 1) The data processing system of claim 1, wherein the script code comprises JAVASCRIPT script code. ### Claim 8 A data processing method of improving resistance of a client computer to attacks comprising: at an intermediary computer: obtaining a particular electronic document from a server computer; inserting a set of script code into source code of the electronic document to result in producing a modified electronic document; providing the modified electronic document to a client computer; wherein the script code is configured to: improve resistance of the client computer to attacks by running upon loading in the client computer and to cause transforming, when running in the client computer, one or more values of one or more elements of the source code of the electronic document into obfuscated values of the one or more elements, repeatedly periodically execute in the client computer after loading in the client computer, and cause the transforming in a different manner at each time that the script code repeatedly executes in the client computer. ### Claim 9 (depends on 8) The data processing method of claim 8, wherein the script code is configured to cause the transforming using a pseudo-random transformation of the values of the elements. ### Claim 10 (depends on 8) The data processing method of claim 8, wherein the script code comprises two or more segments of a particular obfuscated value, and wherein the script code is configured to cause transforming a particular value of a particular element of the source code into a particular combination of the two or more segments. ### Claim 11 (depends on 10) The data processing method of claim 10, wherein the script code is configured to cause transforming the particular value of the particular element of the source code into a pseudo-randomly selected combination of the two or more segments. ### Claim 12 (depends on 10) The data processing method of claim 10, wherein the script code is configured to cause transforming the particular value of the particular element of the source code into a randomly selected combination of the two or more segments. ### Claim 13 (depends on 8) The data processing method of claim 8, wherein the script code is configured to repeatedly periodically execute in the client computer at time intervals specified using a time interval value in the script code, and further comprising periodically updating the time interval value in the script code to a different time interval value. ### Claim 14 (depends on 8) The data processing method of claim 8, wherein the script code comprises JAVASCRIPT script code. ### Claim 15 A data processing method of improving resistance of a client computer to attacks comprising: using a security computer that is logically interposed between a server computer that generates HTML documents and a client computer, obtaining a HTML electronic document from the server computer; inserting a set of JAVASCRIPT script code into HTML source code of the HTML document to result in producing a modified HTML document; providing the modified HTML document to the client computer; wherein the JAVASCRIPT code is configured to: improve resistance of the client computer to attacks by running upon loading in the client computer and to cause transforming, when running in the client computer, one or more values of one or more elements of the HTML source code of the HTML document into obfuscated values of the one or more elements, repeatedly periodically execute in the client computer at time intervals specified using a time interval value in the JAVASCRIPT code after loading in the client computer, and periodically updating the time interval value in the JAVASCRIPT code to a different time interval value. ### Claim 16 (depends on 15) The data processing method of claim 15, wherein the JAVASCRIPT code is configured to cause the transforming using a pseudo-random transformation of the values of the elements. ### Claim 17 (depends on 15) The data processing method of claim 15, wherein the JAVASCRIPT code comprises two or more segments of a particular obfuscated value, and wherein the JAVASCRIPT code is configured to cause transforming a particular value of a particular element of the HTML source code into a particular combination of the two or more segments. ### Claim 18 (depends on 17) The data processing method of claim 17, wherein the JAVASCRIPT code is configured to cause transforming the particular value of the particular element of the HTML source code into a pseudo-randomly selected combination of the two or more segments. ### Claim 19 (depends on 17) The data processing method of claim 17, wherein the JAVASCRIPT code is configured to cause transforming the particular value of the particular element of the HTML source code into a randomly selected combination of the two or more segments. ### Claim 20 (depends on 15) The data processing method of claim 15, wherein the JAVASCRIPT code is configured to repeatedly periodically execute in the client computer, and wherein the JAVASCRIPT code is configured to cause the transforming in a different manner at each time that the JAVASCRIPT code repeatedly periodically executes in the client computer.