# US 9,521,133 B2 · Moving target defense against cross-site scripting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,133 B2 - Document ID: US9521133B2 - Status: Granted - Kind: B2 - Application number: 14/692,149 - Filed: 2015-04-21 - Published: 2015-08-06 - Granted: 2016-12-13 - Earliest claimed: 2013-09-27 - Assignees: The University of North Carolina at Charlotte - Applicants: Bei-Tseng Chu; Joe Portner; Joel Kerr; Ehab Al-Shaer - Inventors: Bei-Tseng Chu; Joe Portner; Joel Kerr; Ehab Al-Shaer - Web page: https://patentgrep.com/patent/US9521133B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/128: {involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/567: {using dedicated hardware} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1001: for accessing one among a plurality of replicated servers - H04L 67/1004: Server selection for load balancing - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 2221/2115: Third party - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - H04L 63/168: {above the transport layer} - H04L 67/1029: using data related to the state of servers by a load balancer - H04L 67/1031: Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, in a server, implementing a moving target defense against cross-site scripting includes receiving a request for a web page, wherein the server has N versions of the web page each with a mutated version of JavaScript; selecting a web page of the N versions; and sending an indication of the mutated version of JavaScript associated with the web page in response to the request. Another method, in a client device, using a moving target defense against cross-site scripting includes requesting a web page; receiving an indication of a mutated version of JavaScript for the web page; and adjusting a JavaScript interpreter based on the mutated version of JavaScript for the web page. ## Claims ### Claim 1 A method, in a client device, using a moving target defense against cross-site scripting, the method comprising: requesting a web page from a server, wherein the server mutates web content with JavaScript offline to provide N versions of the web page, each with a different mutated version of JavaScript, and wherein, upon the requesting, the server provides one of the N versions of the web page thereby providing the moving target defense against cross-site scripting; receiving a response serving the web page from the server with a header comprising an indication of a mutated version of JavaScript for the web page of the N versions of the web page each with a different mutated version and replaced randomly to increase probability of vulnerability detection, wherein the mutated version of JavaScript comprises changes to one or more lexical tokens which are selected based on use in malicious JavaScript attacks, wherein the one or more lexical tokens are one or more of a left parenthesis and an assignment operator, wherein cross-site scripting requires use of the parenthesis or the assignment operator to maliciously manipulate behavior, and wherein the parenthesis or the assignment operator are randomized because they manipulate behavior or state in a cross-site scripting attack; adjusting a JavaScript interpreter based on the mutated version of JavaScript for the web page; and detecting any JavaScript not conforming to the mutated version of JavaScript and providing an indication of a violation including JavaScript not conforming to the mutated version of JavaScript associated with the web page, wherein the indication includes a page on which the violation occurred, the page's referrer, a resource that violated the page's policy, and a specific directive of the violation. ### Claim 2 (depends on 1) The method of claim 1, further comprising: responsive to the detecting, performing one or more of prohibiting any JavaScript not conforming to the mutated version of JavaScript and alerting the server associated with the web page. ### Claim 3 (depends on 1) The method of claim 1, wherein any attack scripts generated from content at run time are not compliant to the mutated version of JavaScript and thus detected as cross-site scripting. ### Claim 4 (depends on 1) The method of claim 1, wherein the web content comprises files with extensions of .HML, .HTML, .JS, .CSS, .PHP, .JSP, and .ASP. ### Claim 5 (depends on 1) The method of claim 1, wherein the requesting, receiving, and adjusting step are performed by a moving target defense compliant browser executed on the client device. ### Claim 6 (depends on 1) The method of claim 1, wherein the client device operates a browser program with a plugin for implementing the requesting, receiving, and adjusting steps. ### Claim 7 A client device configured to implement a moving target defense against cross-site scripting, the client device comprising: a processor; and memory storing instructions that, when executed, cause the processor to: request a web page from a server, wherein the server mutates web content with JavaScript offline to provide N versions of the web page, each with a different mutated version of JavaScript, and wherein, upon the requesting, the server provides one of the N versions of the web page thereby providing the moving target defense against cross-site scripting; receive a response serving the web page from the server with a header comprising an indication of a mutated version of JavaScript for the web page of the N versions of the web page each with a different mutated version and replaced periodically to increase probability of vulnerability detection, wherein the mutated version of JavaScript comprises changes to one or more lexical tokens which are selected based on use in malicious JavaScript attacks, wherein the one or more lexical tokens are one or more of a left parenthesis and an assignment operator, wherein cross-site scripting requires use of the parenthesis or the assignment operator to maliciously manipulate behavior, and wherein the parenthesis or the assignment operator are randomized because they manipulate behavior or state in a cross-site scripting attack, and wherein the web page is randomly reselected from the N versions and replaced periodically by the server; adjust a JavaScript interpreter based on the mutated version of JavaScript for the web page; and detect any JavaScript not conforming to the mutated version of JavaScript and provide an indication of a violation including JavaScript not conforming to the mutated version of JavaScript associated with the web page, wherein the indication includes a page on which the violation occurred, the page's referrer, a resource that violated the page's policy, and a specific directive of the violation. ### Claim 8 (depends on 7) The client device of claim 7, wherein the instructions that, when executed, further cause the processor to responsive to detecting any JavaScript not conforming to the mutated version of JavaScript, perform one or more of prohibit any JavaScript not conforming to the mutated version of JavaScript and alert the server associated with the web page. ### Claim 9 (depends on 7) The client device of claim 7, wherein any attack scripts generated from content at run time are not compliant to the mutated version of JavaScript and thus detected as cross-site scripting. ### Claim 10 (depends on 7) The client device of claim 7, wherein the web content comprises files with extensions of .HML, .HTML, .JS, .CSS, .PHP, .JSP, and .ASP. ### Claim 11 (depends on 7) The client device of claim 7, wherein the instructions comprise a moving target defense compliant browser executed on the client device. ### Claim 12 (depends on 7) The client device of claim 7, wherein the client device operates a browser program with a plugin for implementing adjustments to the JavaScript interpreter.