Anomaly detection on web client
AssigneeIntel Corporation
InventorsHong Li, Tobias Kohlenberg, Jim S Baca
Life of this patent
Estimating the term…
Abstract
Embodiments for anomaly detection on a web client are generally described herein. A processor on the web client is monitored, where a web browser is installed on the web client, with the web browser arranged to render a web page, the web page including content originating from a plurality of origins. A request from the web page to store data on the web client is intercepted, with the request originating from a particular origin of the plurality of origins. The request is analyzed and approved or denied based on the particular origin.
Claims25
An apparatus for anomaly detection on a web client, the apparatus comprising:
- a monitoring circuit to:
- monitor a web browser installed on the apparatus, the web browser arranged to render a web page corresponding to a domain name, the web page including content originating from a plurality of origins, wherein each origin of the plurality of origins includes at least one respective subdomain name associated with the domain name, a respective application layer protocol, and a respective port number;
- intercept a request from the web page to store data on the apparatus, the request originating from a particular origin of the plurality of origins, wherein the request from the web page to store data on the apparatus is a HTML5 request from the respective subdomain of the particular origin to store data in a localStorage object;
- analyze the request, wherein analyzing the request includes analyzing characteristics of web browser behavior including a count of subdomains of the origin requesting to store data on the apparatus and a frequency of subdomain changes;
- and
- approve or deny the request based on a respective subdomain of the at least one respective subdomain of the particular origin and based on the characteristics of the web browser behavior.
A method for anomaly detection on a web client, the method comprising:
- monitoring using a processor on the web client, a web browser installed on the web client, the web browser arranged to render a web page corresponding to a domain name, the web page including content originating from a plurality of origins, wherein each origin of the plurality of origins includes at least one respective subdomain name associated with the domain name, a respective application layer protocol, and a respective port number;
- intercepting a request from the web page to store data on the web client, the request originating from a particular origin of the plurality of origins, wherein the request from the web page to store data on the web client is a HTML5 request from the respective subdomain of the particular origin to store data in a localStorage object;
- analyzing the request, wherein analyzing the request includes analyzing characteristics of web browser behavior including a count of subdomains of the origin requesting to store data on the apparatus and a frequency of subdomain changes;
- and
- approving or denying the request based on a respective subdomain of the at least one respective subdomain of the particular origin and based on the characteristics of the web browser behavior.
A non-transitory machine-readable medium including instructions for anomaly detection on a web client, which when executed by a machine, cause the machine to:
- monitor using a processor on the web client, a web browser installed on the web client, the web browser arranged to render a web page corresponding to a domain name, the web page including content originating from a plurality of origins, wherein each origin of the plurality of origins includes a respective subdomain name associated with the domain name, a respective application layer protocol, and a respective port number;
- intercept a request from the web page to store data on the web client, the request originating from a particular origin of the plurality of origins, wherein the request from the web page to store data on the web client is a HTML5 request from the respective subdomain of the particular origin to store data in a localStorage object;
- analyze the request, wherein analysis of the request includes analysis of characteristics of web browser behavior including speed of storing data to the apparatus, a count of subdomains of the origin requesting to store data on the web client, a frequency of subdomain changes, and a ratio of reads and writes of stored data;
- and
- approve or deny the request based on the respective subdomain of the particular origin and based on the characteristics of the web browser behavior.
Dependencies are inferred from the claim text.