Protecting against the introduction of alien content
AssigneeShape Security, Inc.
InventorsJustin D. Call, Xiaohan Huang, Xiaoming Zhou, Subramanian Varadarajan, Marc R. Hansen
Life of this patent
Estimating the term…
Abstract
In one implementation, a computer-implemented method can identify abnormal computer behavior. The method can receive, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet. The method can also modify the computer code to obscure operational design of the web server system that could be determined from the computer code, and supplement the computer code with instrumentation code that is programmed to execute on the computing client. The method may serve the modified and supplemented computer code to the computing client.
Claims20
A computer-implemented security method, comprising:
- obtaining, by a computer server system, requests from a plurality of client devices for a common web resource;
- for each client device of the plurality of client devices:
- recoding portions of the common web resource that do not affect a presentation of the common web resource on the client device of the plurality of different client devices, the recoding for the client device differing than the recoding for a different client device of the plurality of client devices;
- serving the common web resource with the recoded portions to the client device;
- receiving, from the client device, a response that results from the serving of the common web resource with the recoded portions, the response having different content that depends on how the portions of the common web resource were recoded for the client device;
- and
- decoding content in the response from the client device in a manner that corresponds to how the portions of the common web resource were recoded for the client device of the plurality of client devices.
A computer system for identifying abnormal computer behavior, the computer system comprising:
- a security intermediary arranged to (i) receive the resource from a web server before the resource is provided to requesting client computing devices, (ii) process the received resource, and (iii) transmit the processed resource to corresponding requesting client computing devices;
- wherein the web server is configured to provide the resource in a form of computer code to requesting client computing devices;
- and
- wherein processing the received resource includes modifying the computer code for the received resource to obscure operation of the web server, the modifying being different for different requests from clients for the received resource.
Dependencies are inferred from the claim text.