U.S. patent application number 15/859694 was filed with the patent office on 2018-05-03 for obfuscating web code.
The applicant listed for this patent is Shape Security, Inc.. Invention is credited to Xinran Wang, Yao Zhao.
Application Number | 20180121680 15/859694 |
Document ID | / |
Family ID | 60971724 |
Filed Date | 2018-05-03 |
United States Patent
Application |
20180121680 |
Kind Code |
A1 |
Wang; Xinran ; et
al. |
May 3, 2018 |
OBFUSCATING WEB CODE
Abstract
A computer-implemented method, the method includes identifying a
piece of data to be served from a server system to a client device
that is remote from the server system; creating a plurality of
expressions that, when executed, provide a result that corresponds
to the piece of data; and providing the plurality of expressions to
the client device with code for executing the plurality of
expressions.
Inventors: |
Wang; Xinran; (San Ramon,
CA) ; Zhao; Yao; (Fremont, CA) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
Shape Security, Inc. |
Mountain View |
CA |
US |
|
|
Family ID: |
60971724 |
Appl. No.: |
15/859694 |
Filed: |
January 1, 2018 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
14286324 |
May 23, 2014 |
9858440 |
|
|
15859694 |
|
|
|
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
G06F 21/125 20130101;
G06F 21/64 20130101; G06F 21/55 20130101; G06F 21/54 20130101 |
International
Class: |
G06F 21/64 20060101
G06F021/64 |
Claims
1. A computer-implemented method, comprising: identifying a piece
of data for serving from a server system to a client device that is
remote from the server system, the piece of data being part of
executable code requested from the server from the client device;
creating a plurality of expressions that, when executed, provide a
result that corresponds to the piece of data; and providing, to the
client device and as part of the executable code, the plurality of
expressions along with code for executing the plurality of
expressions, so that when the plurality of expressions are executed
on the client device, the identified piece of data is returned on
the client device without a need to serve the identified piece of
data to the client device.
2. The computer-implemented method of claim 1, further comprising
performing a permutation on the plurality of expressions so that
the plurality of expressions are ordered in the executable code in
an order different than they were created.
3. The computer-implemented method of claim 2, wherein the order of
the expressions is selected randomly as part of the
permutation.
4. The computer-implemented method of claim 1, further comprising:
creating one or more additional expressions whose executed results
are not used by other code that is part of the executable code
served to the client device; and providing to the client device the
plurality of expressions with the one or more additional
expressions.
5. The computer-implemented method of claim 1, further comprising:
identifying, in the piece of data, data that needs to be kept away
from malware that may be in the client device, and wherein creating
a plurality of expressions comprises creating one or more
replacement statements that when executed, provide a result that
corresponds to the potentially sensitive data.
6. The computer-implemented method of claim 5, wherein the one or
more replacement statements comprise one or more expressions that
do not execute on the client device when the executable code is
executed.
7. The computer-implemented method of claim 1, further comprising
identifying, in the piece of data, a first expression and a second
expression to be replaced, wherein creating a plurality of
expressions comprises creating a first set of replacement
expressions corresponding to the first expression and a second set
of expressions corresponding to the second expressions; and
interleaving the replacement expressions of the first set of
replacement expressions with the replacement expressions of the
second set of replacement expressions, wherein the plurality of
expressions provided to the client device comprise the interleaved
replacement expressions.
8. The computer-implemented method of claim 1, wherein creating a
plurality of expressions comprises: creating a first set of
replacement expressions; identifying a first replacement expression
in the first set of replacement expressions; creating a second set
of replacement expressions that, when executed, provide a result
that corresponds to the first replacement expression; and replacing
the first replacement expression with the second set of replacement
expressions.
9. The computer-implemented method of claim 1, wherein the piece of
data to be served comprises formats of code in HTML, CSS, and
JavaScript, and wherein each of the formats interoperates with the
other formats.
10. A computer-implemented method, the method comprising:
receiving, from a server system, web content comprising original
code, wherein the web content is requested by a client device that
is remote from the server system; identifying a piece of data in
the code; creating a plurality of expressions that, when executed,
provide a result that corresponds to the piece of data; generating
modified code comprising the original code with the piece of data
replaced with the plurality of expressions; and providing the
modified code to the client device, wherein, when executed, the
modified code provides a result that corresponds to the original
code.
11. The computer-implemented method of claim 10, wherein generating
modified code comprises: interleaving the plurality of expressions
into the original code with the identified piece of data
removed.
12. The computer-implemented method of claim 11, wherein the
plurality of expressions are created in a first ordering, and
wherein the plurality of expressions are interleaved into the
original code so that the plurality of expressions maintain the
first ordering.
13. The computer-implemented method of claim 11, wherein the
plurality of expressions are created in a first ordering, and
wherein the plurality of expressions are interleaved into the
original code so that the plurality of expressions are in a second
ordering that is different than the first ordering.
14. The computer-implemented method of claim 10, wherein the
plurality of expressions comprises one or more junk expressions
that do not execute.
15. The computer-implemented method of claim 10, further
comprising: selecting a first expression among the plurality of
expressions; and creating a second plurality of expressions that,
when executed, provide a result that corresponds to the selected
first expression, wherein the generated modified code comprises the
original code with the piece of data replaced with the plurality of
expressions, with the selected first expression replaced with the
second plurality of expressions.
16. A computer system for recoding web content served to client
computers, the system comprising: an interface for receiving
information from a web server system configured to provide computer
code in multiple different formats in response to requests from
client computing devices; and a security intermediary that is
arranged to (i) receive the computer code from the interface before
the computer code is provided to the client computing devices, (ii)
identify a piece of data in the computer code that is to be
replaced; (iii) create a plurality of expressions that, when
executed, provide a result that corresponds to the piece of data;
and (iv) provide the plurality of expressions to the client
computing devices with code for executing the plurality of
expressions.
17. The computer-implemented system of claim 16, wherein the piece
of data in the computer code that is to be replaced is identified
as potentially sensitive data.
18. The computer-implemented system of claim 16, wherein the
security intermediary is further arranged to perform a permutation
of the plurality of expressions.
19. The computer-implemented system of claim 16, wherein the
plurality of expressions comprise one or more expressions that do
not execute.
20. The computer-implemented system of claim 16, wherein the
security intermediary is further arranged to interleave the
plurality of expressions with the code of executing the plurality
of expressions.
Description
[0001] This application claims the benefit under 35 U.S.C. 120 as a
Continuation of U.S. patent application Ser. No. 14/286,324, filed
on 2014 May 23, the entire contents of which are hereby
incorporated by reference for all purposes as if fully set forth
herein. The applicant(s) hereby rescind any disclaimer of claim
scope in the parent application(s) or the prosecution history
thereof and advise the USPTO that the claims in this application
may be broader than any claim in the parent application(s).
TECHNICAL FIELD
[0002] This document relates to computer security and interference
with malware.
BACKGROUND
[0003] Research indicates that a large share of web traffic
involves computer bots--many are malware. Bot activities include
content scraping, reconnaissance, credential stuffing, creating
fake accounts, comment spamming, and similar activities. Bots can
impose an unnecessary load on any company trying to serve web
content efficiently. More importantly, they can attempt to "learn"
the operation of a web site so as to exploit it. As one example,
malicious software (malware) may execute a "man in the browser"
attack by intercepting communications that a user makes with a web
site in a manner that makes the user believe that he or she is
actually communicating with the web site. For example, malware may
generate a display for a user who is visiting a banking site, where
the display requests from the user information such as social
security number, credit card number, other account numbers. An
organization that operates the malware may then have such data sent
to it, and may use the data to steal from the user, the web site
operator, or both.
[0004] Various approaches have been taken to identify and prevent
such malicious activity. For example, programs have been developed
for operation on client computers or at the servers of the
organizations that own and operate the client computer to detect
improper activity.
SUMMARY
[0005] This document describes systems and techniques by which web
code (e.g., HTML, CSS, and JavaScript) that a server system
provides to client devices is modified before it is served over the
internet, so as to make more difficult the exploitation of the code
and the operator of the server system by clients that receive the
code (including clients that are infected without their human
users' knowledge). The modifications can be made to encode
sensitive data, and may differ for different instances in which a
web page and related content are served, whether to the same client
computer or to different client computers. For example, a single
expression or value in the code may be re-written as multiple
expressions that, when executed, produce the initial value or
expression. Where different code is served in response to each
request, the expressions into which the initial value are resolved
may also differ each time. The output of the code, when executed on
the client computer, however, is the same for all such different
versions of the served code so that a user at a client computer
does not perceive a difference in the displayed web page.
Specifically, two different users (or a single user in two
different web browsing sessions) may be served slightly different
code in response to the same requests, where the difference may be
in implicit parts of the code that are not displayed so that the
differences are not noticeable to the user or users.
[0006] The manner in which an initial value or expression is
rewritten into multiple expressions capable of being executed on a
client computer may take a variety of forms For example, different
expressions, different numbers of expressions, and different
ordering of the execution of the expressions may all be varied to
interfere with malware. Also, these different parameters may be
varied so as to be different from one serving of the code to the
next. Such variation, which may be termed "polymorphism" of the
code, may help create a moving target against which malware needs
to apply itself. In one example, changing the code that is served
to client devices in an essentially random manner (i.e., a manner
that effectively interferes with the ability of malware that has
analyzed serving n from inferring something useful about serving
n+x) each time the code is served can deter malicious code
executing on the client computers (e.g., Man in the Browser bot)
from interacting with the served code in a predictable way so as to
trick a user of the client computer into providing confidential
financial information and the like. Moreover, external programs
generally cannot drive web application functionality directly, and
so preventing predictable interaction with served code can be an
effective mechanism for preventing malicious computer activity.
[0007] As described here, the techniques transform values or
expressions, such as a cleartext string, a Javascript object, or a
Javascript code snippet into another Javascript snippet that is the
equivalent to the input after it is executed (i.e., it produces an
identical displayed output). The encoding is dynamic and random,
which means that the encoding generates different output code each
time given the same input (though the outputs may repeat
periodically as long as that repetition is not frequent enough to
allow malware to predict the output or readily obtain the repeated
output). Because the encoded output code is still presented as
cleartext, it may not be able to prevent a human from ascertaining
sensitive data, but it may make it very difficult for a malicious
party to write a computer program to extract the sensitive data
automatically.
[0008] Likewise, other forms of computer attacks can also be
prevented or deterred by the web code transformations described in
this document. Some of these attacks include: (a) denial of service
attacks, and particularly advanced application denial of service
attacks, in which a malicious party targets a particular
functionality of a website (e.g., a widget or other web
application) and floods the server with requests for that
functionality until the server can no longer respond to requests
from legitimate users; (b) rating manipulation schemes in which
fraudulent parties use automated scripts to generate a large number
of positive or negative reviews of some entity such as a marketed
product or business in order to artificially skew the average
rating for the entity up or down; (c) fake account creation in
which malicious parties use automated scripts to establish and use
fake accounts on one or more web services to engage in attacks
ranging from content spam, e-mail spam, identity theft, phishing,
ratings manipulation, fraudulent reviews, and countless others; (d)
fraudulent reservation of rival goods, by which a malicious party
exploits flaws in a merchant's website to engage in a form of
online scalping by purchasing all or a substantial amount of the
merchant's inventory and quickly turning around to sell the
inventory at a significant markup; (e) ballot stuffing, in which
automated bots are used to register a large number of fraudulent
poll responses; (f) website scraping, in which both malicious
parties and others (e.g., commercial competitors), use automated
programs to obtain and collect data such as user reviews, articles,
or technical information published by a website, and where the
scraped data is used for commercial purposes that may threaten to
undercut the origin website's investment in the scraped content;
and (g) web vulnerability assessments, in which malicious parties
scan any number of websites for security vulnerabilities by
analyzing the web code and structure of each site.
[0009] The systems, methods, and techniques for web code
modifications described in this paper can, in certain
implementations, prevent or deter one or more of these types of
attacks. For example, transforming sensitive data by replacing
expressions with a set of equivalent expressions and then
interleaving the expressions in the set of equivalent expressions
can cause the effectiveness of bots and other malicious automated
scripts to be substantially diminished.
[0010] The modification of code that is described in more detail
below may be carried out by a security system that may supplement a
web server system, and may intercept requests from client computers
to the web server system and intercept responses from web servers
of the system when they serve content back to the client computers
(including where pieces of the content are served by different
server systems). The modification may be of static code (e.g.,
HTML) and of related executable code (e.g., JavaScript) in
combination. For example, the names of certain elements on a web
page defined via HTML may be changed, as may references to items
external to the HTML (e.g., CSS and JavaScript code). An expression
may be rewritten as an equivalent expression or multiple
expressions. For example, the expression "var y=2" may be rewritten
as the following set of expressions: "var a=10"; "var b=8"; and
"y=a-b". As shown in this example, the combination of the three
expressions in the set of expressions produces the same result as
the original expression--that is, an assignment of the value 2 to
the variable y. Such rewriting, or transforming, of code may occur
by first identifying data present in code that is to be served to
the client computer (e.g., HTML, CSS, and JavaScript) and grouping
such occurrences of sensitive data for further processing (e.g., by
generating flags that point to each such element or copying a
portion of each such element). The identified data may be
identified as sensitive or potentially sensitive or simply data
that should be rewritten before being served. Processing of the
data may occur by modifying each element throughout different
formats of code, such as changing an expression in the manner above
each time that name occurs in a parameter, method call, DOM
operation, or elsewhere. Next, further processing may occur that
comprises interleaving the set of elements throughout the new code.
Such a process may be repeated each time a client computer requests
code, and the modifications may be different for each serving of
the same code.
[0011] In certain instances, the analysis to identify values or
expressions that can be rewritten without affecting the operation
of the code may be performed once, and a map to occurrences of such
values or expressions in the mode may be generated, and then used
for each serving of the code to locate the occurrences, so that
they may be altered throughout the code in a consistent manner that
does not break the code. Such analyze-once, transform-many
approaches may lessen the computational load for such a system and
allow greater scaling of the system to larger web server systems
with high volume requirements.
[0012] Such modification of the served code can help to prevent
bots or other malicious code from exploiting or even detecting
weaknesses in the web server system. For example, the names of
functions or variables may be changed in various random manners
each time a server system serves the code. As noted above, such
constantly changing modifications may interfere with the ability of
malicious parties to identify how the server system operates and
web pages are structured, so that the malicious party cannot
generate code to automatically exploit that structure in dishonest
manners. Such techniques may create a moving target that can
prevent malicious organizations from reverse-engineering the
operation of a web site so as to build automated bots that can
interact with the web site, and potentially carry out
Man-in-the-Browser and other Man-in-the-Middle operations and
attacks.
[0013] The techniques discussed here may be carried out by a server
subsystem that acts as an adjunct to a web server system that is
commonly employed by a provider of web content. For example, as
discussed in more detail below, an internet retailer may have an
existing system by which it presents a web storefront at a web site
(e.g., www.examplestore.com), interacts with customers to show them
information about items available for purchase through the
storefront, and processes order and payment information through
that same storefront. The techniques discussed here may be carried
out by the retailer adding a separate server subsystem (either
physical or virtualized) that stands between the prior system and
the internet. The new subsystem may act to receive web code from
the web servers (or from a traffic management system that receives
the code from the web servers), may translate that code in random
manners before serving it to clients, may receive responses from
clients and translate them in the opposite direction, and then
provide that information to the web servers using the original
names and other data. In addition, such a system may provide the
retailer or a third party with whom the retailer contracts (e.g., a
web security company that monitors data from many different clients
and helps them identify suspect or malicious activity) with
information that identifies suspicious transactions. For example,
the security subsystem may keep a log of abnormal interactions, may
refer particular interactions to a human administrator for later
analysis or for real-time intervention, may cause a financial
system to act as if a transaction occurred (so as to fool code
operating on a client computer) but to stop such a transaction, or
any number of other techniques that may be used to deal with
attempted fraudulent transactions.
[0014] In one implementation, a computer-implemented method is
disclosed that includes identifying a piece of data for serving
from a server system to a client device that is remote from the
server system, the piece of data being part of executable code
requested from the server from the client device; creating a
plurality of expressions that, when executed, provide a result that
corresponds to the piece of data; and providing, to the client
device and as part of the executable code, the plurality of
expressions along with code for executing the plurality of
expressions, so that when the plurality of expressions are executed
on the client device, the identified piece of data is returned on
the client device without a need to serve the identified piece of
data to the client device. The method can include performing a
permutation on the plurality of expressions so that the plurality
of expressions or ordered in the executable code in an order
different than they were created. The order of the expressions can
be selected randomly as part of the permutation.
[0015] In some aspects, the method can include creating one or more
additional expressions whose executed results are not used by other
code that is part of the executable code served to the client
device; and providing to the client device the plurality of
expressions with the one or more additional expressions. Also, the
method can include identifying, in the piece of data, data that
needs to be kept away from malware that may be in the client
device, and wherein creating a plurality of expressions comprises
creating one or more replacement statements that when executed,
provide a result that corresponds to the potentially sensitive
data. The replacement statements can comprise one or more
expressions that do not execute on the client device when the
executable code is executed.
[0016] In certain aspects, the method can further include
identifying, in the piece of data, a first expression and a second
expression to be replaced, wherein creating a plurality of
expressions comprises creating a first set of replacement
expressions corresponding to the first expression and a second set
of expressions corresponding to the second expressions; and
interleaving the replacement expressions of the first set of
replacement expressions with the replacement expressions of the
second set of replacement expressions, wherein the plurality of
expressions provided to the client device comprise the interleaved
replacement expressions.
[0017] In other aspects, creating a plurality of expressions
comprises creating a first set of replacement expressions;
identifying a first replacement expression in the first set of
replacement expressions; creating a second set of replacement
expressions that, when executed, provide a result that corresponds
to the first replacement expression; and replacing the first
replacement expression with the second set of replacement
expressions. The piece of data to be served comprises formats of
code in HTML, CSS, and JavaScript, and wherein each of the formats
interoperates with the other formats.
[0018] In another implementation, a computer-implemented method is
disclosed that comprises receiving, from a server system, web
content comprising original code, wherein the web content is
requested by a client device that is remote from the server system;
identifying a piece of data in the code; creating a plurality of
expressions that, when executed, provide a result that corresponds
to the piece of data; generating modified code comprising the
original code with the piece of data replaced with the plurality of
expressions; and providing the modified code to the client device,
wherein, when executed, the modified code provides a result that
corresponds to the original code. In some aspects, generating
modified code comprises interleaving the plurality of expressions
into the original code with the identified piece of data removed.
Also, in some aspects, the plurality of expressions is created in a
first ordering, and the plurality of expressions is interleaved
into the original code so that the plurality of expressions
maintains the first ordering. In other aspects, the plurality of
expressions are created in a first ordering, and the plurality of
expressions are interleaved into the original code so that the
plurality of expressions are in a second ordering that is different
than the first ordering. In yet other aspects, the plurality of
expressions includes one or more junk expressions that do not
execute. In some aspects, the method further comprises selecting a
first expression among the plurality of expressions; and creating a
second plurality of expressions that, when executed, provide a
result that corresponds to the selected first expression, wherein
the generated modified code comprises the original code with the
piece of data replaced with the plurality of expressions, with the
selected first expression replaced with the second plurality of
expressions.
[0019] In another implementation, a computer system for recoding
web content served to client computers is disclosed that comprises
an interface for receiving information from a web server system
configured to provide computer code in multiple different formats
in response to requests from client computing devices; and a
security intermediary that is arranged to (i) receive the computer
code from the interface before the computer code is provided to the
client computing devices, (ii) identify a piece of data in the
computer code that is to be replaced; (iii) create a plurality of
expressions that, when executed, provide a result that corresponds
to the piece of data; and (iv) provide the plurality of expressions
to the client computing devices with code for executing the
plurality of expressions. In some aspects, the piece of data in the
computer code that is to be replaced is identified as potentially
sensitive data. In other aspects, the security intermediary is
further arranged to perform a permutation of the plurality of
expressions. In yet other aspects, the plurality of expressions
comprise one or more expressions that do not execute. In yet
another aspect, the security intermediary is further arranged to
interleave the plurality of expressions with the code of executing
the plurality of expressions.
[0020] Other features and advantages will be apparent from the
description and drawings, and from the claims.
BRIEF DESCRIPTION OF THE DRAWINGS
[0021] FIG. 1 is a conceptual diagram showing transformation of a
value into multiple expressions that execute back to the value.
[0022] FIG. 1A depicts a general overview of a system for
requesting, modifying, and serving web content.
[0023] FIG. 1B depicts a schematic diagram of an encoding system
that modifies requested web content.
[0024] FIG. 2 depicts an overview of a method for modifying program
code.
[0025] FIG. 3A-3G depict various examples for modifying code for
web content.
[0026] FIG. 4 is a flow diagram of a process for serving modified,
or encoded, web content.
[0027] FIG. 5 shows a system for serving polymorphic code.
[0028] FIG. 6 is a schematic diagram of a general computing
system.
[0029] Like reference numbers and designations in the various
drawings indicate like elements.
DETAILED DESCRIPTION
[0030] FIG. 1 is a conceptual diagram showing transformation of a
value into multiple expressions that execute back to the value. In
general, the diagram attempts to show at a high level how initial
representations in code can be rewritten as multiple
representations that together can be executed on a client device to
return the initial representation. The multiple representations,
however, can be difficult for automated malware to analyze because
they can not easily be matched to a template, can be scattered
throughout the code in appropriate circumstances, and can be
constantly changed, both in their values and in their ordered and
locations in the code.
[0031] The diagram depicts a process, flowing from left-to-right.
The process starts with a value 102, which may take a variety of
forms. The value may be a simple string or number in plaintext
form. Such value may be found by analysis of web code served by a
web server system and provided to an intermediate security system
that is tasked with recoding portions of the served code where the
recoding will not affect the functionality of the code when it is
executed on client devices.
[0032] At 104, the intermediate security system identifies a
relatively complex expression that will resolve to the value. For
clarity of explanation, the expression is shown here in the form of
a pseudo-equation. In the equation, operations are shown as a box
surrounding a dot, to represent that any appropriate operation may
be used. Parentheses are used to indicate grouping of operations,
and the ability to have the relative groups combined with each
other out of the order they are shown in the equation. Thus, at
106, the three main groups are each converted into code snippets to
represent the relevant sub-expressions, and then the order in which
those sub-expressions are evaluated is changed--where the second
grouping from the formula is evaluated first in the code, then the
first, and then the third. Additional code may be generated to
evaluate the results of the three groupings together with each
other.
[0033] The code generated at 106 may then be inserted into the code
received from the web server system and may be served to a client
device that requested the code. At 108, that code is executed at
the client device, such as using a web browser, and such execution
generates the initial value 108 or a value that is equivalent to
the initial value. In subsequent servings of the code, the value
"T" may be resolved into very different lines of code and
expressions.
[0034] In this manner, then, the process shown here is able to
replace original code with different code that serves as a proxy
for the original code, and that reaches the same result as the
original code when it is executed by the standard environment
(e.g., standard JavaScript run-time) on a client device.
[0035] FIG. 1A depicts an overview of a system 100 for encoding web
content served from a web server 122 to a polymorphic encoding
system 124 (or simply, encoding system) and to a web browser 126.
In general, the system 100 represents a high-level depiction of the
system in FIG. 1.
[0036] The polymorphic encoding system 124 receives web content
from a web server 122 that is to be served to a web browser 126 at,
for example, a client device. Prior to serving the web content to
the web browser 126, the polymorphic encoding system 124 identifies
and encodes potentially sensitive data. Web content that is handled
by the system 100 may include, for example, HTML, CSS, JavaScript,
and other program code associated with the content or transmission
of web resources such as a web page that may be presented at a
client computer (or many different requesting client
computers).
[0037] FIG. 1B depicts various parts of the encoding system 124 of
FIG. 1A. In general, these components operate to transform incoming
computer code so as to convert values or expressions into multiple
additional expressions that resolve to the original values or
expressions when they are executed as part of the code.
[0038] In the figure, a sensitive data identifier 110 parses code
to identify sensitive data or potentially sensitive data, including
data that can be recoded without affecting the functionality of the
code when it is executed. In some instances, data identifier 110
may broadly identify data that is to be replaced, regardless of
whether the data is identified as sensitive in nature. In this
example, program code P may comprise statements S1, S2, S3, and S4.
In this example, the sensitive data identifier 110 identifies
statement S1 as potentially sensitive data.
[0039] Various methods may be used for identifying potentially
sensitive data. For example, data associated with a form to be
filled out or with particular fields or fieldnames in a form may be
identified. Also, an operator of a security system may study the
code served by a particular organization and may flag particular
fields or other elements that are frequently served by the
organization and are of a sensitive nature. The sensitive field
identifier 110 may then use a list of fields or other information
generated by such an analysis to locate sensitive fields in other
pages of web code to be served by the same organization.
[0040] The sensitive data from the web server may be typically
presented in cleartext form. A replacement code generator 112
generates code that replaces such potentially sensitive data. The
generated code, when executed, generates the same output as the
originally-identified potentially sensitive code. In this example,
replacement code generator 112 generates four statements E1, E2,
E3, and E4 that, when executed, produce the same output as
statement S1. Interleaver 114 takes the replacement code statements
E1, E2, E3, and E4, and interleaves the replacement code statements
into other programmatic statements that are already part of program
P, or statements that have been generated as replacement code for
other statements in the code. The interleaving process may be
random (though avoiding any placement that would break the code)
and may result in a different ordering of statements in response to
two different requests. The resulting program with the interleaved
statements, when executed, produces the same functional output as
program P.
[0041] The data transferred from the encoding system 124 to the web
browser 126 may be, for example, in the form of obfuscated
JavaScript code with the sensitive data hidden within the code.
Specific example methods for encoding the sensitive data are
described below with respect to FIGS. 3A-3G. When the sensitive
data passes through the encoding system 124, the encoding system
124 identifies and extracts the sensitive data and then modifies
the code. The modified code is then incorporated in the original
web content, replacing the sensitive data.
[0042] FIG. 2 depicts an example of how program code P 202 may be
modified, or encoded, into program code P' 206. In general, the
illustrated process involves identifying a number of operations or
statements that may be joined together and transformed into code
that, when executed under a standard programming environment (e.g.,
a standard run-time implementation), will produce an original
starting value or expression.
[0043] While the code of program P 202 and program P' 206 are not
identical, the output of each of program P 202 and program P' 206,
when executed (e.g., via a web browser), are the same. Program P
202 represents any appropriate web content, such as HTML, CSS,
JavaScript, and other program code. Program P 202 comprises a set
of n statements, {S1, S2, S3, . . . , Sn}. The statement Si in the
set of statements may be potentially sensitive data or content that
is confirmed to be sensitive in nature. In some instances, the
statement Si in the set of statements may include statements that
are identified as needing to be replaced. Each statement, Si, may
be a line of code or expression in the program. In Step 1, each of
the statements, Si, is rewritten as a set of statements {Si1, Si2,
Si3, Si4 . . . } that, collectively, is executed as the equivalent
of the individual statement Si, as described in further detail
below with respect to FIGS. 3A-3F. In this manner, after Step 1 is
complete for each statement, Si, in Program P 202, a set of
equivalent statements E 204 for Program P 202 is generated. That
is, the set of equivalent statements E 204 comprises n sets of
equivalent statements for each statement Si, in Program P 202. For
example, the statement Si is replaced with the set of equivalent
statements {S11, S12, S13, S14 . . . }. The number of statements in
each set of equivalent statements need not be the same. Then, in
Step 2, the various statements in the set of equivalent statements
E 204 are interleaved, as described below with respect to FIG.
3G.
[0044] FIGS. 3A-3F show examples of equivalent statement
replacement. In general, the figures show manners in which a single
line of code for expressing a variable-assigning and/or
mathematical relationship can be expressed instead by multiple
lines of code that can be executed in a particular order to reach
the initial result. Although numeric functions are shown in the
examples, here, other data may be similarly treated. For example,
an alphanumeric string may be transformed through multiple
operations, so that the starting point is a string different than
what the web server system provided, but that ends up in generating
the same string when the code is executed by a web browser.
[0045] Referring to FIG. 3A, a constant number in Javascript can be
replaced by an equivalent Javascript expression. There exist
numerous ways to replace a constant number. For example, the number
1 can be written as (3-2) or as (0+1), and the number 24 can be
written as the expression (4*6) or (30-6). To generate essentially
random expressions for number y, the system can first use a random
generator to generate a random number, for example, x, and then
replace the number y with (x-(x-y)), which appears in the code to
be different than y but is functional equivalent of y when
executed. FIG. 3A shows an example of this equivalent statement
replacement where the statement "var y=2" is replaced with the set
of statements {var a=10; var b=8; y=a-b}. While FIG. 3A shows a sum
(or subtraction) operation, generally, any appropriate type of
JavaScript operation (e.g., sum, multiply, divide) or function that
returns a number (e.g., String.length( ), Array.length( )) may be
used. Other types of constants, such as Boolean, string, array, and
object, can be replaced with equivalent statements using a similar
approach.
[0046] FIG. 3B shows an example of an equivalent statement
replacement of a Boolean operation, as one such example. Where the
initial statement "var y=true" sets the value of variable y as
"true," the set of equivalent statements comprises a set of three
statements, which, when executed, equivalently result in the
variable y being set as "true." In this example, the first two
statements assign the values 3 and 2 to variables a and b,
respectively. In doing so, the value of a is assigned to be greater
than the value of b. Therefore, the statement "y=(a>b)" will
always result in the value of y being set to "true." Notably, there
exists a near infinite number of ways to create a set of statements
(with any number of statements) that result in the value of y being
assigned a value of "true." For instance, variables a and b can be
assigned to any values as long as the value of a is larger than the
value of b. Alternatively, other Boolean expressions can be
used.
[0047] FIG. 3C shows an example of an equivalent statement
replacement of a string constant. In the example, the statement
"var y=`abc`" is replaced with an equivalent set of statements
comprising three statements. Collectively, when the equivalent set
of statements is executed, the variable y is set as "abc". As with
the examples discussed with respect to FIGS. 3A and 3B, an nearly
infinite number of combinations exist to replace the initial
statement. In other implementations, a string or the characters in
a string may be assigned numeric values, and the operations
performed on the numeric examples in the figures above and below
may be applied, and then the resulting numeric value or values may
be converted back into alphanumeric characters for a string. For
example, the letter "a" may be assigned a value of 256 in a
particular font definition, and the techniques discussed here may
be used to break the value of 256 up into a plurality of
expressions. When those expressions are executed at the client
device, the number 256 may be returned, and then may be rendered as
a glyph for the character set, as an "a."
[0048] Another method of equivalent statement replacement involves
adding junk code or junk branches, and may be applied as an
alternative or additionally to the other examples discussed here.
The purpose of adding the junk code is to add "noise" to the code
so that potential hackers or attackers cannot use the position of
expressions in the code (e.g, line number or the nth statement) to
locate a key function or variable. Junk code may be one or more
statements that execute but have no effect on the execution of the
rest of the program or the operation of the program. For instance,
two simple assignment statements "j=4" and "k=3+j" may be a part of
the set of statements that the replacement code generator creates.
However, variables j and k not be present anywhere else in the
program code, so that while the new code causes j to be assigned
the value of 4 and k to be assigned the value of 7, variables j and
k are not used anywhere else in the code and do not otherwise
affect the operation or execution of the program code.
[0049] Alternatively, junk branches can be generated to add a level
of obfuscation to the code. FIG. 3D shows an example of adding a
junk branch to the statement "var y=2". Because the conditional
statement "if (3<2)" is always false, junk branch "y=1" will
never execute (e.g., the assignment of the value of 1 to y will
never occur). The junk code or junk branches make it difficult for
an attacker program to discern sensitive data from junk code or
junk branches without more carefully parsing or analyzing the web
content.
[0050] FIG. 3E shows an example of permutations of statements for a
scenario in which equivalent statements do not require a strict
order. For example, the statement "var y=[1, 2, 3]" creates an
array with three elements. The collectively equivalent four
statements "var y=[ ]", "y[1]=2", "y[2]=3", "y[0]=1" create the
same array y regardless of the order that the latter three
statements are executed. Where the order of the code does not
matter, a larger number of potential random ways exist to rewrite
the code. Specifically, for N such statements for which order does
not matter, there are N! possible permutations. In the example
shown in FIG. 3E, because there are three statements where the
order is irrelevant, there are six possible ways to generate
equivalent code in this manner. Permutation of statements may be
used on an array, list string, or other collection data
structure.
[0051] The encoding system may further employ recursive encoding.
FIG. 3F illustrates an example of random recursive encoding where a
constant is replaced with a random expression and then a junk
branch is then added to one replacement statement. Specifically,
first, a single statement "var y=2" is replaced with three separate
statements. Then, one of the three statements is then replaced with
other statements that add a junk branch, similar to the example
shown in FIG. 3D. Additional recursive encoding may be employed.
After applying random basic polymorphic encoding approaches a
random number of times, a simple assignment statement, such as "var
y=2" can be transformed into hundreds of lines of code.
[0052] FIGS. 3A-3F illustrated various methods of producing
equivalent statements 204. After performing such methods, an
encoded program P' 206 can be generated by interleaving the
equivalent statements E 204 with the rest of the code, as shown,
for example, in FIG. 3G (and potentially identifying which of the
statements can be included in either order relative to other of the
statements). In FIG. 3G, two separate statements 372 and 374--"var
x=2" and "var y=3"--are part of web content, for example, program
code P 202. In a first step, a set of replacement statements 376
are generated for statement 372 and a set of replacement statements
378 are generated for statement 374. Then, in a second step, the
individual expressions of the set of replacement statements 376 are
interleaved with the individual expressions of the set of
replacement statements 378 to form an encoded form of the original
web content 380. FIG. 3G shows an example where the order of the
statements in each of the sets of replacement statements 376, 378
matter (i.e., affect the outcome of the executed code), but the
order of the statements between the two sets of replacement
statements 376, 378 does not matter.
[0053] FIG. 4 is a flow diagram of a process for serving modified
program code. In general, the process involves identifying items in
content to be served to a client computer that may potentially
include sensitive data, transforming the data dynamically and
randomly into a set of other data, and incorporating the set of
other data into the content in a manner so as to hide the
potentially sensitive data.
[0054] The process begins at box 402, where a request for web
content is received, such as from a client computer operated by an
individual seeking to perform a banking transaction at a website
for the individual's bank. The request may be in the form of an
HTTP request and may be received by a load balancer operated by, or
for, the bank. The load balancer may recognize the form of the
request and understand that it is to be handled by a security
system that the bank has installed to operate along with its web
server system. The load balancer may thus provide the request to
the security system, which may forward it to the web server system
after analyzing the request (e.g., to open a tracking session based
on the request), or may provide the request to the web server
system and also provide information about the request to the
security system in parallel.
[0055] At box 404, a response to the request is generated by the
web server system. For example, the user may have requested to
perform a funds transfer between accounts at the bank, where the
funds are owned by the individual, and the response by the web
server system may include HTML for a webpage on which the user can
specify parameters for the transaction, along with JavaScript code
and CSS code for carrying out such transactions at a web browser
operated by the individual.
[0056] At box 406, the web server system sends the response to the
request to an encoding system. The response may comprise the web
content requested by the client computer. Included in the response
may be potentially sensitive data, such as, for example, or account
numbers, routing numbers, or other data relating to a banking
transaction. At box 408, the encoding system receives the web
content from the web server system and identifies potentially
sensitive data in the web content.
[0057] At box 410, the encoding system generates code to replace
the sensitive data. The sensitive data may be written as a set of
replacement statements, which, when executed, are displayed the
same as the sensitive data, resulting in no difference in
appearance to a user requesting the web content. Various methods
for rewriting or replacing the sensitive data are possible,
including the methods described above with respect to FIGS. 3A-3F.
The replacement of sensitive data may include replacing a single
statement or expression in the web content, or it may include
replacing numerous statements. At a minimum, however, a single
statement, or expression, is replaced with a set of equivalent
statements. The set equivalent statements may comprise one or more
statements, which, when collectively executed, output the same
result as the initial statement comprising sensitive data.
[0058] In some instances, the encoding system may identify a single
statement assigning a constant value to contain sensitive data. In
response, the encoding system may randomly generate a set of
equivalent statements, which, collectively, make the same
assignment, as illustrated, for example, in FIG. 3A. In other
instances, the encoding system may identify a single statement
containing sensitive data. In response, the encoding system may add
one or more lines of junk code or junk branches. The purpose of the
junk code is to add a layer of randomness to the code to prevent
potential hackers from using the position (e.g., line number) of
code to identify potentially sensitive data. When executed, the
junk code has no visible effect on the displayed web content.
Similarly, the encoding system may generate junk branches that
appear to supplement the original statement or expression in the
code. In some instances, the junk branches may comprise conditional
statements or expressions that will never execute. An example of
generating a junk branch is discussed above with respect to FIG.
3D. In that example, the conditional statement "if (3<2)" will
never be true, so the assignment statement "y=1" will not occur and
instead, the value 2 will always be assigned to y. Adding junk
branches adds an additional level of obfuscation to the code that
hampers a potential attacker's ability to target sensitive
data.
[0059] In some instances, the encoding system may employ recursive
coding, generating multiple "layers" of replacement code. An
example of recursive coding is shown, for example, in FIG. 3F. In a
first step, an assignment statement is replaced with three separate
statements. In a second step, a junk branch is added to one of the
three replacement statements. While the example shown in FIG. 3F
shows only two "layers" of replacement code, any number of "layers"
of replacement code may be generated.
[0060] After the encoding system generates replacement code, the
method moves to box 412 where the various replacement statements
are interleaved in the code of the web content. An example of the
interleaving process is described above with respect to FIG. 3G. In
that example, the encoder system first generates two sets of
replacement code 376 and 378 in response to two separate input
statements, "var x=2" and "var y=3", respectively. Then the
individual statements of the two sets of replacement code 376 and
378 are interleaved. Each of the two sets of replacement code 376
and 378 has a particular ordering of the statements. In some
instances, the ordering of the individual statements affects the
execution of the code, while in other instances, the ordering does
not affect the outcome. For example, in the set 376, statements
"var a=10" and "var b=8" can be executed in any order with respect
to one another but must be executed before the statement "x=a-b" is
executed. Where the order of the statements is irrelevant, more
variations of interleaved code are possible.
[0061] In some instances, the encoding system randomly and
dynamically generates code to replace the sensitive data. That is,
given the same input code (i.e., web content), the encoding system
does not necessarily generate the same replacement code in response
to two different requests for the web content. Furthermore, the
approach for generating the replacement code may be different in
response to two requests for the same web content. For example, in
response to one request, the encoder system may replace a first
statement with a set of three replacement statements that
collectively result in the same result as the first statement, such
as the example shown in FIG. 3A. In response to a second request
for the same web content, the encoder system may replace the same
first statement with a set of three different replacement
statements that include a junk branch, such as the example shown in
FIG. 3D. In both examples, the first statement to be replaced
(presumably containing potentially sensitive data) is "var y=2",
but the encoder system generates two different sets of replacement
statements. In another example, the encoder may generate the same
two sets of replacements statements in response to a first
statement (e.g., "var y=2"), such as the replacement statements
shown in FIG. 3A, but it may then interleave the code in a
different order so that the resulting web code produced in response
to the two requests are identical.
[0062] The process then serves the recoded web content at box 414,
in familiar manners. Such a process may be performed repeatedly
each time a client computer requests content, with the recoded
content being different each time the content is served through the
encoding system, including when identical or nearly identical
content is requested in separate transactions by two different
users or by the same user.
[0063] In addition, the code that is served by the encoding system
may be supplemented with instrumentation code that runs on the
computer browser and monitors interaction with the web page. For
example, the instrumentation code may look for particular method
calls or other calls to be made, such as when the calls or actions
relate to a field in a form that is deemed to be subject to
malicious activity, such as a client ID number field, a transaction
account number field, or a transaction amount field. When the
instrumentation code observes such activity on the client device,
it will report that activity along with metadata that helps to
characterize the activity, the process receives such reports from
the instrumentation code and processes them, such as by forwarding
them to a central security system that may analyze them to
determine whether such activity is benign or malicious.
[0064] FIG. 5 shows a system 500 for serving polymorphic and
instrumented code. Generally, polymorphic code is code that is
changed in different manners for different servings of the code, in
manners that do not affect the way in which the executed code is
perceived by users. The goal is to create a moving target for
malware that tries to determine how the code operates, but without
changing the user experience. Instrumented code is code that is
served, e.g., to a browser, with the main functional code and
monitors how the functional code operates on a client device, and
how other code may interact with the functional code and other
activities on the client device. In certain implementations, the
system 500 may identify values or expressions in the code that can
be replaced with multiple other expressions that, when executed on
a client device, resolve to the initial value or expressions.
[0065] The system 500 may be adapted to perform deflection and
detection of malicious activity with respect to a web server
system. Deflection may occur, for example, by the serving of
polymorphic code, which interferes with the ability of malware to
interact effectively with the code that is served. Detection may
occur, for example, by adding instrumentation code (including
injected code for a security service provider) that monitors
activity of client devices that are served web code.
[0066] The system 500 in this example is a system that is operated
by or for a large number of different businesses that serve web
pages and other content over the internet, such as banks and
retailers that have on-line presences (e.g., on-line stores, or
on-line account management tools). The main server systems operated
by those organizations or their agents are designated as web
servers 504a-504n, and could include a broad array of web servers,
content servers, database servers, financial servers, load
balancers, and other necessary components (either as physical or
virtual servers).
[0067] In this example, security server systems 502a to 502n may
cause code from the web server system to be supplemented and
altered. In one example of the supplementation, code may be
provided, either by the web server system itself as part of the
originally-served code, or by another mechanism after the code is
initially served, such as by the security server systems 502a to
502n, where the supplementing code causes client devices to which
the code is served to transmit data that characterizes the client
devices and the use of the client devices. As also described below,
other actions may be taken by the supplementing code, such as the
code reporting actual malware activity or other anomalous activity
at the client devices that can then be analyzed to determine
whether the activity is malware activity.
[0068] The set of security server systems 502a to 502n is shown
connected between the web servers 504a to 504n and a network 510
such as the internet. Although both extend to n in number, the
actual number of sub-systems could vary. For example, certain of
the customers could install two separate security server systems to
serve all of their web server systems (which could be one or more),
such as for redundancy purposes. The particular security server
systems 502a-502n may be matched to particular ones of the web
server systems 504a-504n, or they may be at separate sites, and all
of the web servers for various different customers may be provided
with services by a single common set of security servers 502a-502n
(e.g., when all of the server systems are at a single co-location
facility so that bandwidth issues are minimized).
[0069] Each of the security server systems 502a-502n may be
arranged and programmed to carry out operations like those
discussed above and below and other operations. For example, a
policy engine 520 in each such security server system may evaluate
HTTP requests from client computers (e.g., desktop, laptop, tablet,
and smartphone computers) based on header and network information,
and can set and store session information related to a relevant
policy. The policy engine may be programmed to classify requests
and correlate them to particular actions to be taken to code
returned by the web server systems before such code is served back
to a client computer. When such code returns, the policy
information may be provided to a decode, analysis, and re-encode
module, which matches the content to be delivered, across multiple
content types (e.g., HTML, JavaScript, and CSS), to actions to be
taken on the content (e.g., using XPATH within a DOM), such as
substitutions, addition of content, and other actions that may be
provided as extensions to the system. For example, the different
types of content may be analyzed to determine naming that may
extend across such different pieces of content (e.g., the name of a
function or parameter), and such names may be changed in a way that
differs each time the content is served, e.g., by replacing a named
item with randomly-generated characters. Elements within the
different types of content may also first be grouped as having a
common effect on the operation of the code (e.g., if one element
makes a call to another), and then may be re-encoded together in a
common manner so that their interoperation with each other will be
consistent even after the re-encoding.
[0070] Both the analysis of content for determining which
transformations to apply to the content, and the transformation of
the content itself, may occur at the same time (after receiving a
request for the content) or at different times. For example, the
analysis may be triggered, not by a request for the content, but by
a separate determination that the content newly exists or has been
changed. Such a determination may be via a "push" from the web
server system reporting that it has implemented new or updated
content. The determination may also be a "pull" from the security
servers 502a-502n, such as by the security servers 502a-502n
implementing a web crawler (not shown) to recursively search for
new and changed content and to report such occurrences to the
security servers 502a-502n, and perhaps return the content itself
and perhaps perform some processing on the content (e.g., indexing
it or otherwise identifying common terms throughout the content,
creating DOMs for it, etc.). The analysis to identify portions of
the content that should be subjected to polymorphic modifications
each time the content is served may then be performed according to
the manner discussed above and below.
[0071] A rules engine 522 may store analytical rules for performing
such analysis and for re-encoding of the content. The rules engine
522 may be populated with rules developed through operator
observation of particular content types, such as by operators of a
system studying typical web pages that call JavaScript content and
recognizing that a particular method is frequently used in a
particular manner. Such observation may result in the rules engine
522 being programmed to identify the method and calls to the method
so that they can all be grouped and re-encoded in a consistent and
coordinated manner.
[0072] The decode, analysis, and re-encode module 524 encodes
content being passed to client computers from a web server
according to relevant policies and rules. The module 524 also
reverse encodes requests from the client computers to the relevant
web server or servers. For example, a web page may be served with a
particular parameter, and may refer to JavaScript that references
that same parameter. The decode, analysis, and re-encode module 524
may replace the name of that parameter, in each of the different
types of content, with a randomly generated name, and each time the
web page is served (or at least in varying sessions), the generated
name may be different. When the name of the parameter is passed
back to the web server, it may be re-encoded back to its original
name so that this portion of the security process may occur
seamlessly for the web server.
[0073] A key for the function that encodes and decodes such strings
can be maintained by the security server system 502 along with an
identifier for the particular client computer so that the system
502 may know which key or function to apply, and may otherwise
maintain a state for the client computer and its session. A
stateless approach may also be employed, whereby the system 502
encrypts the state and stores it in a cookie that is saved at the
relevant client computer. The client computer may then pass that
cookie data back when it passes the information that needs to be
decoded back to its original status. With the cookie data, the
system 502 may use a private key to decrypt the state information
and use that state information in real-time to decode the
information from the client computer. Such a stateless
implementation may create benefits such as less management overhead
for the server system 502 (e.g., for tracking state, for storing
state, and for performing clean-up of stored state information as
sessions time out or otherwise end) and as a result, higher overall
throughput.
[0074] The decode, analysis, and re-encode module 524 and the
security server system 502 may be configured to modify web code
differently each time it is served in a manner that is generally
imperceptible to a user who interacts with such web code. For
example, multiple different client computers may request a common
web resource such as a web page or web application that a web
server provides in response to the multiple requests in
substantially the same manner. Thus, a common web page may be
requested from a web server, and the web server may respond by
serving the same or substantially identical HTML, CSS, JavaScript,
images, and other web code or files to each of the clients in
satisfaction of the requests. In some instances, particular
portions of requested web resources may be common among multiple
requests, while other portions may be client or session specific.
The decode, analysis, and re-encode module 524 may be adapted to
apply different modifications to each instance of a common web
resource, or common portion of a web resource, such that the web
code that it is ultimately delivered to the client computers in
response to each request for the common web resource includes
different modifications.
[0075] In certain implementations, the analysis can happen a single
time for a plurality of servings of the code in different recoded
instances. For example, the analysis may identify a particular
function name and all of the locations it occurs throughout the
relevant code, and may create a map to each such occurrence in the
code. Subsequently, when the web content is called to be served,
the map can be consulted and random strings may be inserted in a
coordinated matter across the code, though the generation of a new
name each time for the function name and the replacement of that
name into the code, will require much less computing cost than
would full re-analysis of the content. Also, when a page is to be
served, it can be analyzed to determine which portions, if any,
have changed since the last analysis, and subsequent analysis may
be performed only on the portions of the code that have
changed.
[0076] Even where different modifications are applied in responding
to multiple requests for a common web resource, the security server
system 502 can apply the modifications in a manner that does not
substantially affect a way that the user interacts with the
resource, regardless of the different transformations applied. For
example, when two different client computers request a common web
page, the security server system 502 applies different
modifications to the web code corresponding to the web page in
response to each request for the web page, but the modifications do
not substantially affect a presentation of the web page between the
two different client computers. The modifications can therefore be
made largely transparent to users interacting with a common web
resource so that the modifications do not cause a substantial
difference in the way the resource is displayed or the way the user
interacts with the resource on different client devices or in
different sessions in which the resource is requested.
[0077] An instrumentation module 526 is programmed to add
instrumentation code to the content that is served from a web
server. The instrumentation code is code that is programmed to
monitor the operation of other code that is served. For example,
the instrumentation code may be programmed to identify when certain
methods are called, when those methods have been identified as
likely to be called by malicious software. When such actions are
observed to occur by the instrumentation code, the instrumentation
code may be programmed to send a communication to the security
server reporting on the type of action that occurred and other meta
data that is helpful in characterizing the activity. Such
information can be used to help determine whether the action was
malicious or benign.
[0078] The instrumentation code may also analyze the DOM on a
client computer in predetermined manners that are likely to
identify the presence of and operation of malicious software, and
to report to the security servers 502 or a related system. For
example, the instrumentation code may be programmed to characterize
a portion of the DOM when a user takes a particular action, such as
clicking on a particular on-page button, so as to identify a change
in the DOM before and after the click (where the click is expected
to cause a particular change to the DOM if there is benign code
operating with respect to the click, as opposed to malicious code
operating with respect to the click). Data that characterizes the
DOM may also be hashed, either at the client computer or the server
system 502, to produce a representation of the DOM (e.g., in the
differences between part of the DOM before and after a defined
action occurs) that is easy to compare against corresponding
representations of DOMs from other client computers. Other
techniques may also be used by the instrumentation code to generate
a compact representation of the DOM or other structure expected to
be affected by malicious code in an identifiable manner.
[0079] As noted, the content from web servers 504a-504n, as encoded
by decode, analysis, and re-encode module 524, may be rendered on
web browsers of various client computers. Uninfected client
computers 513A-512n represent computers that do not have malicious
code programmed to interfere with a particular site a user visits
or to otherwise perform malicious activity. Infected client
computers 514a-514n represent computers that do have malware or
malicious code (518a-518n, respectively) programmed to interfere
with a particular site a user visits or to otherwise perform
malicious activity. In certain implementations, the client
computers 513A-512n, 514a-514n may also store the encrypted cookies
discussed above and pass such cookies back through the network 510.
The client computers 512A-512n, 514a-514n will, once they obtain
the served content, implement DOMs for managing the displayed web
pages, and instrumentation code may monitor the respective DOMs as
discussed above. Reports of illogical activity (e.g., software on
the client device calling a method that does not exist in the
downloaded and rendered content) can then be reported back to the
server system.
[0080] The reports from the instrumentation code may be analyzed
and processed in various manners in order to determine how to
respond to particular abnormal events, and to track down malicious
code via analysis of multiple different similar interactions across
different client computers 512A-512n, 514a-514n. For small-scale
analysis, each web site operator may be provided with a single
security console 507 that provides analytical tools for a single
site or group of sites. For example, the console 507 may include
software for showing groups of abnormal activities, or reports that
indicate the type of code served by the web site that generates the
most abnormal activity. For example, a security officer for a bank
may determine that defensive actions are needed if most of the
reported abnormal activity for its web site relates to content
elements corresponding to money transfer operations-an indication
that stale malicious code may be trying to access such elements
surreptitiously.
[0081] Console 507 may also be multiple different consoles used by
different employees of an operator of the system 500, and may be
used for pre-analysis of web content before it is served, as part
of determining how best to apply polymorphic transformations to the
web code. For example, in combined manual and automatic analysis
like that described above, an operator at console 507 may form or
apply rules 522 that guide the transformation that is to be
performed on the content when it is ultimately served. The rules
may be written explicitly by the operator or may be provided by
automatic analysis and approved by the operator. Alternatively, or
in addition, the operator may perform actions in a graphical user
interface (e.g., by selecting particular elements from the code by
highlighting them with a pointer, and then selecting an operation
from a menu of operations) and rules may be written consistent with
those actions.
[0082] A central security console 508 may connect to a large number
of web content providers, and may be run, for example, by an
organization that provides the software for operating the security
server systems 502A-502n. Such console 508 may access complex
analytical and data analysis tools, such as tools that identify
clustering of abnormal activities across thousands of client
computers and sessions, so that an operator of the console 508 can
focus on those clusters in order to diagnose them as malicious or
benign, and then take steps to thwart any malicious activity.
[0083] In certain other implementations, the console 508 may have
access to software for analyzing telemetry data received from a
very large number of client computers that execute instrumentation
code provided by the system 500. Such data may result from forms
being re-written across a large number of web pages and web sites
to include content that collects system information such as browser
version, installed plug-ins, screen resolution, window size and
position, operating system, network information, and the like. In
addition, user interaction with served content may be characterized
by such code, such as the speed with which a user interacts with a
page, the path of a pointer over the page, and the like.
[0084] Such collected telemetry data, across many thousands of
sessions and client devices, may be used by the console 508 to
identify what is "natural" interaction with a particular page that
is likely the result of legitimate human actions, and what is
"unnatural" interaction that is likely the result of a bot
interacting with the content. Statistical and machine learning
methods may be used to identify patterns in such telemetry data,
and to resolve bot candidates to particular client computers. Such
client computers may then be handled in special manners by the
system 500, may be blocked from interaction, or may have their
operators notified that their computer is potentially running
malicious software (e.g., by sending an e-mail to an account holder
of a computer so that the malicious software cannot intercept it
easily).
[0085] FIG. 6 is a schematic diagram of a general computing system
600. The system 600 can be used for the operations described in
association with any of the computer-implement methods described
previously, according to one implementation. The system 600 is
intended to include various forms of digital computers, such as
laptops, desktops, workstations, personal digital assistants,
servers, blade servers, mainframes, and other appropriate
computers. The system 600 can also include mobile devices, such as
personal digital assistants, cellular telephones, smartphones, and
other similar computing devices. Additionally the system can
include portable storage media, such as, Universal Serial Bus (USB)
flash drives. For example, the USB flash drives may store operating
systems and other applications. The USB flash drives can include
input/output components, such as a wireless transmitter or USB
connector that may be inserted into a USB port of another computing
device.
[0086] The system 600 includes a processor 610, a memory 620, a
storage device 630, and an input/output device 640. Each of the
components 610, 620, 630, and 640 are interconnected using a system
bus 650. The processor 610 is capable of processing instructions
for execution within the system 600. The processor may be designed
using any of a number of architectures. For example, the processor
610 may be a CISC (Complex Instruction Set Computers) processor, a
RISC (Reduced Instruction Set Computer) processor, or a MISC
(Minimal Instruction Set Computer) processor.
[0087] In one implementation, the processor 610 is a
single-threaded processor. In another implementation, the processor
610 is a multi-threaded processor. The processor 610 is capable of
processing instructions stored in the memory 620 or on the storage
device 630 to display graphical information for a user interface on
the input/output device 640.
[0088] The memory 620 stores information within the system 600. In
one implementation, the memory 620 is a computer-readable medium.
In one implementation, the memory 620 is a volatile memory unit. In
another implementation, the memory 620 is a non-volatile memory
unit.
[0089] The storage device 630 is capable of providing mass storage
for the system 600. In one implementation, the storage device 630
is a computer-readable medium. In various different
implementations, the storage device 630 may be a floppy disk
device, a hard disk device, an optical disk device, or a tape
device.
[0090] The input/output device 640 provides input/output operations
for the system 600. In one implementation, the input/output device
640 includes a keyboard and/or pointing device. In another
implementation, the input/output device 640 includes a display unit
for displaying graphical user interfaces.
[0091] The features described can be implemented in digital
electronic circuitry, or in computer hardware, firmware, software,
or in combinations of them. The apparatus can be implemented in a
computer program product tangibly embodied in an information
carrier, e.g., in a machine-readable storage device for execution
by a programmable processor; and method steps can be performed by a
programmable processor executing a program of instructions to
perform functions of the described implementations by operating on
input data and generating output. The described features can be
implemented advantageously in one or more computer programs that
are executable on a programmable system including at least one
programmable processor coupled to receive data and instructions
from, and to transmit data and instructions to, a data storage
system, at least one input device, and at least one output device.
A computer program is a set of instructions that can be used,
directly or indirectly, in a computer to perform a certain activity
or bring about a certain result. A computer program can be written
in any form of programming language, including compiled or
interpreted languages, and it can be deployed in any form,
including as a stand-alone program or as a module, component,
subroutine, or other unit suitable for use in a computing
environment.
[0092] Suitable processors for the execution of a program of
instructions include, by way of example, both general and special
purpose microprocessors, and the sole processor or one of multiple
processors of any kind of computer. Generally, a processor will
receive instructions and data from a read-only memory or a random
access memory or both. The essential elements of a computer are a
processor for executing instructions and one or more memories for
storing instructions and data. Generally, a computer will also
include, or be operatively coupled to communicate with, one or more
mass storage devices for storing data files; such devices include
magnetic disks, such as internal hard disks and removable disks;
magneto-optical disks; and optical disks. Storage devices suitable
for tangibly embodying computer program instructions and data
include all forms of non-volatile memory, including by way of
example semiconductor memory devices, such as EPROM, EEPROM, and
flash memory devices; magnetic disks such as internal hard disks
and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM
disks. The processor and the memory can be supplemented by, or
incorporated in, ASICs (application-specific integrated
circuits).
[0093] To provide for interaction with a user, the features can be
implemented on a computer having a display device such as a CRT
(cathode ray tube) or LCD (liquid crystal display) monitor for
displaying information to the user and a keyboard and a pointing
device such as a mouse or a trackball by which the user can provide
input to the computer. Additionally, such activities can be
implemented via touchscreen flat-panel displays and other
appropriate mechanisms.
[0094] The features can be implemented in a computer system that
includes a back-end component, such as a data server, or that
includes a middleware component, such as an application server or
an Internet server, or that includes a front-end component, such as
a client computer having a graphical user interface or an Internet
browser, or any combination of them. The components of the system
can be connected by any form or medium of digital data
communication such as a communication network. Examples of
communication networks include a local area network ("LAN"), a wide
area network ("WAN"), peer-to-peer networks (having ad-hoc or
static members), grid computing infrastructures, and the
Internet.
[0095] The computer system can include clients and servers. A
client and server are generally remote from each other and
typically interact through a network, such as the described one.
The relationship of client and server arises by virtue of computer
programs running on the respective computers and having a
client-server relationship to each other.
[0096] While this specification contains many specific
implementation details, these should not be construed as
limitations on the scope of any inventions or of what may be
claimed, but rather as descriptions of features specific to
particular implementations of particular inventions. Certain
features that are described in this specification in the context of
separate implementations can also be implemented in combination in
a single implementation. Conversely, various features that are
described in the context of a single implementation can also be
implemented in multiple implementations separately or in any
suitable subcombination. Moreover, although features may be
described above as acting in certain combinations and even
initially claimed as such, one or more features from a claimed
combination can in some cases be excised from the combination, and
the claimed combination may be directed to a subcombination or
variation of a subcombination.
[0097] Similarly, while operations are depicted in the drawings in
a particular order, this should not be understood as requiring that
such operations be performed in the particular order shown or in
sequential order, or that all illustrated operations be performed,
to achieve desirable results. In certain circumstances,
multitasking and parallel processing may be advantageous. Moreover,
the separation of various system components in the implementations
described above should not be understood as requiring such
separation in all implementations, and it should be understood that
the described program components and systems can generally be
integrated together in a single software product or packaged into
multiple software products.
[0098] Thus, particular implementations of the subject matter have
been described. Other implementations are within the scope of the
following claims. In some cases, the actions recited in the claims
can be performed in a different order and still achieve desirable
results. In addition, the processes depicted in the accompanying
figures do not necessarily require the particular order shown, or
sequential order, to achieve desirable results. In certain
implementations, multitasking and parallel processing may be
advantageous. In some implementations, the subject matter may be
embodied as methods, systems, devices, and/or as an article or
computer program product. The article or computer program product
may comprise one or more computer-readable media or
computer-readable storage devices, which may be tangible and
non-transitory, that include instructions that may be executable by
one or more machines such as computer processors.
* * * * *
References