DETECTING AND REMOVING INJECTED ELEMENTS FROM CONTENT INTERFACES

• US 20180219910A1
• Filed: 07/31/2015
• Published: 08/02/2018
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: Namogoo Technologies Ltd.
• Original Assignee: Namogoo Technologies, Inc.
• Inventors: Greenshpan, Ohad, Katz, Chemi
• Granted Patent: US 10,554,682 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 30/0251 Targeted advertisements
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Systems and methods are disclosed for detecting and removing injected elements from content interfaces. In one implementation, a processing device receives a content interface from a content provider, processes the content interface to identify elements of the interface that may not have been received from the content provider, compares the content interface with corresponding reference interfaces to identify elements of the content interface that are not present in the reference interfaces, processes the identified elements to determine how the identified elements affect a rendering of the content interface on the device, and modifies a rendering of the content interface on the device based on the manner in which the identified elements affect the rendering of the content interface on the device.

Claims

1-32. -32. (canceled)

33. A method comprising:

receiving a content interface from a content provider;

processing the content interface as rendered on a device to identify one or more elements of the content interface as rendered on the device that was potentially not received from the content provider;

comparing, by a processing device, the content interface as rendered on the device with one or more corresponding reference interfaces to identify at least one of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces;

processing the at least one of the one or more elements of the content interface as rendered on the device that is not present in the one or more corresponding reference interfaces to determine a manner in which the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces affects a rendering of the content interface on the device; and

modifying a rendering of the content interface on the device based on the manner in which the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces affects the rendering of the content interface on the device.

34. The method of claim 33, wherein comparing the content interface comprises comparing the content interface as rendered on the device with one or more corresponding reference interfaces to identify at least one of the one or more elements of the content interface as rendered on the device that are capable of being injected by a third-party service into the content interface.

35. The method of claim 33, wherein comparing the content interface comprises comparing the content interface as rendered on the device with one or more corresponding reference interfaces to identify at least one of the one or more elements of the content interface as rendered on the device that are determined to have been previously injected into another content interface by a third-party service.

36. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that are not present in the one or more corresponding reference interfaces.

37. The method of claim 36, wherein comparing the content interface comprises comparing one or more attributes of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more attributes of one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that are not present in the one or more corresponding reference interfaces, wherein the one or more attributes of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service comprise at least one of:

a relative positioning of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service, a size of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service, or a shape of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service.

38. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that contain one or more source domains that are not included in a set of valid source domains.

39. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that are rendered after expiration of a time interval subsequent to a rendering of one or more other elements of the content interface.

40. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that overlay one or more elements of the content interface.

41. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that remove one or more elements of the content interface.

42. The method of claim 33, wherein comparing the content interface comprises comparing one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service with one or more elements from one or more corresponding reference interfaces to identify at least one of the one or more elements from the content interface as rendered on the device that are capable of being injected by a third-party service that remove one or more elements of the content interface after expiration of a time interval.

43. The method of claim 33, further comprising modifying one or more parameters of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces, wherein the one or more parameters comprise one or more coordinates pertaining to a relative orientation of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces within the content interface.

44. The method of claim 33, wherein modifying a rendering of the content interface on the device comprises removing one or more parameters of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces.

45. The method of claim 33, wherein modifying a rendering of the content interface on the device comprises removing the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces.

46. The method of claim 33, wherein modifying a rendering of the content interface on the device comprises:

generating one or more substitute elements based on the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces; and

replacing the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces with the one or more substitute elements.

47. The method of claim 33, wherein modifying a rendering of the content interface on the device comprises generating one or more elements that encapsulate the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces.

48. The method of claim 47, wherein the one or more elements that encapsulate the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces comprise an invisibility attribute.

49. The method of claim 33, wherein processing the at least one of the one or more elements comprises processing the at least one of the one or more elements of the content interface as rendered on the device that is not present in the one or more corresponding reference interfaces to determine whether the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces is listening for inputs to be provided in relation to the content interface.

50. The method of claim 49, wherein modifying a rendering of the content interface on the device comprises modifying the content interface to absorb the inputs prior to receipt of the inputs by the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces.

51. A system comprising:

a memory; and

a processing device, coupled to the memory, to;

receive a content interface from a content provider;

process the content interface as rendered on a device to identify one or more elements of the content interface as rendered on the device that was potentially not received from the content provider;

compare the content interface as rendered on the device with one or more corresponding reference interfaces to identify at least one of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces;

process the at least one of the one or more elements of the content interface as rendered on the device that is not present in the one or more corresponding reference interfaces to determine a manner in which the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces affects a rendering of the content interface on the device; and

modify a rendering of the content interface on the device based on the manner in which the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces affects the rendering of the content interface on the device.

52. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processing device, cause the processing device to:

receive, by the processing device, one or more first inputs from a first device;

receive a content interface from a content provider;

process the content interface as rendered on a device to identify one or more elements of the content interface as rendered on the device that was potentially not received from the content provider;

compare the content interface as rendered on the device with one or more corresponding reference interfaces to identify at least one of the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces;

process the at least one of the one or more elements of the content interface as rendered on the device that is not present in the one or more corresponding reference interfaces to determine a manner in which the one or more elements of the content interface as rendered on the device that are not present in the one or more corresponding reference interfaces affects a rendering of the content interface on the device; and