SYSTEMS AND METHODS FOR REMOTE DETECTION OF SOFTWARE THROUGH BROWSER WEBINJECTS

• US 20200134174A1
• Filed: 11/19/2019
• Published: 04/30/2020
• Est. Priority Date: 10/25/2018
• Status: Active Grant

• Current Assignee: BitSight Technologies, Inc.
• Original Assignee: BitSight Technologies, Inc.
• Inventors: Bagulho Monteiro Pereira, Tiago
• Granted Patent: US 10,776,483 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]

Abstract

Computer-implemented methods and systems are provided for the detection of software presence remotely through the web browser by detecting the presence of webinjects in a web browser that visits a detection webpage. The methods can include delivering a detection webpage to a web browser, in which the detection webpage has detection code configured to detect a presence of the webinject in the detection webpage; and inspecting, by the detection code, rendering of content of the detection webpage in the browser to detect webinject content in the detection webpage by the webinject, the webinject content including one or more Hypertext Markup Language (HTML) components. The method can further include, if webinject content is detected, generating a fingerprint for each of the one or more HTML components; transmitting the one or more fingerprints to an external server; and classifying, by the external server, the webinject based on the one or more fingerprints.

Claims

1. A computer-implemented method for detection of a webinject, the method comprising:

delivering a detection webpage to a web browser, the detection webpage having detection code configured to detect a presence of the webinject in the detection webpage;

inspecting, by the detection code, rendering of content of the detection webpage in the browser to detect webinject content in the detection webpage by the webinject, the webinject content including one or more Hypertext Markup Language (HTML) components;

if webinject content is detected, generating, by the detection code, a fingerprint for each of the one or more HTML components;

transmitting, by the detection code, the one or more fingerprints to an external server; and

classifying, by the external server, the webinjects present on a remote browser based on the one or more known fingerprints.

2. The method of claim 1, further comprising:

transmitting to the external server, by the detection code, the one or more HTML components of the detected webinject content, the transmission performed by a portion of executions of the detection code;

identifying an origin software of the one or more HTML components by at least one of;

(i) searching for the one or more HTML components in sandboxed executions of software or (ii) searching through privately- or publicly-available data sources; and

generating a database of (a) the one or more fingerprints, (b) a name of the origin software, (c) one or more features of the detected webinject content, and/or (d) one or more capabilities of the detected webinject content.

3. The method of claim 1, wherein delivering the detection webpage having detection code further comprises:

configuring the detection code such that at least one of;

(i) a source domain, (ii) a path, or (iii) an HTML structure of the detection webpage is configured to trigger an injection of the webinject content by the webinject.

4. The method of claim 1, wherein the detection code comprises JavaScript or Content Security Policy (CSP).

5. The method of claim 1, wherein the detection webpage is inserted into an Hypertext Markup Language (HTML) inline frame.

6. The method of claim 1, wherein classifying the webinject based on the one or more fingerprints further comprises:

determining an origin software of the webinject based on the one or more fingerprints.

7. The method of claim 1, wherein classifying the webinject based on the one or more fingerprints further comprises:

mapping the one or more fingerprints to a feature set of the webinject.

8. The method of claim 1, wherein the detection webpage is delivered by a traffic generating entity.

9. The method of claim 8, wherein delivering a detection webpage to a web browser further comprises:

embedding, by the traffic generating entity, the detection webpage into an external webpage.

10. The method of claim 1, wherein delivering a detection webpage to a web browser occurs upon receiving an indication of a user interaction with the content of a webpage, the webpage separate from the detection webpage.

11. A system for detection of webinjects, the system comprising:

one or more computer systems programmed to perform operations comprising;

delivering a detection webpage to a web browser, the detection webpage having detection code configured to detect a presence of the webinject in the detection webpage;

inspecting, by the detection code, rendering of content of the detection webpage in the browser to detect webinject content in the detection webpage by the webinject, the webinject content including one or more Hypertext Markup Language (HTML) components;

if webinject content is detected, generating, by the detection code, a fingerprint for each of the one or more HTML components;

transmitting, by the detection code, the one or more fingerprints to an external server; and

classifying, by the external server, the webinjects present on a remote browser based on the one or more known fingerprints.

12. The system of claim 11, further comprising:

transmitting to the external server, by the detection code, the one or more HTML components of the detected webinject content, the transmission performed by a portion of executions of the detection code;

identifying an origin software of the one or more HTML components by at least one of;

(i) searching for the one or more HTML components in sandboxed executions of software or (ii) searching through privately- or publicly-available data sources; and

generating a database of (a) the one or more fingerprints, (b) a name of the origin software, (c) one or more features of the detected webinject content, and/or (d) one or more capabilities of the detected webinject content.

13. The system of claim 11, wherein delivering the detection webpage having detection code further comprises:

configuring the detection code such that at least one of (i) a source domain, (ii) a path, or (iii) an HTML structure of the detection webpage is configured to trigger an injection of the webinject content by the webinject.

14. The system of claim 11, wherein the detection code comprises JavaScript or Content Security Policy (CSP).

15. The system of claim 11, wherein the detection webpage is inserted into an Hypertext Markup Language (HTML) inline frame.

16. The system of claim 11, wherein classifying the webinject based on the one or more fingerprints further comprises:

determining an origin software of the webinject based on the one or more fingerprints.

17. The system of claim 11, wherein classifying the webinject based on the one or more fingerprints further comprises:

mapping the one or more fingerprints to a feature set of the webinject.

18. The system of claim 11, wherein the detection webpage is delivered by a traffic generating entity.

19. The system of claim 11, wherein delivering a detection webpage to a web browser further comprises embedding, by the traffic generating entity, the detection webpage into an external webpage.

20. The system of claim 19, wherein delivering a detection webpage to a web browser occurs upon receiving an indication of a user interaction with the content of a webpage, the webpage separate from the detection webpage.