Cross-site scripting defense using document object model template

Patent metadata

Field	Value
Publication number	US-9699142-B1
Application number	US-201414272230-A
Country	US
Kind code	B1
Filing date	May 7, 2014
Priority date	May 7, 2014
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Method and apparatus for cross-site scripting defense using document object model template are disclosed. In the method and apparatus, a document object model template is generated based at least in part on representative information for web content. The document object model template is provided for use in determining whether received web content is permissible.

First claim

What is claimed is:

1. A computer-implemented method for detecting malicious content, comprising:
under the control of one or more computer systems configured with executable instructions,
generating a plurality of document object model snapshots wherein:
the plurality of document object model snapshots comprises a first snapshot from a first webpage and a second snapshot from a second webpage, the first webpage and the second webpage identified via different domain names; and
each document object model snapshot of the plurality of document object model snapshots represents a logical structure of one or more node elements of a respective webpage;
generating a document object model template based at least in part on the plurality of document object model snapshots, the document object model template specifying a logical structure of permissible web content, the logical structure of the permissible web content including a plurality of node elements, the document object model template further specifying a node type associated with one or more node elements of the plurality of node elements and a hierarchal relationship between the plurality of node elements, generating the document object model template including:
analyzing the plurality of document object model snapshots to identify commonalities between the first snapshot and the second snapshot; and

incorporating the identified commonalities in the document object model template; and
sending the document object model template to a user device for use in evaluating further web content.

2. The computer-implemented method of claim 1 , wherein the node type of a node element of the one or more node elements specifies whether the node element is an executable node.

3. The computer-implemented method of claim 1 , wherein the hierarchal relationship between the plurality of node elements is expressed as an XPath expression.

4. The computer-implemented method of claim 1 , wherein the identified commonalities are represented by one or more conjunctive or disjunctive normal form statements.

5. The computer-implemented method of claim 1 , wherein:
the method further comprises:
testing the document object model template to determine whether the plurality of document object model snapshots are permissible according to the document object model template; and
on a condition that a document object model snapshot of the plurality of document object model snapshots is not permissible, adjusting the document object model template to make the document object model snapshot permissible; and

the document object model template is sent to the user device on a condition that the plurality of document object model snapshots are permissible according to the document object model template.

6. A system comprising:
at least one computing device configured to implement one or more services, wherein the one or more services are configured to:
receive information that represents web content, the web content associated with a plurality of distinct webpages of a website, the distinct webpages identified using different domain names;
analyze the information to identify commonalities among the plurality of distinct webpages of the website;
generate a document object model template specifying a structure of permissible web content, the document object model template being generated based at least in part on the identified commonalities; and
provide the document object model template to a user device for determining whether further web content is permissible.

7. The system of claim 6 , wherein the document object model template further specifies a number or type of a plurality of node elements and a hierarchal relationship between the plurality of node elements in the structure of the permissible web content.

8. The system of claim 6 , the document object model template includes an indication of whether an executable node element is permissible.

9. The system of claim 6 , wherein the document object model template specifies a target property of a node element.

10. The system of claim 6 , wherein generating the document object model template further includes utilizing an optimization algorithm to reduce a complexity of the document object model template.

11. The system of claim 10 , wherein the optimization algorithm is further configured to penalize increasing a size of the document object model template or increasing a number of webpages permissible by the document object model template.

12. The system of claim 6 , wherein generating the document object model template further includes:
generating a plurality of document object model snapshots based at least in part on the information; and
generating the document object model template based at least in part on the plurality of document object model snapshots.

13. The system of claim 12 , wherein:
the one or more services are further configured to:
test the document object model template to determine whether the plurality of document object model snapshots are permissible according to the document object model template; and
on a condition that a document object model snapshot of the plurality of document object model snapshots is not permissible, adjust the document object model template to make the document object model snapshot permissible according to the document object model template; and

the document object model template is provided on a condition that the plurality of document object model snapshots are permissible according to the document object model template.

14. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by one or more processors of a computer system, cause the computer system to:
obtain information representative of web content, the web content including webpage content from multiple pages of a website that are identified with different domain names;
analyze the information to identify commonalities among the multiple pages of the website identified with different domain names;
generate, based at least in part on the identified commonalities between the multiple pages of the website, a document object model template specifying a structure of permissible web content; and
provide the document object model template to a user device for use in evaluating further web content.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the document object model template specifies permitted document-object-model characteristics for webpages of the website.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the document object model template further specifies a number or type of a plurality of node elements and a hierarchal relationship between the plurality of node elements in the structure of the permissible web content.

17. The non-transitory computer-readable storage medium of claim 14 , wherein the document object model template specifies an executable node element.

18. The non-transitory computer-readable storage medium of claim 14 , wherein the document object model template specifies a target property of a node element.

19. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions that cause the computer system to generate the document object model template, when executed by the one or more processors, further cause the computer system to generate the document object model template to have lower complexity than a previous document object model template.

20. The non-t

Assignees

• Amazon Tech Inc

Inventors

• Allen Nicholas Alexander

Classifications

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title

• G06F21/563

  by source code analysis · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title