Safe Intelligent Content Modification

Abstract

A computer-implemented method for deflecting abnormal computer interactions includes receiving, at a computer server system and from a client computer device that is remote from the computer server system, a request for web content; identifying, by computer analysis of mark-up code content that is responsive to the request, executable code that is separate from, but programmatically related to, the mark-up code content; generating groups of elements in the mark-up code content and the related executable code by determining that the elements within particular groups are programmatically related to each other; modifying elements within particular ones of the groups consistently so as to prevent third-party code written to interoperate with the elements from modifying from interoperating with the modified elements, while maintain an ability of the modified elements within each group to interoperate with each other; and recoding the mark-up code content and the executable code to include the modified elements.

1 . A computer-implemented method for deflecting abnormal computer interactions, the method comprising:
 identifying, by computer analysis of mark-up code content at a computer server system, executable code that is separate from, but programmatically related to, the mark-up code content;   analyzing the mark-up code content and executable code related to the mark-up code content, to identify elements that can be altered without changing a manner in which code containing the identified elements is presented on a computer;   generating one or more groups of elements in the mark-up code content and the related executable code by determining that particular elements within particular groups are programmatically related to each other;   generating a mapping that identifies locations, in the mark-up code content, the executable code, or both, of the identified elements that are in the groups of elements;   repeatedly modifying elements within particular ones of the groups in response to different requests for the mark-up code content, the modifying being performed (a) consistently across multiple elements for a particular request, but (b) differently as between different requests, so as to prevent third-party code written to interoperate with the elements from interoperating with the modified elements, while maintaining an ability of the modified elements within each group of the one or more groups to interoperate with each other, the modifying using the generated mapping for modifying elements in response to multiple separate requests for the mark-up code content; and   repeatedly recoding the mark-up code content and the executable code to include the modified elements, in response to requests for the mark-up code from multiple client devices.   
     
     
         2 . The computer-implemented method of  claim 1 , further comprising serving the recoded mark-up code content and executable code to client computer devices that request the mark-up code. 
     
     
         3 . The computer-implemented method of  claim 1 , further comprising performing the steps of identifying, generating, modifying, and recoding repeatedly for each of multiple different requests from the multiple client devices, wherein the elements within particular ones of the groups are modified, using the mapping, in different manners for each of the multiple different requests. 
     
     
         4 . The computer-implemented method of  claim 1 , further comprising generating instrumentation code configured to monitor interaction with the recoded mark-up code, executable code, or both, and to report to the computer server system information that identifies abnormalities in the monitored interaction. 
     
     
         5 . The computer-implemented method of  claim 4 , further comprising receiving, at the computer server system and from instrumentation code executing on one of the client devices, a report of activity by alien code attempting to interoperate with the recoded mark-up code, executable code, or both. 
     
     
         6 . The computer-implemented method of  claim 5 , wherein the attempt to interoperate comprises an attempt to alter a document object model for a web browser on the one of the client devices. 
     
     
         7 . The computer-implemented method of  claim 1 , wherein generating the one or more groups of elements comprises identifying elements that address or are addressed by a common name. 
     
     
         8 . The computer-implemented method of  claim 7 , wherein the common name is a common name of an element, method, function, or object. 
     
     
         9 . The computer-implemented method of  claim 7 , wherein modifying the elements comprises changing the common name in a consistent manner across the elements. 
     
     
         10 . The computer-implemented method of  claim 8 , wherein changing the common name comprises changing the common name to a random string of characters. 
     
     
         11 . The computer-implemented method of  claim 1 , wherein the mark-up code comprises HTML code, and the executable code comprises JavaScript code. 
     
     
         12 . The computer-implemented method of  claim 1 , further comprising modifying elements in cascading style sheet (CSS) code identified as being programmatically related to the HTML code. 
     
     
         13 . A computer system for recoding web content served to client computers, the system comprising:
 an interface, executed on one or more processors from code stored on one or more non-transitory media, for receiving information from a web server system configured to provide computer code in multiple different formats in response to requests from client computing devices; and   a security intermediary, executed on the one or more processors from the code stored on the one or more non-transitory media, that is arranged to (i) receive the computer code from the interface before the resource is provided to the client computing devices, (ii) identify common elements in the different formats of the computer code by determining that the common elements interoperate with each other when the code is executed and generate a mapping that identifies locations of the identified common elements in the different formats of the computer code; (iii) use the mapping to modify the common elements in a consistent manner across the different formats of the computer code within particular servings of the computer code, and in different manners between different servings of the computer code; and (iv) recode the computer code using the modified common elements in manners that differs, with respect to particular elements, for different requests for the computer code, so as to interfere with attempts by malware to interoperate with the code.   
     
     
         14 . The computer-implemented system of  claim 13 , wherein the system is further configured to serve the recoded computer code to particular client computing devices that requested the code. 
     
     
         15 . The computer-implemented system of  claim 13 , wherein the security intermediary is programmed to perform actions (i) through (iv) in response to each request for content, and to modify the multiple different common elements in different manners as compared to how the corresponding elements were modified for different requests for the same computer code. 
     
     
         16 . The computer-implemented system of  claim 13 , further comprising an instrumentation module programmed to generate instrumentation code configured to monitor interaction with the recoded mark-up code, executable code, or both, and to report to the computer server system information that identifies abnormalities in the monitored interaction. 
     
     
         17 . The computer-implemented system of  claim 16 , wherein the system is further programmed to receive from the instrumentation code executing on a client computing device, a report of activity by alien code attempting to interoperate unsuccessfully with the recoded computer code by attempts to interoperate with a version of the computer code that has not been recoded, and to generate an alert related to such attempting. 
     
     
         18 . The computer-implemented system of  claim 17 , wherein the attempt to interoperate comprises an attempt to alter a document object model for a web browser on the client computer. 
     
     
         19 . The computer-implemented system of  claim 13 , wherein identifying the common elements comprises identifying elements that address or are addressed by a common name in the computer code. 
     
     
         20 . The computer-implemented system of  claim 19 , wherein the common name is a common name of an element, method, function, or object. 
     
     
         21 . The computer-implemented system of  claim 20 , wherein modifying the elements comprises changing the common name in a consistent manner across the elements. 
     
     
         22 . The computer-implemented system of  claim 21 , wherein changing the common name comprises changing the common name to a random string of characters. 
     
     
         23 . The computer-implemented method of  claim 1 , wherein the computer code comprises formats of code in HTML, CSS, and JavaScript, and wherein each of the formats interoperates with the other formats.