Analyzing client application behavior to detect anomalies and prevent access
A client device accesses content and performs actions at a remote application server via a user-agent application. The application server directs the user-agent application to a security verification system to retrieve and perform security tests. The security verification system receives information from the user-agent application describing characteristics of the user-agent application, and the security verification system selects a set of security tests to be performed by a security module executing in the user-agent application to verify that the user-agent application is accessing the application server consistent with the described user-agent application. The security verification system compares a set of test results with other user-agent applications and provides a token to the user-agent application to access the application server. The security module may also monitor and actions on the user-agent application to permit the security verification system to revise or revoke the token.
1. A method comprising:
receiving, at a security verification system from a client device, a request to verify security of the client device that specifies characteristics of an application executing on the client device, the characteristics of the application identifying a type of the application and a version of the application;
identifying, at the security verification system, a set of tests based on the characteristics of the application by identifying the set of tests from a plurality of sets of tests associated with different applications and versions;
sending, by the security verification system, the set of tests to the client device for execution by the application at the client device;
receiving, at the security verification system from the client device, a set of test results from the client device reflecting execution of the set of security tests by the application of the client device accessing a service from an application server;
comparing, the set of test results to expected test results associated with characteristics matching the characteristics of the application executing on the client device to determine differences between the set of test results and the expected test results;
generating, by the security verification system, a security token for the application, the security token including a security score describing the differences between the set of test results and the expected test results; and
sending, by the security verification system, the security token to the client device for the application to provide the security token to the application server as verification of the application on the client device.
2. The method of claim 1 , wherein sending the set of tests to the application comprises sending executable code executed by the application to the client device.
3. The method of claim 2 , wherein the application is a web browser and the executable code is a script for execution by the web browser.
4. The method of claim 1 , wherein the tests executed by the application at the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application.
5. The method of claim 1 , further comprises
providing an additional set of tests to the client device for execution by the application when the security score for the comparison is below a threshold, and
receiving an additional set of test results from the client device,
wherein generating the security token is further based on the additional set of test results.
6. The method of claim 1 , wherein generating the security token comprises adding an identification of the set of tests and the comparison of the test results to the set of expected test results to the token.
7. The method of claim 1 , wherein the tests are executed by a security module in the application, the method further comprising
receiving, after sending the security token to the client device, an application action identified by the security module;
updating the security token based on the application action; and
providing the updated security token to the application.
8. A system comprising:
a processor configured to execute instructions;
a non-transitory computer-readable medium storing instructions that when executed by the processor cause the processor to:
receive, from a client device, a request to verify security of the client device that specifies characteristics of an application executing on the client device, the characteristics of the application identifying a type of the application and a version of the application;
identify a set of tests based on the characteristics of the application by identifying the set of tests from a plurality of sets of tests associated with different applications and versions;
send the set of tests to the client device for execution by the application at the client device;
receive, from the client device, a set of test results from the client device reflecting execution of the set of security tests by an application of the client device accessing a service from an application server;
compare the set of test results to expected test results associated with characteristics matching the characteristics of the application executing on the client device to determine differences between the set of test results and the expected test results;
generate a security token for the application, the security token including a security score describing the differences between the set of test results and the expected test results; and
send the security token to the client device for the application to provide the security token to the application server as verification of the application on the client device.
9. The system of claim 8 , wherein sending the set of tests to the application comprises sending executable code executed by the application to the client device.
10. The system of claim 9 , wherein the application is a web browser and the executable code is a script for execution by the web browser.
11. The system of claim 8 , wherein the tests executed by the application at the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application.
12. The system of claim 8 , wherein the instructions when executed by the processor further the processor to:
provide an additional set of tests to the client device for execution by the application when the security score for the comparison is below a threshold, and
receive an additional set of test results from the client device,
wherein generating the security token is further based on the additional set of test results.
13. The system of claim 8 , wherein generating the security token comprises adding an identification of the set of tests and the comparison of the test results to the set of expected test results to the token.
14. The system of claim 8 , wherein the tests are executed by a security module in the application, wherein the instructions when executed by the processor further the processor to:
receive, after sending the security token to the client device, an application action identified by the security module;
update the security token based on the application action; and
provide the updated security token to the application.