Analyzing client application behavior to detect anomalies and prevent access
A client device accesses content and performs actions at a remote application server via a user-agent application. The application server directs the user-agent application to a security verification system to retrieve and perform security tests. The security verification system receives information from the user-agent application describing characteristics of the user-agent application, and the security verification system selects a set of security tests to be performed by a security module executing in the user-agent application to verify that the user-agent application is accessing the application server consistent with the described user-agent application. The security verification system compares a set of test results with other user-agent applications and provides a token to the user-agent application to access the application server. The security module may also monitor and actions on the user-agent application to permit the security verification system to revise or revoke the token.
1. A method comprising:
sending, by a security verification system to a client device executing an application accessing a service from an application server, a set of security tests for execution by the application on the client device, the set of security tests comprising executable code which, when executed by the application, performs the set of security tests;
receiving, at the security verification system from the client device, a set of test results reflecting the execution of the set of security tests by the application of the client device, the set of security tests associated with one or more characteristics of the application of the client device;
comparing the set of test results to a set of expected test results associated with the one or more characteristics of the application to determine a security score based on differences between the set of test results and the set of expected test results;
responsive to the comparing, generating, by the security verification system, a security token for the application comprising the security score; and
sending, by the security verification system, the security token to the client device.
2. The method of claim 1 , further comprising:
receiving, at the security verification system from the client device, a request to verify security of the client device specifying characteristics of the application executing on the client device; and
identifying, at the security verification system, the set of security tests based on the one or more characteristics of the application.
3. The method of claim 2 , wherein the one or more characteristics of the application comprise a type of the application and a version of the application and wherein identifying the set of security tests based on the one or more characteristics of the application comprises identifying the set of security tests from a plurality of sets of security tests, each associated with different combinations of applications and versions.
4. The method of claim 1 , wherein the application is a web browser and the executable code is a script for execution by the web browser.
5. The method of claim 1 , wherein the set of security tests executed by the application of the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application.
6. The method of claim 1 , further comprising:
responsive to the security score being below a threshold:
providing an additional set of security tests to the client device for execution by the application; and
receiving, from the client device, an additional set of test results reflecting the execution of the additional set of security tests; and
wherein generating the security token is further based on the additional set of test results.
7. The method of claim 1 , wherein the security token for the application further comprises an identification of the set of security tests and the comparison of the set of test results to the set of expected test results.
8. The method of claim 1 , wherein comparing the set of test results to a set of expected test results to determine a security score comprises determining, at the security verification system, the security score based on the comparison of the test results to one or more expected client characteristics, an expected profile of application content when accessed, and expected user activity.
9. The method of claim 1 , wherein the tests are executed by a security module of the application, and wherein the method further comprises:
receiving, responsive sending the security token to the client device, an application action identified by the security module;
updating, at the security verification system, the security token based on the application action; and
providing, by the security verification system, the updated security token to the application.
10. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform steps comprising:
sending, by a security verification system to a client device executing an application accessing a service from an application server, a set of security tests for execution by the application on the client device, the set of security tests comprising executable code which, when executed by the application, performs the set of security tests;
receiving, at the security verification system from the client device, a set of test results reflecting the execution of the set of security tests by the application of the client device, the set of security tests associated with one or more characteristics of the application of the client device;
comparing the set of test results to a set of expected test results associated with the one or more characteristics of the application to determine a security score based on differences between the set of test results and the set of expected test results;
responsive to the comparing, generating, by the security verification system, a security token for the application comprising the security score; and
sending, by the security verification system, the security token to the client device.
11. The non-transitory computer-readable storage medium of claim 10 further comprising instructions that cause the processor to perform the steps of:
receiving, at the security verification system from the client device, a request to verify security of the client device specifying characteristics of the application executing on the client device; and
identifying, at the security verification system, the set of security tests based on the one or more characteristics of the application.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the one or more characteristics of the application comprise a type of the application and a version of the application and wherein identifying the set of security tests based on the one or more characteristics of the application comprises identifying the set of security tests from a plurality of sets of security tests, each associated with different combinations of applications and versions.
13. The non-transitory computer-readable storage medium of claim 10 , wherein the application is a web browser and the executable code is a script for execution by the web browser.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the set of security tests executed by the application of the client device comprise at least one of: a test identifying a user's interactions with the application, a test identifying the application's display of the service accessed from the application server, a test identifying an application's interaction with the application server, and a test identifying an executing environment of the application.
15. The non-transitory computer-readable storage medium of claim 10 , further comprising instructions that cause the processor to perform the steps of:
responsive to the security score being below a threshold:
providing an additional set of security tests to the client device for execution by the application; and
receiving, from the client device, an additional set of test results reflecting the execution of the additional set of security tests; and
wherein generating the security token is further based on the additional set of test results.
16. The non-transitory computer-readable storage medium of claim 10 , wherein the security token for the application further comprises an identification of the set of security tests and the comparison of the set of test results to the set of expected test results.
17. The non-transitory computer-readable storage medium of claim 10 , wherein comparing the set of test results to a set of expected test results to determine a security score comprises determining, at the security verification system, the security score based on the comparison of the test results to one or more expected client characteristics, an expected profile of application content when accessed, and expected user activity.
18. The non-transitory computer-readable storage medium of claim 10 , wherein the tests are executed by a security module of the application, and wherein the non-transitory computer-readable storage medium further comprises instructions that cause the processor to perform the steps of:
receiving, responsive sending the security token to the client device, an application action identified by the security module;
updating, at the security verification system, the security token based on the application action; and
providing, by the security verification system, the updated security token to the application.