Granted Patent B1

US 11,354,440 · App. 16/449,116 · Granted Jun 7, 2022

Inventors: Iskander Sanchez (Antibes, FR); Leylya Yumer (Antibes, FR)

Assignee: NORTONLIFELOCK INC.

G06F21/6263G06F11/3636G06F21/52

Abstract

Claims (76)

1. A computer-implemented method for analyzing and mitigating privacy issues on a computing device using cookie generation flow, at least a portion of the method being performed by the computing device comprising one or more processors, the method comprising:

initiating, by the computing device, a headless web browser;

monitoring, by the computing device, a request made of a website accessed by the headless web browser;

monitoring, by the computing device, scripts created on the website;

instrumenting, by the computing device, a function used to create a cookie on the computing device;

tracing, by the computing device, an initial generation of a call used to create the cookie on the computing device by performing a back trace analysis on the initial generation of the call used to create the cookie in order to identify an origin of the call and correlating the origin of the call to a FrameID present in the website;

obtaining, by the computing device, a cookie generation flow related to creating the cookie; and

initiating a security action based on obtaining the cookie generation flow.

2. The method of claim 1 , wherein the initiating of the security action further comprises:

alerting an administrator regarding cookie creation, or disabling the cookie, or a combination thereof.

3. The method of claim 1 , wherein the initiating of the headless web browser further comprises:

attaching the headless web browser using a protocol interface.

4. The method of claim 3 , wherein the attaching of the headless web browser using the protocol interface further comprises:

attaching the headless web browser using the Chrome Debugging Protocol (CDP).

5. The method of claim 1 , wherein the monitoring of the request further comprises:

detecting a loader;

connecting the loader to a frame corresponding with the request;

performing analysis on at least one response received in response to the request;

identifying an initiator of the request; and

connecting the initiator to a source code associated with the initial generation of the call to create the cookie.

6. The method of claim 5 , wherein the performing of the analysis further comprises:

checking a value of different possible headers and document content associated with the response.

7. The method of claim 5 , wherein the monitoring of the scripts further comprises:

classifying the scripts according to a technique used to call the scripts;

establishing an inclusion context of the scripts;

indicating the initiator of the initial generation of the call to create the cookie; and

relating the initiator to the source code associated with the initial generation of the call to create the cookie.

8. The method of claim 1 , wherein the instrumenting of the function further comprises:

including the instrumenting in all possible contexts of creation of the cookie.

9. The method of claim 1 , wherein the instrumenting of the function further comprises:

creating a communication channel between a new implementation of the cookie created and a debugger attached to the headless web browser.

10. The method of claim 1 , wherein the obtaining of the cookie generation flow further comprises:

obtaining stack trace information from the instrumented function, the scripts created on the website, and the request made; and

combining the obtained stack trace information to create a finalized cookie generation flow.

11. A computing device for analyzing and mitigating privacy issues on the computing device using cookie generation flows; comprising:

a processor;

a memory in electronic communication with the processor; and

instructions stored in the memory, the instructions being executable by the processor to:

initiate a headless web browser;

monitor a request made of a website accessed by the headless web browser;

monitor scripts created on the website;

instrument a function used to create a cookie on the computing device;

trace an initial generation of a call used to create the cookie on the computing device by performing a back trace analysis on the initial generation of the call used to create the cookie in order to identify an origin of the call and correlating the origin of the call to a FrameID present in the website;

obtain a cookie generation flow related to creating the cookie; and

initiate a security action based on obtaining the cookie generation flow.

12. The computing device of claim 11 , wherein when the processor attaches the headless web browser, the instructions are further executable to:

attach the headless web browser using a protocol interface.

13. The computing device of claim 12 , wherein when the processor attaches the headless web browser using the protocol interface, the instructions are further executable to:

attach the headless web browser using the Chrome Debugging Protocol (CDP).

14. The computing device of claim 11 , wherein when the processor monitors the request, the instructions are further executable to:

detect a loader;

connect the loader to a frame corresponding with the request;

perform analysis on a response received in response to the request;

identify an initiator of the request; and

connect the initiator to a source code associated with the initial generation of the call to create the cookie.

15. The computing device of claim 14 , wherein when the processor performs the analysis, the instructions are further executable to:

check a value of different possible headers and document content associated with the response.

16. The computing device of claim 14 , wherein when the processor monitors the scripts, the instructions are further executable to:

classify the scripts according to a technique used to call the scripts;

establish an inclusion context of the scripts;

indicate the initiator of the initial generation of the call to create the cookie; and

relate the initiator to the source code associated with the initial generation of the call to create the cookie.

17. The computing device of claim 11 , wherein when the processor instruments the function, the instructions are further executable to:

include the instrumenting in all possible contexts of creation of the cookie.

18. The computing device of claim 11 , wherein when the processor instruments the function, the instructions are further executable to:

create a communication channel between a new implementation of the cookie created and a debugger attached to the headless web browser.

19. One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for analyzing and mitigating privacy issues on the computing device using cookie generation flows, the method comprising:

initiating, by the computing device, a headless web browser;

monitoring, by the computing device, a request made of a website accessed by the headless web browser;

monitoring, by the computing device, scripts created on the website;

instrumenting, by the computing device, a function used to create a cookie on the computing device;

tracing, by the computing device, an initial generation of a call used to create the cookie on the computing device by performing a back trace analysis on the initial generation of the call used to create the cookie in order to identify an origin of the call and correlating the origin of the call to a FrameID present in the website;

obtaining, by the computing device, a cookie generation flow related to creating the cookie; and

initiating a security action based on obtaining the cookie generation flow.

20. The method of claim 1 , wherein the initiating of the security action further comprises:

preventing third-party cookie creation or blocking a third-party cookie.

Assignments (6)