Abstract: Preserving web page functionality through dynamic analysis of host web pages. Web pages accessed by a user device may be monitored. The web browser may apply a blocking policy that blocks an external domain from loading functional content into the web page, which results in a breakage in the web page. The breakage in the web page may be identified through a dynamic analysis of the web page and correlated with the functional content from the blocked external domain. Once identified and correlated, the blocking policy may be modified to allow the external domain to load the functional content and reloading the web page.

Abstract: The disclosed computer-implemented method for dynamic formjacking protection may include identifying a sensitive data input field element on a webform loaded in a browser, creating a secure isolated container overlaid on the identified sensitive data input field element, and collecting, via the secure isolated container, real input data intended for the sensitive data input field element. The method may also include inserting dummy data into the sensitive data input field element and intercepting a form submit request from the webform to a destination. The method may further include determining whether the destination is a trusted destination, and when the destination is determined to be the trusted destination, modifying the form submit request to allow the real input data to be sent to the trusted destination. The method may also include sending the form submit request to the destination. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Distinguishing between functional tracking domains and nonfunctional tracking domains on a host web page. In particular, a list of known tracking domains that load content into host web pages may be received. This list of tracking domains may include tracking domains that are functional and tracking domains that are nonfunctional. The tracking domains that are functional may be determined by evaluating various behaviors and characteristics of the tracking domains. Once functional tracking domains have been determined, these functional tracking domains may be allowed, and other tracking domains may be blocked from loading content onto host web pages thereby preserving the functionality of the web pages.

Abstract: Assigning privacy ratings to tracking domains in order to increase user awareness of online privacy violations. A list of known tracking domains and raw data from a set of host websites may be received. A prevalence, frequency, and role for each tracking domain may be determined from the raw data. Each tracking domain may be assigned to a prevalence cluster, a frequency cluster, and a role cluster. A rank may be determined for each prevalence cluster, frequency cluster, and role cluster. A domain privacy rating may be assigned to each tracking domain that is based on the ranks of the clusters to which each tracking domain is assigned. A privacy action may be performed based on the domain privacy rating assigned to each tracking domain.

Abstract: The disclosed computer-implemented method for utilizing user profile data to protect against phishing attacks may include (i) detecting a target user profile associated services accessed by a network-based application, (ii) determining identifiers associated with each of the services, (iii) extracting, for each of the identifiers, feature vectors describing exploitable screen elements in the network-based application associated with phishing attacks, (iv) updating, based on the feature vectors, previously extracted feature vectors in a data repository storing additional profiles for other users associated with the services, (v) predicting, utilizing a machine-learning model, phishing attack threats for target profile user based on a similarity with the additional profiles, and (vi) performing a security action that protects against the phishing attack threats. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for removing whitespace from blocked resources in websites may include identifying elements arranged in a hierarchy from a website at least partially loaded in a browser and identifying one or more whitespace candidates to be displayed as whitespace in the browser. The method may also include selecting an element relating to the one or more whitespace candidates based on the hierarchy and establishing a mutation observer for monitoring a change in the selected element. The method may further include modifying a display attribute of the selected element based on the monitoring by the mutation observer. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting unauthorized online transactions may include correlating, by at least one processor, one or more reported financial activities to one or more online financial activities tracked in network telemetry on one or more authorized devices. The method may additionally include identifying, by the at least one processor based on the correlation, at least one of the reported financial activities that was initiated by an unauthorized device. The method may also include performing, by the at least one processor, a security action in response to the identification. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for detecting websites that perpetrate at least one of scams or frauds may include correlating online interaction data with financial transaction data. The online interaction data may include information on suspicious websites obtained through an online interaction analysis, and the financial transaction data may include sources of suspicious financial activity obtained through a transaction trend analysis. The method may additionally include detecting at least one of online scams or frauds based on the correlation. The detection may include detecting that an online interaction is suspicious based on correlation thereof to a suspicious financial transaction, and/or detecting that a financial transaction is suspicious based on correlation thereof to a suspicious online interaction. The method may also include performing a security action in response to the detection. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods for identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.

Abstract: Protecting against a tracking parameter in a web link. In one embodiment, a method may include receiving an input URL during a browser navigation session on a user device, the input URL including parameters, determining that the parameters include a tracking parameter, pausing the browser navigation session on the user device, launching the input URL in a headless browser that operates in an isolated environment that simulates one or more features of the user device, landing on a destination web page in the isolated environment, identifying a URL of the destination web page as a destination URL, and resuming the browser navigation session on the user device by replacing the input URL, which includes the tracking parameter, with the destination URL, which does not include the tracking parameter, in order to protect the user device from the tracking parameter.

Abstract: The disclosed computer-implemented method for detecting fraudulent shopping websites may include (i) identifying a shopping website that advertises a plurality of allegedly available payment options for completing transactions on the shopping website, (ii) determining, based at least in part on an analysis of the plurality of allegedly available payment options that at least one of the plurality of allegedly available payment options is suspicious, (iii) calculating a trustworthiness score for the shopping website that is based at least in part on the determination that at least one of the allegedly available payment options is suspicious, and (iv) displaying an alert to a user based on the trustworthiness score of the shopping website. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for protecting user data privacy against anti-tracking evasion techniques for web trackers may include (i) detecting hypertext markup language (HTML) associated with a website displayed in a browser application, (ii) identifying one or more elements in the HTML capable of executing web tracking code from the website, (iii) determining, based on information describing scripting programming code responsible for embedding the HTML elements in the website, a presence of a hidden web tracking script, and (iv) performing a security action that protects against a potential invasion of user data privacy by preventing the hidden web tracking script from executing the web tracking code in the browser application. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Identifying and removing a tracking capability from an external domain that performs a tracking activity on a host web page. Tracking capabilities of an external domain may be removed by altering web requests and/or responses to API calls. Once these tracking capabilities of the external domain have been removed, the altered web requests and/or altered responses to API calls may be transmitted to a web browser and/or entity making the API call thereby protecting user privacy while allowing the external domain to interact with the host web page.

Abstract: Determining a number of secondary tracking attempts avoided by blocking a primary tracking domain from loading in a host web page. In particular, a set of rules that identify numbers of secondary tracking domains that are loaded into web browsers through host web pages by external domain and primary tracking domain combinations may be identified. The set of rules may be created based on loading patterns, resource patterns, parameter patterns, and header patterns exhibited by the external domain and primary tracking domain combinations. The rules may be applied to determine a number of secondary tracking attempts avoided by blocking a primary tracking domain from loading in a host web page.

Abstract: The disclosed computer-implemented method for providing web tracking transparency to protect user data privacy may include (i) receiving a browser request for target websites during a browsing session, (ii) identifying a tracking type for website trackers utilized by the target websites, the tracking type including a direct tracking type or a tracking sharing type, (iii) extracting an information category for the target websites, (iv) detecting text patterns shared between the target websites in a common information category, (v) determining information collected about a user by the website trackers by combining the tracking type for the website trackers, the information category for the target websites, and the detected text patterns, and (v) performing a security action that protects against unsolicited website tracking in future browsing sessions by providing the information collected by the website trackers to the user. Various other methods, systems, and computer-readable media are also disclosed.