Apparatus and methods for shortening user exposure to malicious websites

• US 10,334,015 B2
• Filed: 04/28/2017
• Issued: 06/25/2019
• Est. Priority Date: 04/28/2017
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Birch, Christopher D., Cardinal, Donald J.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US15/581,063
• Publication Number:
  US 20180316712A1
• Time in Patent Office: 788 Days
• Field of Search: 726 2, 726 23, 709223, 709238
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for enhancing computer security is provided. The method may include receiving a first dataset including a first plurality of web sites and a second dataset including a second plurality of web sites. The second plurality of web sites may comprise whitelisted websites. The method may include executing a first set of instructions, the first set of instructions including accessing each of the first plurality of websites and, based on the accessing, assigning a confidence score to each of the websites. The method may also include executing a second set of instructions. The second set of instructions may include creating a third dataset including a third list of web sites having a URL that includes a predetermined term. The second set of instructions may also include removing from the third dataset the second plurality of websites to create a modified third dataset.

Claims

1. A method for enhancing computer security, the method comprising:

receiving a first dataset including a first plurality of websites that have been identified as potentially including malicious software by an application running on a user'"'"'s computer device and a second dataset including a second plurality of websites, the second plurality of websites comprising whitelisted websites;

executing a first set of instructions, the first set of instructions including;

accessing each of the first plurality of websites and, based on the accessing, assigning a confidence score to each of the websites;

executing a second set of instructions, the second set of instructions including;

creating a third dataset including a third list of websites having a URL that includes a predetermined term; and

removing from the third dataset the second plurality of websites to create a modified third dataset;

extracting from the first dataset all websites having an assigned confidence score greater than a predetermined value;

combining the extracted data from the first dataset and the modified third dataset to create a fourth dataset including a fourth list of potentially malicious websites;

initiating a take-down procedure for the fourth list of potentially malicious websites by sending a take-down request to one or more remote servers to take down the fourth list of potentially malicious websites, each of the one or more remote servers hosting one or more websites included in the fourth dataset; and

sending a blocking instruction to a central server, the blocking instruction initiating a browser-based blocking of the fourth list of websites.

2. The method of claim 1 wherein the assigning the confidence score is based at least in part on identifying a website'"'"'s spelling and grammar mistakes.

3. The method of claim 1 wherein the white-listed websites are entity sponsored.

4. The method of claim 1 further comprising modifying the predetermined value in response to the receipt of a user instruction to modify the predetermined value.

5. The method of claim 1 wherein the predetermined value is user-selected.

6. The method of claim 1 wherein the browser-based blocking includes updating a list of websites stored in a central server.

7. The method of claim 6 of wherein the list of websites is a black-listed list of websites.

8. The method of claim 6 wherein the list of websites is accessed by a plurality of browser plug-ins, each browser plug-in residing on a user'"'"'s internet browser, wherein each browser plug-in accesses the list of websites and blocks user access to each website included in the list of websites.

9. The method of claim 6 wherein the list of websites is accessed by a plurality of browser plug-ins, each browser plug-in residing on a user'"'"'s internet browser, wherein each browser plug-in accesses the list of websites and generates a warning message prior to allowing access to each website included in the list of websites.

10. A method for enhancing computer security, the method comprising:

receiving a first dataset including a first plurality of websites that have been identified as potentially including malicious software by an application running on a user'"'"'s computer device and a second dataset including a second plurality of websites, the second plurality of websites comprising whitelisted websites;

executing a first set of instructions, the first set of instructions including;

modifying the first dataset by removing all websites from the first dataset that are included in the second plurality of websites; and

accessing each of the plurality of websites included in the modified first dataset and, based on the accessing, assigning a confidence score to each of the websites;

executing a second set of instructions, the second set of instructions including;

creating a third dataset including a third list of websites having a URL, that includes a predetermined term; and

removing from the third dataset the second plurality of websites to create a modified third dataset;

extracting from the modified first dataset all websites having an assigned confidence score greater than a predetermined value;

combining the extracted data from the modified first dataset and the modified third dataset to create a fourth dataset including a fourth list of potentially malicious websites;

initiating a take-down procedure for the fourth list of potentially malicious websites sending a take-down request to one or more remote servers to take down the fourth list of potentially malicious websites, each of the one or more remote servers hosting one or more websites included in the fourth dataset; and

sending a blocking instruction to a central server, the blocking instruction initiating a browser-based blocking of the fourth list of websites.

11. The method of claim 10 wherein the assigning the confidence score is based at least in part on identifying a website'"'"'s spelling and grammar mistakes.

12. The method of claim 10 wherein the white-listed websites are entity sponsored.

13. The method of claim 10 further comprising modifying the predetermined value in response to the receipt of a user instruction to modify the predetermined value.

14. The method of claim 10 wherein the predetermined value is user-selected.

15. The method of claim 10 wherein the browser-based blocking includes updating a list of websites stored in a central server.

16. The method of claim 15 of wherein the list of websites is a black-listed list of websites.

17. The method of claim 15 wherein the list of websites is accessed by a plurality of browser plug-ins, each browser plug-in residing on a user'"'"'s internet browser, wherein each browser plug-in accesses the list of websites and blocks user access to each website included in the list of websites.

18. The method of claim 15 wherein the list of websites is accessed by a plurality of browser plug-ins, each browser plug-in residing on a user'"'"'s internet browser, wherein each browser plug-in accesses the list of websites and generates a warning message prior to allowing access to each website included in the list of websites.