Method, computer software, and system for providing end to end security protection of an online transaction

• US 20040098607A1
• Filed: 02/04/2003
• Published: 05/20/2004
• Est. Priority Date: 08/30/2002
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: WholeSecurity, Inc. (Gen Digital Inc.)
• Inventors: Alagna, Michael Tony, Obrecht, Mark, Payne, Andy, Norwood, Peter
• Granted Patent: US 7,331,062 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Abstract

A method for implementing an online transaction security product includes downloading an online transaction security product program from a web site to an information handling system. The security product program includes an anti-malicious code program configured to detect malicious code on the information handling system. Lastly, the security product program is executed, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system.

Claims

1. A method for implementing an online transaction security product, comprising:

downloading an online transaction security product program from a web site to an information handling system, the security product program including an anti-malicious code program configured to detect malicious code on the information handling system; and

executing the security product program on the information handling system, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system.

2. The method of claim 1, wherein downloading the security product program includes downloading a security product plug-in from the web site to a browser operating on the information handling system, the plug-in including the anti-malicious code program configured to detect malicious code on the information handling system;

said method further comprising;

caching the downloaded plug-in on the information handling system; and

executing the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

3. The method of claim 1, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

4. The method of claim 3, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action.

5. The method of claim 4, wherein the disabling action includes an action configured to disable the malicious code.

6. The method of claim 4, wherein the quarantine action includes an action configured to quarantine the malicious code.

7. The method of claim 1, wherein the security product program further includes an online security system tray icon, and wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system.

8. The method of claim 7, wherein the security product program further includes a resident program and wherein executing the security product program includes installing the resident program on the information handling system, said method further comprising:

responsive to at least one selected from the group consisting of an activation and a selection of the online security system tray icon, executing the resident program.

9. The method of claim 8, wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse a quarantine action.

10. The method of claim 7, wherein an activation of the system tray icon executes a resident program.

11. The method of claim 10, wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse the quarantine action in response to an unquarantine request.

12. The method of claim 11, further wherein the unquarantine request includes a user selectable option.

13. The method of claim 1, wherein the anti-malicious code program includes an anti-Trojan program configured to detect malicious code in the form of a Trojan Horse on the information handling system.

14. The method of claim 13, wherein the anti-Trojan program includes detection routines configured to a) examine executable code under investigation running on the information handling system, and b) associate weights to respective code under investigation in response to detections of a valid routine or malicious code as a function of respective detection routines, the anti-Trojan program further including a scoring algorithm configured to identify executable code under investigation as a valid program or malicious code as a function of the weights associated to the executable code under investigation by the detection routines.

15. A method for implementing an online transaction security product comprising:

downloading an online transaction security product program from a web site to an information handling system, the security product program including an anti-malicious code program configured to detect malicious code on the information handling system; and

executing the security product program, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

16. The method of claim 15, wherein downloading the online transaction security product program includes downloading a security product plug-in from a web site to a browser operating on the information handling system, the security product plug-in including the anti-malicious code program configured to detect malicious code on the information handling system, said method further comprising:

caching the downloaded plug-in on the information handling system; and

executing the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

17. The method of claim 15, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action, wherein the disabling action is configured to disable the malicious code, and wherein the quarantine action is configured to quarantine the malicious code.

18. The method of claim 15, wherein the plug-in further includes an online security system tray icon and a resident program, wherein executing the cached plug-in further includes adding the system tray icon to a system tray of the information handling system and installing the resident program on the information handling system;

and

responsive to a selection of the online security system tray icon, executing the resident program, wherein the resident program includes an unquarantine function configured to reverse a quarantine action.

19. An information handling system comprising:

a memory;

a processor; and

computer-readable code stored on said memory and processable by said processor for implementing an online transaction security product, said computer-readable code including instructions for causing said processor to;

download an online transaction security product plug-in from a web site to a browser operating on said information handling system, the plug-in including an anti-malicious code program configured to detect malicious code on the information handling system, cache the downloaded plug-in on the information handling system, and execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

20. The information handling system of claim 19, wherein downloading the security product program further includes downloading an online transaction security product plug-in from the web site to a browser operating on said information handling system, the plug-in including the anti-malicious code program configured to detect malicious code on the information handling system, said computer-readable code further including instructions for causing said processor to:

cache the downloaded plug-in on the information handling system, and execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

21. The system of claim 19, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

22. The system of claim 21, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action.

23. The system of claim 22, wherein the disabling action includes an action configured to disable the malicious code and wherein the quarantine action includes an action configured to quarantine the malicious code.

24. The system of claim 19, wherein the security product program further includes an online security system tray icon, and wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system.

25. The system of claim 24, wherein the security product program further includes a resident program and wherein executing the security product program includes installing the resident program on the information handling system, said computer-readable code further including:

instructions for causing said processor to execute the resident program responsive to at least one selected from the group consisting of an activation and a selection of the online security system tray icon.

26. The system of claim 25, wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse a quarantine action.

27. The system of claim 24, wherein an activation of the system tray icon executes a resident program, and wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse the quarantine action in response to an unquarantine request.

28. The system of claim 19, wherein the anti-malicious code program includes an anti-Trojan program configured to detect malicious code in the form of a Trojan Horse on the information handling system.

29. The system of claim 28, wherein the anti-Trojan program includes detection routines configured to a) examine executable code under investigation running on the information handling system, and b) associate weights to respective code under investigation in response to detections of a valid routine or malicious code as a function of respective detection routines, the anti-Trojan program further including a scoring algorithm configured to identify executable code under investigation as a valid program or malicious code as a function of the weights associated to the executable code under investigation by the detection routines.

30. An information handling system comprising:

a memory;

a processor; and

computer-readable code stored on said memory and processable by said processor for implementing an online transaction security product, said computer-readable code including instructions for causing said processor to;

download an online transaction security product program from a web site to said information handling system, the security product program including an anti-malicious code program configured to detect malicious code on the information handling system, cache the downloaded plug-in on the information handling system, and execute the security product program on the information handling system, wherein the anti-malicious code program operates to detect malicious code on the information handling system, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

31. The information handling system of claim 30, wherein downloading the security product program includes downloading a plug-in to a browser operating on said information handling system, said computer-readable code further including instructions for causing said processor to:

cache the downloaded plug-in on the information handling system, and execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

32. The system of claim 30, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action, wherein the disabling action is configured to disable the malicious code, and wherein the quarantine action is configured to quarantine the malicious code.

33. The system of claim 30, wherein the security product program further includes an online security system tray icon and a resident program, wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system and installing the resident program on the information handling system;

and

responsive to a selection of the online security system tray icon, executing the resident program, wherein the resident program includes an unquarantine function configured to reverse a quarantine action.

34. A computer program stored on computer-readable media for providing online security protection of an online transaction to an information handling system, the computer program including instructions executeable by the information handling system for causing the information handling system to:

download an online transaction security product plug-in from a web site to a browser operating on the information handling system, the plug-in including an anti-malicious code program configured to detect malicious code on the information handling system;

cache the downloaded plug-in on the information handling system; and

execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

35. The computer program of claim 34, wherein downloading the security product program includes downloading a plug-in from the web site to a browser operating on the information handling system, the plug-in including the anti-malicious code program configured to detect malicious code on the information handling system, wherein said computer program further including instructions executeable by the information handling system for causing the information handling system to:

cache the downloaded plug-in on the information handling system; and

execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

36. The computer program of claim 34, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

37. The computer program of claim 36, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action.

38. The computer program of claim 37, wherein the disabling action includes an action configured to disable the malicious code and wherein the quarantine action includes an action configured to quarantine the malicious code.

39. The computer program of claim 34, wherein the security product program further includes an online security system tray icon, and wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system.

40. The computer program of claim 39, wherein the security product program further includes a resident program and wherein executing the security product program includes installing the resident program on the information handling system, said computer program further comprising instructions for causing the information handling system to:

execute the resident program responsive to at least one selected from the group consisting of an activation and a selection of the online security system tray icon.

41. The computer program of claim 40, wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse a quarantine action.

42. The computer program of claim 39, wherein an activation of the system tray icon executes a resident program.

43. The computer program of claim 42, wherein the resident program includes an unquarantine function, the unquarantine function configured to reverse the quarantine action in response to an unquarantine request.

44. The computer program of claim 43, further wherein the unquarantine request includes a user selectable option.

45. The computer program of claim 34, wherein the anti-malicious code program includes an anti-Trojan program configured to detect malicious code in the form of a Trojan Horse on the information handling system.

46. The computer program of claim 45, wherein the anti-Trojan program includes detection routines configured to a) examine executable code under investigation running on the information handling system, and b) associate weights to respective code under investigation in response to detections of a valid routine or malicious code as a function of respective detection routines, the anti-Trojan program further including a scoring algorithm configured to identify executable code under investigation as a valid program or malicious code as a function of the weights associated to the executable code under investigation by the detection routines.

47. A computer program stored on computer-readable media for implementing an online transaction security product, the computer program including instructions executable by an information handling system for causing the information handling system to:

download an online transaction security product program from a web site to the information handling system, the security product program including an anti-malicious code program configured to detect malicious code on the information handling system; and

execute the security product program, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

48. The computer program of claim 47, wherein downloading the security product program includes downloading an online transaction security product plug-in from the web site to a browser operating on the information handling system, the plug-in including the anti-malicious code program, wherein said computer program further including instructions executable by an information handling system for causing the information handling system to:

cache the downloaded plug-in on the information handling system; and

execute the cached plug-in in the context of the browser, wherein the anti-malicious code program operates to detect malicious code on the information handling system.

49. The computer software of claim 47, wherein the mitigation action includes at least one selected from the group consisting of a disabling action and a quarantine action, wherein the disabling action is configured to disable the malicious code, and wherein the quarantine action is configured to quarantine the malicious code.

50. The computer software of claim 47, wherein the security product program further includes an online security system tray icon and a resident program, wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system and installing the resident program on the information handling system, said computer program further comprising instructions for causing the information handling system to execute the resident program responsive to a selection of the online security system tray icon, wherein the resident program includes an unquarantine function configured to reverse a quarantine action.

51. A method for providing an online transaction security product to an information handling system, comprising:

enabling access to a web page containing the online transaction security product of a web site during an online transaction session;

responsive to an accessing of the web page, downloading an online transaction security product program from the web site to the information handling system, the security product program including an anti-malicious code program configured to detect malicious code on the information handling system, wherein the online transaction security product program is configured to be executed, further wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system.

52. The method of claim 51, wherein downloading the security program product includes downloading an online transaction security product plug-in from the web site to a browser operating on the information handling system, the plug-in including the anti-malicious code program, wherein the online transaction security product plug-in is configured to be cached on the information handling system and executed in the context of the browser.

53. The method of claim 51, wherein the anti-malicious code program is further configured to perform at least one mitigation action in response to a detection of malicious code on the information handling system.

54. The method of claim 53, further wherein the mitigation action includes at least one selected from the group consisting of a disabling action configured to disable the malicious code and a quarantine action configured to quarantine the malicious code.

55. The method of claim 53, wherein the mitigation action includes preventing a continuation of the online transaction session between the information handling system and the web site.

56. The method of claim 51, wherein the security product program further includes an online security system tray icon and a resident program, wherein executing the security product program further includes adding the system tray icon to a system tray of the information handling system and installing the resident program on the information handling system, said method further comprising:

responsive to a selection of the online security system tray icon, executing the resident program, wherein the resident program includes an unquarantine function configured to reverse a quarantine action.