METHOD, COMPUTER SOFTWARE, AND SYSTEM FOR PROVIDING END TO END SECURITY PROTECTION OF AN ONLINE TRANSACTION

• US 20080209561A1
• Filed: 02/11/2008
• Published: 08/28/2008
• Est. Priority Date: 08/30/2002
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Alagna, Michael Tony, Obrecht, Mark, Payne, Andy, Norwood, Peter
• Granted Patent: US 8,156,552 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Abstract

A method for implementing an online transaction security product includes downloading an online transaction security product program from a web site to an information handling system. The security product program includes an anti-malicious code program configured to detect malicious code on the information handling system. Lastly, the security product program is executed, wherein the anti-malicious code program of the security product program operates to detect malicious code on the information handling system.

Claims

1-56. -56. (canceled)

57. A computer-readable medium storing program instructions executable on a computing device to:

at the point of entry into or during a transaction over a wide-area network, detect whether malicious code is executing on the computing device;

upon malicious code being detected, determining whether or not to continue the transaction.

58. The computer-readable medium of claim 57, wherein the program instructions are executable within a browser application, and wherein the transaction is an Internet-based banking transaction.

59. The computer-readable medium of claim 57, wherein the program instructions are executable to discontinue the transaction upon detecting malicious code executing on the computing device.

60. The computer-readable medium of claim 57, wherein the program instructions are executable to disable or quarantine the malicious code that is detected, and then continue the transaction.

61. The computer-readable medium of claim 57, wherein the point of entry into the transaction is prior to a login sequence to a first website.

62. The computer-readable medium of claim 57, wherein the point of entry into the transaction is immediately after entry of a login sequence to a first website.

63. The computer-readable medium of claim 57, wherein the transaction is performed via a first website, and wherein the program instructions are executable to continue the transaction after prompting the user to change login information associated with the first website and receiving the changed login information.

64. The computer-readable medium of claim 57, wherein detection of malicious code includes determining, for each actively executing program on the computing device, a first composite score indicative of code characteristics and/or behaviors typically associated with valid code, and a second composite score indicative of code characteristics and/or behaviors typically associated with malicious code.

65. The computer-readable medium of claim 64, wherein the first composite score is calculated based on weighted output values of a first plurality of valid code detection routines, and wherein the second composite score is calculated based on weighted output values of a second plurality of malicious code detection routines.

66. The computer-readable medium of claim 57, wherein the program instructions are repeatedly executable during the transaction to detect whether malicious code is executing on the computing device.

67. A computer-readable medium storing program instructions executable on a computing device involved in an online transaction to:

at the point of entry into or during the online transaction, determine whether malicious code is running on the computing device; and

upon determining that malicious code is running on the computing device, terminate the online transaction.

68. The computer-readable medium of claim 67, wherein the online transaction is an Internet-based transaction involving a first website.

69. The computer-readable medium of claim 68, wherein the program instructions are executable to determine whether malicious code is running on the computing device by:

calculating, for each active program running on the computing device, a first composite score indicative of the likelihood of the active program being valid code and a second composite score indicative of the likelihood of the active program being malicious code; and

using the first and second composite scores for each active program to determine whether that program is malicious code.

70. The computer-readable medium of claim 67, wherein the program instructions are executable to repeatedly determine whether malicious code is running on the computing device throughout the duration of the online transaction.

71. A computer-readable medium storing program instructions executable on a computing device involved in an online transaction to:

at the point of entry into or during the online transaction, determine whether malicious code is running on the computing device; and

upon determining that malicious code is running on the computing device, suspend the online transaction until the malicious code is disabled.

72. The computer-readable medium of claim 71, wherein the program instructions are executable to disable malicious code by quarantining the malicious code.

73. The computer-readable medium of claim 71, wherein the program instructions are executable within a browser application, and wherein the malicious code is disabled at least during the duration of the online transaction.

74. The computer-readable medium of claim 71, wherein the determination of whether malicious code is running on the computing device includes calculating, for each program running on the computing device, a valid score and a malicious score indicative of valid and malicious characteristics and/or behaviors, respectively, of that program.

75. The computer-readable medium of claim 71, wherein the program instructions are executable to receive malicious code detection routines from a server at the point of entry into or during the online transaction, wherein the malicious code detection routines are executable to determine whether malicious code is running on the computing device.

76. The computer-readable medium of claim 75, wherein the malicious code detection routines include a first plurality of routines executable to determine whether active programs on the computing device possess characteristics and/or behaviors indicative of valid code, and wherein the malicious code detection routines include a second plurality of routines executable to determine whether active programs on the computing device possess characteristics and/or behaviors indicative of malicious code.