METHOD AND SYSTEM FOR PROTECTION AGAINST INFORMATION STEALING SOFTWARE

• US 20090241187A1
• Filed: 03/19/2008
• Published: 09/24/2009
• Est. Priority Date: 03/19/2008
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Troyansky, Lidror
• Granted Patent: US 8,407,784 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for identifying infection of unwanted software on an electronic device is disclosed. A software agent configured to generate a bait and is installed on the electronic device. The bait can simulate a situation in which the user performs a login session and submits personal information or it may just contain artificial sensitive information. Parameters may be inserted into the bait such as the identity of the electronic device that the bait is installed upon. The output of the electronic device is monitored and analyzed for attempts of transmitting the bait. The output is analyzed by correlating the output with the bait and can be done by comparing information about the bait with the traffic over a computer network in order to decide about the existence and the location of unwanted software. Furthermore, it is possible to store information about the bait in a database and then compare information about a user with the information in the database in order to determine if the electronic device that transmitted the bait contains unwanted software.

Claims

1. A computer-implemented method for verifying whether data transmitted over a computer network is a password, the method comprising the step of analyzing the data with a weak validation file to identify passwords.

2. The method of claim 1, wherein the weak validation file is a Bloom filter.

3. The method of claim 1, wherein the step of analyzing the data is performed by a traffic analyzer in communication with the computer network.

4. The method of claim 3, wherein the traffic analyzer is configured to block the data from being transmitted over the network if the data is a password.

5. A system for verifying whether data transmitted over a computer network is a password, the system comprising:

a traffic analyzer in communication with the computer network, the traffic analyzer being configured to analyze the data with a weak validation file in order to identify passwords.

6. The system of claim 5, wherein the weak validation file is a Bloom filter.

7. The system of claim 6, wherein the traffic analyzer is configured to block the data from being transmitted over the network if the data is a password.

8. A system for verifying whether data transmitted over a computer network is a password, the system comprising:

data analyzer means in communication with the computer network, the data analyzer means using a weak validation file to analyze the data and determine whether the data is a password.

9. The system of claim 8, wherein the weak validation file of the data analyzer means is a Bloom filter.

10. The system of claim 8, wherein the traffic analyzer means blocks the data from being transmitted over the network if the data is a password.