Proactive Intrusion Protection System

• US 20170150353A1
• Filed: 11/24/2015
• Published: 05/25/2017
• Est. Priority Date: 11/24/2015
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Hillis, David N., Kurian, Manu J.
• Granted Patent: US 9,723,484 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 48/06 based on traffic conditions

Abstract

One or more non-transitory computer-readable media comprises logic, where the logic corresponds to an application associated with a remote device and a remote system. When executed, the logic is operable to receive, from the remote system, data identifying a plurality of compromising entities, identify a pending outgoing communication initiated by the remote device, and identify information regarding a destination of the outgoing communication. Additionally, the logic is operable to determine an entity associated with the destination of the outgoing communication and determine that the entity associated with the destination matches at least one of the plurality of compromising entities based on comparing the data identifying the plurality of compromising entities and the entity associated with the destination of the outgoing communication. In addition, the logic is operable to generate a signal configured to block the outgoing communication, where the signal is generated before the outgoing communication is sent.

Claims

1. One or more non-transitory computer-readable media comprising logic corresponding to an application associated with a remote device and a remote system, the logic when executed by one or more processors is operable to perform operations comprising:

receiving, from the remote system, data identifying a plurality of compromising entities, where the data comprises at least one of a device identifier or a contact identifier;

identifying a pending outgoing communication initiated by the remote device;

identifying information regarding the outgoing communication, where the information comprises information regarding a destination of the outgoing communication;

determining an entity associated with the destination of the outgoing communication by analyzing the information regarding the outgoing communication;

determining that the entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities based, at least in part, on comparing;

the data identifying the plurality of compromising entities; and

the entity associated with the destination of the outgoing communication; and

generating a signal configured to block the outgoing communication, where the signal is generated before the outgoing communication is sent.

2. The one or more non-transitory computer-readable media of claim 1, wherein the data identifying the plurality of compromising entities is received as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization.

3. The one or more non-transitory computer-readable media of claim 1, further comprising sending, to the remote system, a message indicating that the signal was generated.

4. The one or more non-transitory computer-readable media of claim 1, further comprising:

blocking the outgoing communication; and

displaying an alert on the remote device indicating that the outgoing communication was blocked.

5. The one or more non-transitory computer-readable media of claim 1, further comprising adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.

6. The one or more non-transitory computer-readable media of claim 4, where the alert further presents options on the remote device comprising one or more of:

sending the outgoing communication;

blocking the outgoing communication; and

adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.

7. One or more non-transitory computer-readable media comprising logic corresponding to an application associated with a remote device and a remote system, the logic when executed by one or more processors is operable to perform operations comprising:

identifying a pending outgoing communication initiated by the remote device;

sending, to the remote system, information regarding the outgoing communication, where the information comprises information regarding a destination of the outgoing communication; and

receiving, from the remote system, a signal configured to block the outgoing communication, where the signal is received before the outgoing communication is sent.

8. The one or more non-transitory computer-readable media of claim 7, wherein the information is sent as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization.

9. The one or more non-transitory computer-readable media of claim 7, wherein the signal is received as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization.

10. The one or more non-transitory computer-readable media of claim 7, further comprising sending, to the remote system, an authentication message confirming that the signal was received.

11. The one or more non-transitory computer-readable media of claim 7, further comprising blocking the remote device from sending the outgoing communication, based at least in part on the signal.

12. The one or more non-transitory computer-readable media of claim 7, further comprising adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.

13. The one or more non-transitory computer-readable media of claim 11, further comprising:

displaying an alert on the remote device, where the alert;

indicates that the outgoing communication was blocked; and

presents options on the remote device comprising one or more of;

sending the outgoing communication;

blocking the outgoing communication;

adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.

14. One or more non-transitory computer-readable media comprising logic corresponding to an application associated with a remote device and a remote system, the logic when executed by one or more processors is operable to perform operations comprising:

identifying a pending outgoing communication initiated by the remote device;

sending, to the remote system, information regarding the outgoing communication, where the information comprises information regarding a destination of the outgoing communication; and

receiving, from the remote system, an alert indicating that the destination of the outgoing communication matches a compromising entity, where the alert is received before the outgoing communication is sent.

15. The one or more non-transitory computer-readable media of claim 14, wherein the information is sent as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization.

16. The one or more non-transitory computer-readable media of claim 14, wherein the alert is received as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization.

17. The one or more non-transitory computer-readable media of claim 14, further comprising sending, to the remote system, an authentication message confirming that the alert was received.

18. The one or more non-transitory computer-readable media of claim 14, further comprising displaying the alert on the remote device.

19. The one or more non-transitory computer-readable media of claim 14, further comprising adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.

20. The one or more non-transitory computer-readable media of claim 14, further comprising:

suspending the outgoing communication, based at least in part on the alert; and

displaying the alert on the remote device, where the alert;

indicates that the outgoing communication was suspended; and

presents options on the remote device comprising one or more of;

sending the outgoing communication;

blocking the outgoing communication; and

adding the destination of the outgoing communication to a blocked contacts list associated with the remote device.