SYSTEMS AND METHODS FOR THREAT DETECTION AND WARNING

• US 20200137110A1
• Filed: 12/26/2019
• Published: 04/30/2020
• Est. Priority Date: 09/15/2015
• Status: Active Application

• Current Assignee: Mimecast Services Limited (Mimecast Limited)
• Original Assignee: Mimecast Services Limited (Mimecast Limited)
• Inventors: Tyler, Simon Paul, Malone, Steven, Maylor, Jackie Anne, Ry, Wayne Van, Ribeiro, Francisco, Uebel, Reinhard
• Application Number:
  US16/727,480
• Publication Number:
  US 20200137110A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The present disclosure relates generally to computer security, and, more particularly, to systems and methods for assisting a user in avoiding the accidental disclosure of confidential or sensitive information, as well as avoiding potential security breaches, including phishing and impersonation, malware, and security issues, particularly with respect to websites and electronic communications.

Claims

1. A system for proactively providing a user with security-related information associated with content on a computing device prior to user interaction with such content, the system comprising:

a processor coupled to a non-transitory memory containing instructions executable by the processor to cause the system to;

monitor content delivered to, or queued to be delivered to, a computing device associated with the user;

analyze the content to determine whether the content requires disclosure of information and/or poses a security threat; and

output to the user, at least prior to and/or during user interaction with the content, security-related information associated with the content based, at least in part, on the analysis of the content and/or prevent any subsequent user interaction with the content based, at least in part, on the analysis of the content.

2. The system of claim 1, wherein outputting the security-related information comprises transmitting a signal to the computing device, or to a secondary computing device associated with the user, resulting in the computing device or secondary computing device outputting an alert comprising at least one of a physical indication, an audible indication, and a visual indication of whether the content poses a security threat.

3. The system of claim 2, wherein the visual indication comprises at least one of a notification, icon, pop-up warning, and modification of one or more visual aspects of the content displayed on a user interface of the computing device, a remote computing device, or a secondary remote computing device.

4. The system of claim 3, wherein the visual indication comprises an image, graphic, object, text and/or color indicating whether the content is safe or unsafe for subsequent user interaction.

5. The system of claim 1, wherein the security-related information comprises a safety assessment of the content.

6. The system of claim 5, wherein the safety assessment comprises an indication of whether the content is safe or potentially harmful if the user interacts with such content with regard to a security standpoint.

7. The system of claim 6, wherein the safety assessment comprises a recommended action that the user take with regard to the content.

8. The system of claim 6, wherein the safety assessment comprises an indication whether the content contains a virus, malware, a cyberattack mechanism including phishing, or a combination thereof.

9. The system of claim 6, wherein the safety assessment comprises an indication whether a claimed provenance or authorship of the content appears to be valid.

10. The system of claim 1, wherein the content is associated with at least one of a software application, operating system, website, email, instant message, text message, and telecommunication.

11. The system of claim 10, wherein the analysis comprises identifying one or more information resources associated with the content and determining whether the one or more information resources pose a security threat.

12. The system of claim 11, wherein the one or more information resources comprises a link, an icon, an attachment, or other visual representation of an information resource.

13. The system of claim 12, wherein the visual representation is an email address or a link associated with a domain.

14. The system of claim 10, wherein the analysis comprises a correlation of data associated with the content to a set of data associated with trusted content and flagging the content as being legitimate and safe or flagging the content as being illegitimate and unsafe based on the correlation.

15. The system of claim 14, wherein the content is flagged as being legitimate and safe based on a positive correlation and the content is flagged as being illegitimate and unsafe based on a negative correlation.

16. The system of claim 14, wherein the content data and the trusted content data comprises at least one of domain name(s), Uniform Resource Locator(s) (URL), Uniform Resource Identifier(s) (URIs), Internet Protocol addresses, HTML structure, webpage resources, including images, and a combination thereof.

17. The system of claim 16, wherein the analysis comprises a graphical comparison comprising either a full comparison or a partial comparison of a screen image of the content to a screen image of trusted content and the flagging of the content is based, at least in part, on the graphical comparison.

18. The system of claim 17, wherein the analysis comprises determining a suspicion score based on the correlation, wherein the suspicion score is a similarity metric determined based on a degree of similarity between a display representation of the content and a display representation of the trusted content.

19. The system of claim 1, wherein the processor is provided locally on the computing device or provided on a server remote from the computing device.

20. The system of claim 19, wherein the processor is associated with at least one of an operating system of the computing device, a plugin for use with an application running on the computing device, a software application installed on, or queued to be installed on, the computing device, and a cloud-based service to which the computing device communicates.